@myapihq/cli 2.26.1 → 2.27.1

package/dist/commands/authproduct.js

@@ -9,6 +9,10 @@ import { requireOrg } from '../helpers.js';
 // OIDC endpoints (discovery/jwks/authorize/token/userinfo) are consumed by
 // apps + the JS SDK, not the CLI, so only the management surface is here.
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     type: 'string', // spa | web
     redirect: 'list', // comma-separated OR repeated; occurrences accumulate

package/dist/commands/container.js

@@ -20,6 +20,10 @@ export const EXPOSES = [
     'DELETE /container/orgs/{org_id}/containers/{id}/domain',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     type: 'string',
     cron: 'string',

package/dist/commands/doctor.js

@@ -32,7 +32,11 @@ export const EXPOSES = [
     // Lifetime delivery counts, to replace the 30-day 'quiet webhook' advice.
     'GET /webhook/orgs/{org_id}/deliveries',
 ];
-export const SCHEMA = {};
+export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it.
+    org: 'string',
+};
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
 const C = useColor ? {
     ok: '\x1b[32m', warn: '\x1b[33m', err: '\x1b[31m',

package/dist/commands/feedback.js

@@ -22,6 +22,10 @@ export const EXPOSES = [
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     // Declared because `list` reads flags.limit/offset, --help documents both,
     // and a truncated page prints "raise --limit" — while the parser refused
     // them as unknown. Reported by ImmoPilot on 2026-08-19.

package/dist/commands/fn.js

@@ -15,6 +15,10 @@ export const EXPOSES = [
     'PATCH /function/orgs/{org_id}/functions/{id}/scopes',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     // `create` takes a positional name; --name stays accepted for
     // back-compat (RELEASING.md's stated convention) and must be declared
     // here so the command-aware flag check in index.ts doesn't flag it.

package/dist/commands/funnel-pages-content.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/funnel-pages-content.test.js

@@ -0,0 +1,75 @@
+// `funnel push` overwrites whatever is live at the target, and nothing could
+// tell you what that was.
+//
+// `funnel pages` listed paths only. The API has supported ?include_content=true
+// all along; no client ever sent it. So an agent asked to change one section of
+// a published page had two options: regenerate the whole page from scratch, or
+// scrape the public URL and hope. Every funnel edit was a blind write.
+//
+// Found by asking the reverse-coverage question of QUERY parameters rather than
+// request bodies — the direction the request-field linter documents as out of
+// scope, and the same blind spot that hid `?confirm=` on org delete.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const FUNNEL = 'f1';
+const sdk = vi.hoisted(() => ({
+    funnel: { listFunnelPages: vi.fn() },
+    hq: { listOrgs: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+let printed;
+beforeEach(async () => {
+    printed = [];
+    vi.clearAllMocks();
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(typeof m === 'string' ? m : JSON.stringify(m)); });
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'printTable').mockImplementation(cap);
+    vi.spyOn(output, 'banner').mockImplementation(() => { });
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function run(flags) {
+    const { pages } = await import('./funnel.js');
+    try {
+        await pages(FUNNEL, flags);
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('funnel pages --with-content', () => {
+    it('asks the API for content, so an edit can read before it writes', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, { includeContent: true });
+    });
+    it('does not ask for it otherwise — listing paths must stay cheap', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/' }]);
+        await run({ json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, undefined);
+    });
+    it('puts the content in --json, which is what an agent reads', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(printed.join('\n')).toContain('<h1>live</h1>');
+    });
+    it('keeps HTML out of the human view, showing sizes instead', async () => {
+        // Six pages of markup in a terminal buries the thing being looked for.
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true });
+        const out = printed.join('\n');
+        expect(out).not.toContain('<h1>live</h1>');
+        expect(out).toContain('13');
+    });
+});

