@myapihq/sdk 1.2.4 → 1.2.6

package/dist/config.d.ts

@@ -1,6 +1,8 @@
 export declare const HQ_BASE: string;
 export declare const DOMAIN_BASE: string;
 export declare const FUNNEL_BASE: string;
+export declare const FUNCTION_BASE: string;
+export declare const PAYMENTS_BASE: string;
 export declare const IMAGE_BASE: string;
 export declare const WEBHOOK_BASE: string;
 export declare const WORKFLOW_BASE: string;

package/dist/config.js

@@ -8,11 +8,15 @@
 // local dev — `source scripts/local-env.sh` still points everything at
 // localhost:8080 regardless of the prod default.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CRM_BASE = exports.DATABASE_BASE = exports.LLM_BASE = exports.AUDIENCE_BASE = exports.COMPANY_BASE = exports.PEOPLE_BASE = exports.PIXEL_BASE = exports.URL_BASE = exports.STORAGE_BASE = exports.EMAIL_BASE = exports.WORKFLOW_BASE = exports.WEBHOOK_BASE = exports.IMAGE_BASE = exports.FUNNEL_BASE = exports.DOMAIN_BASE = exports.HQ_BASE = void 0;
+exports.CRM_BASE = exports.DATABASE_BASE = exports.LLM_BASE = exports.AUDIENCE_BASE = exports.COMPANY_BASE = exports.PEOPLE_BASE = exports.PIXEL_BASE = exports.URL_BASE = exports.STORAGE_BASE = exports.EMAIL_BASE = exports.WORKFLOW_BASE = exports.WEBHOOK_BASE = exports.IMAGE_BASE = exports.PAYMENTS_BASE = exports.FUNCTION_BASE = exports.FUNNEL_BASE = exports.DOMAIN_BASE = exports.HQ_BASE = void 0;
 const GATEWAY = 'https://api.myapihq.com';
 exports.HQ_BASE = process.env.MYAPI_HQ_URL ?? process.env.MYAPI_API_BASE ?? GATEWAY;
 exports.DOMAIN_BASE = process.env.MYAPI_DOMAIN_URL ?? 'https://api.mydomainapi.com';
 exports.FUNNEL_BASE = process.env.MYAPI_FUNNEL_URL ?? 'https://api.myfunnelapi.com';
+// New slots — routed via the gateway until brand hosts are DNS-wired
+// (mirrors the LLM/DATABASE/CRM pattern below).
+exports.FUNCTION_BASE = process.env.MYAPI_FUNCTION_URL ?? GATEWAY;
+exports.PAYMENTS_BASE = process.env.MYAPI_PAYMENTS_URL ?? GATEWAY;
 exports.IMAGE_BASE = process.env.MYAPI_IMAGE_URL ?? 'https://api.myimageapi.com';
 exports.WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
 exports.WORKFLOW_BASE = process.env.MYAPI_WORKFLOW_URL ?? 'https://api.myworkflowapi.com';

package/dist/domain.d.ts

@@ -67,8 +67,17 @@ export interface ImportDomainResponse {
 export declare function importDomain(apiKey: string, orgId: string, domain: string): Promise<ImportDomainResponse>;
 export declare function listDomains(apiKey: string, orgId: string, filter?: string): Promise<DomainRecord[]>;
 export declare function getDomainStatus(apiKey: string, orgId: string, domain: string): Promise<DomainRecord>;
-export declare function assignDomain(apiKey: string, orgId: string, domain: string): Promise<DomainRecord>;
-export declare function unassignDomain(apiKey: string, orgId: string, domain: string): Promise<DomainRecord>;
+export interface AssignDomainResponse {
+    domain: string;
+    org_id: string | null;
+    include_www: boolean;
+    routes_bound: string[];
+}
+export declare function assignDomain(apiKey: string, orgId: string, domain: string, opts?: {
+    includeWww?: boolean;
+    funnelId?: string;
+}): Promise<AssignDomainResponse>;
+export declare function unassignDomain(apiKey: string, orgId: string, domain: string): Promise<AssignDomainResponse>;
 export declare function getDomainSettings(apiKey: string, orgId: string, domain: string): Promise<DomainSettings>;
 export type DnsRecordType = 'A' | 'AAAA' | 'CNAME' | 'MX' | 'TXT';
 export interface DnsRecord {

