saasfunnels 0.2.0 → 0.2.2

package/README.md

@@ -10,10 +10,10 @@ This repository contains only the MIT-licensed CLI and its bounded runtime contr
 
 ## Install
 
-After the beta is published:
+Install the stable CLI:
 
 ```bash
-npm install --global saasfunnels@beta
+npm install --global saasfunnels
 ```
 
 ## Use
@@ -24,12 +24,57 @@ saasfunnels verify --json
 saasfunnels mcp serve
 ```
 
+### Plans and pricing
+
+```bash
+saasfunnels plans discover              # propose files, no network call
+saasfunnels plans discover --apply      # write .saasfunnels/plan-sources.json
+saasfunnels plans handoff --integration-id <id> \
+  --repository-key <repo> --repository-revision <sha> --send
+```
+
+`plans discover` reads the working tree and proposes files that define plans and
+prices. Files that reference a Stripe price are reported as evidence; files that
+only look commercial by name and content are reported separately as guesses.
+Nothing leaves the machine until `.saasfunnels/plan-sources.json` lists the files
+and `plans handoff --send` is run, because plan mapping receives file contents
+rather than the `file:line` references a feature manifest sends. Commit that file
+so the approved set is reviewable.
+
+### GitHub Action
+
+```yaml
+- uses: LeadEngine-ai/saasfunnels-cli/action@v0.2.1
+  with:
+    api-key: ${{ secrets.SAASFUNNELS_API_KEY }}
+    cli-version: 0.2.1          # pin it; a floating version rebaselines drift
+    discovery-roots: app,lib
+```
+
+On a pull request the Action scans as a `candidate`: the result is compared
+against the branch's baseline and discarded. Only the default branch advances
+the lineage. Changing `discovery-roots` starts a new lineage, so drift is
+measured against a comparable scan rather than a wider or narrower one.
+
+Plan and pricing upload is opt-in:
+
+```yaml
+    plan-sources: "true"
+    integration-id: <stripe integration id>
+```
+
+It runs only on the default branch, requires a committed
+`.saasfunnels/plan-sources.json`, and fails with an explanation rather than
+uploading anything if that file is missing.
+
 Local validation does not require credentials. Live reads use `SAASFUNNELS_API_KEY`; Direct API smoke events use `SAASFUNNELS_INGEST_API_KEY`. Set `SAASFUNNELS_API_BASE_URL` to target a controlled preview or the current SaaSFunnels host.
 
 Hosted interactive MCP uses Clerk OAuth at the application `/mcp` URL and does not require this CLI or a copied API key.
 
 The application imports the exact versioned MCP registry through the server-side `saasfunnels/library` export. This keeps hosted Streamable HTTP and local stdio MCP on one package owner; it is not a browser API.
 
+In hosted OAuth, `list_workspaces` discovers accessible workspace names and IDs. Live read, inspect, and plan tools accept an optional `workspace_id`. The hosted application must select the sole accessible workspace automatically, require an explicit ID when several are accessible, recheck authorization for every call, and include the selected workspace name and ID in each live response. The application passes the selection through to its developer API as the `workspace_id` query parameter. Local stdio API-key tools do not expose workspace selection; their key stays pinned to its workspace.
+
 ## Development
 