package/dist/commands/funnel.js

@@ -24,10 +24,16 @@ export const EXPOSES = [
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     funnel: 'string',
     slug: 'string',
     env: 'string',
     force: 'boolean',
+    // \`funnel pages --with-content\` — read what is live before overwriting it.
+    'with-content': 'boolean',
     'api-fn': 'string',
     // form
     fields: 'string',
@@ -214,7 +220,11 @@ export async function pages(funnelArg, flags) {
     const funnelId = funnelArg || flags.funnel || config.default_funnel;
     if (!funnelId)
         error('Missing funnel id. Pass it as a positional arg, --funnel <id>, or set: myapi config set-funnel <id>');
-    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    // --with-content is what makes an edit a read-then-write instead of a blind
+    // overwrite. `funnel push` replaces whatever is live at the target, and until
+    // now nothing could tell you what that was: an agent asked to change one
+    // section had to regenerate the whole page or scrape the public URL.
+    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId, flags['with-content'] ? { includeContent: true } : undefined);
     // An empty inventory is not proof the funnel is empty. Verified 2026-07-28:
     // a funnel answering 200 with real content on both its subdomain and a bound
     // custom domain reported `{"pages":[]}`. Someone auditing what is deployed
@@ -244,10 +254,21 @@ export async function pages(funnelArg, flags) {
         printJson(list);
         return;
     }
-    printTable(list, {
+    // Human output never dumps the content — six pages of HTML in a terminal
+    // buries the thing being looked for. The size is the useful summary; --json
+    // carries the content itself, which is the shape an agent reads anyway.
+    printTable(flags['with-content']
+        ? list.map(p => ({
+            slug: p.slug,
+            bytes: typeof p.content === 'string' ? p.content.length : '—',
+            updated_at: p.updated_at ?? '',
+        }))
+        : list, {
         flags,
         empty: 'No pages published to this funnel yet. Push one with: echo "<h1>Hello</h1>" | myapi funnel push /',
     });
+    if (flags['with-content'])
+        info('  Content is in --json; this view shows sizes so a terminal is not flooded.');
 }
 export async function push(slug, flags) {
     const config = requireConfig();
@@ -660,7 +681,11 @@ future platform features (rate-limit, captcha, field validation) for
 free.`,
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'list': 'myapi funnel list [--org <id>] [--json]',
-    'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
+    'pages': `myapi funnel pages [funnel_id] [--funnel <id>] [--with-content] [--org <id>] [--json]
+
+Lists what is published. --with-content also fetches each page's live content, which
+is how you read a page before overwriting it — \`funnel push\` replaces whatever
+is there. Human output shows sizes; --json carries the content.`,
     'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--force] [--org <id>]
 
 Uploads a whole local directory as the funnel's site. Each file's path

package/dist/commands/git.js

@@ -24,6 +24,10 @@ export const EXPOSES = [
     'POST /git/orgs/{org_id}/repos/{repo}/repack',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     'default-branch': 'string',
     ref: 'string',

package/dist/commands/payments.js

@@ -13,6 +13,10 @@ export const EXPOSES = [
     'POST /payments/webhook/{org_id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     'stripe-key': 'string',
     amount: 'string',
     description: 'string',

package/dist/commands/queue.js

@@ -13,6 +13,10 @@ export const EXPOSES = [
     'GET /queue/orgs/{org_id}/jobs/{id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     'consumer-url': 'string',
     'max-attempts': 'number',

package/dist/commands/task.js

@@ -22,6 +22,10 @@ function taskOrigin(flags) {
     return typeof v === 'string' ? v : undefined;
 }
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     body: 'string',
     importance: 'string',
     due: 'string',

package/dist/org-flag-declared.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-flag-declared.test.js