package/dist/domain.js

@@ -61,8 +61,18 @@ async function listDomains(apiKey, orgId, filter) {
 async function getDomainStatus(apiKey, orgId, domain) {
     return (0, client_1.request)('GET', `${config_1.DOMAIN_BASE}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/status`, apiKey);
 }
-async function assignDomain(apiKey, orgId, domain) {
-    return (0, client_1.request)('POST', `${config_1.DOMAIN_BASE}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, { org_id: orgId });
+async function assignDomain(apiKey, orgId, domain, opts) {
+    const body = { org_id: orgId };
+    if (opts?.includeWww === false)
+        body.include_www = false;
+    // Backend (2026-05-15): optional funnel_id picks which funnel the domain
+    // is bound to. Defaults server-side to the org's only funnel (or first
+    // when ambiguous, today; will become required once N-funnels-per-org lands
+    // for real). Pre-emptively threading it through gives agents a way to be
+    // explicit when the migration completes without an SDK shape change.
+    if (opts?.funnelId)
+        body.funnel_id = opts.funnelId;
+    return (0, client_1.request)('POST', `${config_1.DOMAIN_BASE}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, body);
 }
 async function unassignDomain(apiKey, orgId, domain) {
     return (0, client_1.request)('POST', `${config_1.DOMAIN_BASE}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, { org_id: null });

package/dist/function.d.ts

@@ -0,0 +1,43 @@
+import type { Exposes } from './exposes';
+export declare const EXPOSES: Exposes;
+export type TriggerType = 'http' | 'cron';
+export interface Fn {
+    id: string;
+    org_id: string;
+    name: string;
+    trigger_type: TriggerType;
+    cron_schedule?: string;
+    invocation_url: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface CreatePayload {
+    name: string;
+    trigger_type?: TriggerType;
+    cron_schedule?: string;
+}
+export interface CreateResponse {
+    function: Fn;
+    scoped_api_key: string;
+    scoped_api_key_id: string;
+}
+export interface DeployResponse {
+    function: Fn;
+    invocation_url: string;
+    scoped_api_key: string;
+}
+export interface FunctionRun {
+    id: string;
+    function_id: string;
+    invoked_at: string;
+    duration_ms?: number;
+    status?: string;
+    error_message?: string;
+}
+export declare function createFunction(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse>;
+export declare function listFunctions(apiKey: string, orgId: string): Promise<Fn[]>;
+export declare function getFunction(apiKey: string, orgId: string, fnId: string): Promise<Fn>;
+export declare function deleteFunction(apiKey: string, orgId: string, fnId: string): Promise<void>;
+export declare function uploadBundle(apiKey: string, orgId: string, fnId: string, bundle: Blob | Buffer | string, filename?: string): Promise<DeployResponse>;
+export declare function setFunctionEnv(apiKey: string, orgId: string, fnId: string, name: string, value: string): Promise<void>;
+export declare function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]>;

package/dist/function.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPOSES = void 0;
+exports.createFunction = createFunction;
+exports.listFunctions = listFunctions;
+exports.getFunction = getFunction;
+exports.deleteFunction = deleteFunction;
+exports.uploadBundle = uploadBundle;
+exports.setFunctionEnv = setFunctionEnv;
+exports.listFunctionRuns = listFunctionRuns;
+const client_1 = require("./client");
+const config_1 = require("./config");
+// Backend: Story 1 (metadata + scoped API key) and Story 2/4/5 (deploy,
+// runs, env) per myapi-hq/internal/routes/function/. The /logs endpoint is
+// still pending — do not add forward-compat fields the backend will ignore.
+exports.EXPOSES = [
+    'POST /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions/{id}',
+    'DELETE /function/orgs/{org_id}/functions/{id}',
+    'POST /function/orgs/{org_id}/functions/{id}/bundle',
+    'POST /function/orgs/{org_id}/functions/{id}/env',
+    'GET /function/orgs/{org_id}/functions/{id}/runs',
+];
+async function createFunction(apiKey, orgId, payload) {
+    return (0, client_1.request)('POST', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey, payload);
+}
+async function listFunctions(apiKey, orgId) {
+    return (0, client_1.request)('GET', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey);
+}
+async function getFunction(apiKey, orgId, fnId) {
+    return (0, client_1.request)('GET', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
+}
+async function deleteFunction(apiKey, orgId, fnId) {
+    return (0, client_1.request)('DELETE', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
+}
+// uploadBundle deploys a single-file JS bundle (Story 2). The backend
+// wraps it with the MYAPI shim and uploads to Cloudflare Workers. The
+// multipart field MUST be named `bundle`. Raw upload cap is 4MB.
+async function uploadBundle(apiKey, orgId, fnId, bundle, filename = 'bundle.js') {
+    const formData = new FormData();
+    formData.append('bundle', new Blob([bundle], { type: 'application/javascript' }), filename);
+    const response = await fetch(`${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/bundle`, { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData });
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw new client_1.MyApiError('invalid_json_response', response.status);
+    }
+    if (!response.ok || !result?.success) {
+        const err = result?.error;
+        const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+        const detail = typeof err === 'object' ? err?.message : undefined;
+        throw new client_1.MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+    }
+    return result.data;
+}
+// setFunctionEnv writes a secret (Stripe key, etc.) as a Cloudflare Worker
+// Secret on the deployed script (Story 5). The function must already be
+// deployed. The value is never stored in MyAPI Postgres or returned.
+async function setFunctionEnv(apiKey, orgId, fnId, name, value) {
+    return (0, client_1.request)('POST', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
+}
+// listFunctionRuns returns recent invocation records, most recent first
+// (Story 4). Capped at 100 server-side.
+async function listFunctionRuns(apiKey, orgId, fnId) {
+    return (0, client_1.request)('GET', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/runs`, apiKey);
+}