 ```bash

package/dist/library.js

@@ -24260,7 +24260,7 @@ function validateFeatureCatalogManifest(value) {
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.1.0-beta.1";
+var SAASFUNNELS_CLI_VERSION = "0.2.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({
@@ -24299,6 +24299,7 @@ var saasFunnelsMcpToolCapabilityIds = {
   get_integration_health: "developer.workspace.read",
   get_signal_payload_preview: "developer.workspace.read",
   get_workspace_readiness: "developer.workspace.read",
+  list_workspaces: "developer.workspace.read",
   inspect_funnel_entry: "funnel.entry.inspect",
   list_mapping_gaps: "developer.workspace.read",
   list_recent_signals: "developer.workspace.read",
@@ -24399,7 +24400,7 @@ function objectArg(args, name) {
 function sanitizeString(value) {
   const withoutSecrets = value.replace(
     tokenPattern,
-    (candidate) => /^[A-Z0-9_]+$/.test(candidate) ? candidate : "[redacted-token]"
+    (candidate) => /^[A-Z0-9_]+$/.test(candidate) || /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(candidate) ? candidate : "[redacted-token]"
   ).replace(emailPattern3, "[redacted-email]");
   try {
     const parsed = new URL(
@@ -24668,6 +24669,25 @@ function emptyLiveInputSchema() {
     type: "object"
   };
 }
+var hostedWorkspaceToolNames = /* @__PURE__ */ new Set([
+  "get_integration_health",
+  "get_workspace_readiness",
+  "list_mapping_gaps",
+  "list_recent_signals",
+  "get_signal_payload_preview",
+  "inspect_funnel_entry",
+  "propose_funnel_entry_installation",
+  "get_account_strategy",
+  "simulate_account_funnel_fit"
+]);
+function developerPathForWorkspace(path, args, options) {
+  if (!options.hostedMode) return path;
+  if ("workspace_id" in args && !stringArg(args, "workspace_id")) {
+    throw new McpProtocolError(-32602, "workspace_id must be a non-empty string.");
+  }
+  const workspaceId = stringArg(args, "workspace_id");
+  return workspaceId ? `${path}${path.includes("?") ? "&" : "?"}workspace_id=${encodeURIComponent(workspaceId)}` : path;
+}
 function saasFunnelsMcpToolDefinitions({
   allowFunnelTests = false,
   allowFunnelWrites = false,
@@ -25030,6 +25050,29 @@ function hostedSaaSFunnelsMcpToolDefinitions() {
       capability2 && agentCapabilityAllowedAtBoundary(capability2.id, "hosted_mcp")
     );
   });
+  for (const tool of tools) {
+    if (!hostedWorkspaceToolNames.has(tool.name)) continue;
+    const properties = tool.inputSchema.properties;
+    properties.workspace_id = {
+      description: "Workspace ID from list_workspaces. Required when your OAuth identity can access multiple workspaces; optional when it can access one. The server verifies access for every call.",
+      type: "string"
+    };
+  }
+  tools.push({
+    annotations: {
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "List the names and IDs of workspaces accessible to the OAuth user. Use a workspace ID from this list to target live tools when more than one workspace is accessible.",
+    inputSchema: {
+      additionalProperties: false,
+      properties: {},
+      type: "object"
+    },
+    name: "list_workspaces",
+    title: "List Workspaces"
+  });
   assertMcpToolCapabilityContract(tools, "hosted_mcp");
   return tools;
 }
@@ -25055,7 +25098,7 @@ async function developerGet(path, args, options) {
     });
   }
   const response = await (options.fetch ?? fetch)(
-    `${apiBaseUrl(options, args)}${path}`,
+    `${apiBaseUrl(options, args)}${developerPathForWorkspace(path, args, options)}`,
     {
       headers: {
         authorization
@@ -25091,7 +25134,7 @@ async function developerPost(path, args, body, options, requiredScope) {
     });
   }
   const response = await (options.fetch ?? fetch)(
-    `${apiBaseUrl(options, args)}${path}`,
+    `${apiBaseUrl(options, args)}${developerPathForWorkspace(path, args, options)}`,
     {
       body: JSON.stringify(body),
       headers: {
@@ -25161,11 +25204,17 @@ async function sendTestEvent(args, options) {
 }
 async function callSaaSFunnelsMcpTool(name, args, options = {}) {
   try {
-    if ((name === "get_account_strategy" || name === "simulate_account_funnel_fit") && !options.hostedMode) {
+    if (!options.hostedMode && "workspace_id" in args && hostedWorkspaceToolNames.has(name)) {
+      throw new McpProtocolError(
+        -32602,
+        "workspace_id is available only with hosted OAuth; an API key is pinned to its workspace."
+      );
+    }
+    if ((name === "get_account_strategy" || name === "simulate_account_funnel_fit" || name === "list_workspaces") && !options.hostedMode) {
       throw new McpToolExecutionError(
-        "This account tool requires hosted OAuth.",
+        "This tool requires hosted OAuth.",
         {
-          error: "This account tool requires hosted OAuth.",
+          error: "This tool requires hosted OAuth.",
           ok: false,
           required_boundary: "hosted_mcp"
         }
@@ -25208,6 +25257,10 @@ async function callSaaSFunnelsMcpTool(name, args, options = {}) {
           options
         )
       );
+    if (name === "list_workspaces")
+      return structuredToolResult(
+        await developerGet("/api/developer-tools/workspaces", {}, options)
+      );
     if (name === "get_workspace_readiness")
       return structuredToolResult(
         await developerGet(