@@ -0,0 +1,66 @@
+// A command that reads `--org` must declare it.
+//
+// Ten command modules called requireOrg() — which reads flags.org — without
+// listing `org` in their SCHEMA. The flag still worked, because requireOrg
+// reads the raw flags. But the foreign-flag check did not know about it, so
+// every one of them answered a correct command with:
+//
+//   › Note: unknown flag(s) not recognized by this command: --org
+//     (took value "c2c4810d-…") — check for typos.
+//
+// and then used the value anyway. `funnel list --org <other>` returned the
+// other org's funnels while calling the flag a typo.
+//
+// This is not cosmetic. `--org` is the flag that keeps a write in the right
+// tenant, and telling people it is unrecognized is an invitation to drop it and
+// rely on the machine-wide default — which is precisely the habit behind the
+// cross-project collisions customers report. An agent reading stderr is even
+// likelier to "fix" the typo by removing the flag.
+//
+// Found by running a real command and reading what it printed, not from a test.
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const COMMANDS_DIR = fileURLToPath(new URL('./commands/', import.meta.url));
+function moduleFiles() {
+    const out = [];
+    for (const entry of readdirSync(COMMANDS_DIR).sort()) {
+        const p = path.join(COMMANDS_DIR, entry);
+        if (statSync(p).isDirectory()) {
+            const idx = path.join(p, 'index.ts');
+            try {
+                statSync(idx);
+                out.push(`${entry}/index.ts`);
+            }
+            catch { /* no dispatcher */ }
+        }
+        else if (entry.endsWith('.ts') && !entry.includes('.test.')) {
+            out.push(entry);
+        }
+    }
+    return out;
+}
+describe('every command that reads --org declares it', () => {
+    const files = moduleFiles();
+    it('found command modules (or this proves nothing)', () => {
+        expect(files.length).toBeGreaterThan(10);
+    });
+    it('no module uses requireOrg without declaring org in its SCHEMA', () => {
+        const undeclared = [];
+        for (const file of files) {
+            const src = readFileSync(path.join(COMMANDS_DIR, file), 'utf8');
+            const readsOrg = /\brequireOrg\s*\(|\brequireExplicitOrg\s*\(/.test(src);
+            if (!readsOrg)
+                continue;
+            // A module with no SCHEMA of its own inherits nothing — it still needs
+            // the declaration, so absence counts as undeclared rather than exempt.
+            const declares = /^\s*org:\s*'string',/m.test(src);
+            if (!declares)
+                undeclared.push(file);
+        }
+        expect(undeclared, `${undeclared.join(', ')} call requireOrg but do not declare ` +
+            "`org: 'string'` in SCHEMA. The flag will still work and the CLI will call it a " +
+            'typo — on the one flag that keeps a write in the right tenant.').toEqual([]);
+    });
+});

package/dist/skills/my-funnel-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-funnel-api
-version: 1.0.0
+version: 1.0.1
 description: >
   Create and publish websites (funnels) to the edge. Push raw HTML to any slug and it goes live instantly on your org's domain or preview subdomain.
 triggers: [funnel, landing page, website, page, publish, push, slug, html, edge, preview subdomain, makeautonomous]
-checksum: sha256-24c12e48a6153087641369319ac67e79c1fa36b950b140621d1e118128755b53
+checksum: sha256-7bcaeef9bd17839aa28c62a8e39f67e29a39967397f9e0ee717e19765983e499
 ---
 
 # MyFunnelAPI
@@ -19,7 +19,7 @@ Funnels are the publishing surface. You create a funnel under an org (one comman
 
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
-Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and exposes two public proxy endpoints your HTML can call without an API key: a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` (delivers through that webhook — CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. Bind individual slugs to other destinations with `myapi funnel form ... --capture-to webhook:<id>`.
+Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`) and exposes two public endpoints your HTML can call without an API key: **form submit** at `POST /funnel/funnels/{id}/submit/{slug}`, which delivers through that webhook (CRM upsert + bound workflows fire automatically), and **event ingest** for pageviews and click tracking. Send a slug elsewhere with `myapi funnel form ... --capture-to webhook:<id>`.
 <!-- llm:end -->
 
 ## Commands
@@ -32,7 +32,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
 | `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
-| `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
+| `myapi funnel pages [funnel_id]` | Pages published to a funnel; `--with-content` fetches what is on them |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (`--capture-to`, `--cta`, `--success`, `--honeypot`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
@@ -42,7 +42,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 A write targets a `(org, funnel, slug)` address. Get all three right *before* pushing — the CLI will help, but the thinking is yours:
 
 1. **Confirm the org.** `--org` (or `default_org`) decides whose namespace you touch. For a demo or a new project, pass `--org <id>` explicitly every time — don't trust the ambient default. `myapi org list` shows the orgs you can reach.
-2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what's already published. If a slug is taken by something real, you're about to replace it.
+2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what is published, and `--with-content` what is on each page (`--json` carries it). `push` replaces a whole page, so edit by reading it first.
 3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
 4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.26.1",
+  "version": "2.27.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.26.1"
+    "@myapihq/sdk": "^2.27.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",