package/dist/funnel.d.ts

@@ -3,6 +3,7 @@ export declare const EXPOSES: Exposes;
 export interface Funnel {
     id: string;
     org_id: string;
+    name?: string;
     created_at: string;
     updated_at: string;
 }
@@ -24,7 +25,9 @@ export interface VerifyTest {
     passed: boolean;
     details: string;
 }
-export declare function createFunnel(apiKey: string, orgId: string): Promise<CreateFunnelResponse>;
+export declare function createFunnel(apiKey: string, orgId: string, opts?: {
+    name?: string;
+}): Promise<CreateFunnelResponse>;
 export declare function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<Funnel>;
 export declare function listFunnels(apiKey: string, orgId: string): Promise<Funnel[]>;
 export declare function deleteFunnel(apiKey: string, orgId: string, funnelId: string): Promise<void>;
@@ -46,3 +49,21 @@ export declare function verifyFunnel(apiKey: string, orgId: string, funnelId: st
     html?: string;
     slug?: string;
 }): Promise<VerifyResult>;
+export interface PublishFile {
+    path: string;
+    content: Blob | Buffer | string;
+}
+export interface PublishOptions {
+    env?: 'dev' | 'prod';
+    spaMode?: boolean;
+    apiFunctionId?: string;
+}
+export interface PublishResult {
+    manifest_id: string;
+    channel: 'dev' | 'prod';
+    file_count: number;
+    size_bytes: number;
+    spa_mode: boolean;
+    published_url: string;
+}
+export declare function publishFiles(apiKey: string, orgId: string, funnelId: string, files: PublishFile[], opts?: PublishOptions): Promise<PublishResult>;

package/dist/funnel.js

@@ -8,6 +8,7 @@ exports.deleteFunnel = deleteFunnel;
 exports.pushFunnelPage = pushFunnelPage;
 exports.listFunnelPages = listFunnelPages;
 exports.verifyFunnel = verifyFunnel;
+exports.publishFiles = publishFiles;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
@@ -18,9 +19,12 @@ exports.EXPOSES = [
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
 ];
-async function createFunnel(apiKey, orgId) {
-    return (0, client_1.request)('POST', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, {});
+async function createFunnel(apiKey, orgId, opts) {
+    // v2: accept optional name for N-funnels-per-org. Backend rejects names
+    // matching the reserved-suffix rules; agent should pre-validate.
+    return (0, client_1.request)('POST', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, opts?.name ? { name: opts.name } : {});
 }
 async function getFunnel(apiKey, orgId, funnelId) {
     return (0, client_1.request)('GET', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`, apiKey);
@@ -46,3 +50,33 @@ async function listFunnelPages(apiKey, orgId, funnelId) {
 async function verifyFunnel(apiKey, orgId, funnelId, opts) {
     return (0, client_1.request)('POST', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/verify`, apiKey, opts || {});
 }
+// publishFiles is the my-funnel-api v2 directory publish. Every file is a
+// multipart part named `files`; the part's filename carries the site path.
+// 25MB total cap server-side.
+async function publishFiles(apiKey, orgId, funnelId, files, opts = {}) {
+    const formData = new FormData();
+    for (const f of files) {
+        formData.append('files', new Blob([f.content]), f.path);
+    }
+    if (opts.env)
+        formData.append('env', opts.env);
+    if (opts.spaMode !== undefined)
+        formData.append('spa_mode', String(opts.spaMode));
+    if (opts.apiFunctionId)
+        formData.append('api_function_id', opts.apiFunctionId);
+    const response = await fetch(`${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/files`, { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData });
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw new client_1.MyApiError('invalid_json_response', response.status);
+    }
+    if (!response.ok || !result?.success) {
+        const err = result?.error;
+        const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+        const detail = typeof err === 'object' ? err?.message : undefined;
+        throw new client_1.MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+    }
+    return result.data;
+}

package/dist/hq.d.ts

@@ -39,6 +39,25 @@ export interface AccountInfo {
     account_id: string;
     email?: string;
     is_anonymous?: boolean;
+    spend_cap_cents?: number;
+    current_period_spend_cents?: number;
+}
+export type GrantAccess = 'read' | 'write';
+export type Grants = Record<string, GrantAccess>;
+export declare const GRANTABLE_SLOTS: readonly ["domain", "email", "funnel", "storage", "image", "webhook", "workflow", "function", "url", "people", "company", "audience", "llm", "database", "crm"];
+export type KeyKind = 'account' | 'function' | 'manual';
+export type SpendCapPeriod = 'month' | 'day' | 'none';
+export interface ApiKey {
+    id: string;
+    name: string;
+    prefix: string;
+    kind: KeyKind;
+    org_id: string | null;
+    grants: Grants;
+    spend_cap_cents: number | null;
+    spend_cap_period: string;
+    current_period_spend_cents?: number;
+    api_key?: string;
 }
 export declare function createAnonymousAccount(): Promise<AuthResult & {
     subdomain_url: string;
@@ -55,19 +74,21 @@ export type FreeTierEntry = {
 };
 export declare function getFreeTier(apiKey: string): Promise<FreeTierEntry[] | null>;
 export declare function getAccount(apiKey: string): Promise<AccountInfo>;
-export declare function createApiKey(apiKey: string, name: string): Promise<{
-    api_key: string;
-    id: string;
-    prefix: string;
-}>;
-export declare function listApiKeys(apiKey: string): Promise<{
-    id: string;
-    name: string;
-    prefix: string;
-    created_at: string;
-    last_used_at?: string;
-}[]>;
+export interface CreateApiKeyOptions {
+    grants?: Grants;
+    orgId?: string;
+    spendCapCents?: number;
+}
+export declare function createApiKey(apiKey: string, name: string, opts?: CreateApiKeyOptions): Promise<ApiKey>;
+export declare function listApiKeys(apiKey: string): Promise<ApiKey[]>;
 export declare function revokeApiKey(apiKey: string, keyId: string): Promise<void>;
+export declare function revokeAllKeys(apiKey: string, kind?: KeyKind): Promise<{
+    revoked: number;
+}>;
+export declare function setAccountSpendCap(apiKey: string, spendCapCents: number | null, period?: SpendCapPeriod): Promise<{
+    spend_cap_cents: number | null;
+    spend_cap_period: string;
+}>;
 export declare function createOrg(apiKey: string, payload: OrgPayload): Promise<Org>;
 export declare function importOrg(apiKey: string, orgId: string, domain: string, autoAccept?: boolean): Promise<{
     job_id: string;

package/dist/hq.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPOSES = void 0;
+exports.GRANTABLE_SLOTS = exports.EXPOSES = void 0;
 exports.createAnonymousAccount = createAnonymousAccount;
 exports.sendCode = sendCode;
 exports.verifyCode = verifyCode;
@@ -10,6 +10,8 @@ exports.getAccount = getAccount;
 exports.createApiKey = createApiKey;
 exports.listApiKeys = listApiKeys;
 exports.revokeApiKey = revokeApiKey;
+exports.revokeAllKeys = revokeAllKeys;
+exports.setAccountSpendCap = setAccountSpendCap;
 exports.createOrg = createOrg;
 exports.importOrg = importOrg;
 exports.getOrgImportStatus = getOrgImportStatus;
@@ -33,7 +35,9 @@ exports.EXPOSES = [
     'GET /hq/account/free-tier',
     'POST /hq/account/create/key',
     'GET /hq/account/keys',
+    'POST /hq/account/keys/revoke-all',
     'DELETE /hq/account/delete/key/{key_id}',
+    'PATCH /hq/account/spend-cap',
     'POST /hq/orgs',
     'GET /hq/orgs',
     'GET /hq/orgs/{org_id}',
@@ -47,6 +51,13 @@ exports.EXPOSES = [
     'POST /hq/billing/setup-payment',
     'POST /hq/billing/topup',
 ];
+// The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
+// backend — keep in sync. Used to validate `--grant` client-side before the
+// network call. "*" is also valid in a Grants map but is not a slot name.
+exports.GRANTABLE_SLOTS = [
+    'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
+    'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+];
 async function createAnonymousAccount() {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/anonymous`, undefined, {});
 }
@@ -65,8 +76,18 @@ async function getFreeTier(apiKey) {
 async function getAccount(apiKey) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/me`, apiKey);
 }
-async function createApiKey(apiKey, name) {
-    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/create/key`, apiKey, { name });
+// Mints a manual API key. The requested (grants, org, spend cap) must be a
+// subset of the calling key's authority — the backend rejects escalation
+// with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.
+async function createApiKey(apiKey, name, opts = {}) {
+    const body = { name };
+    if (opts.grants)
+        body.grants = opts.grants;
+    if (opts.orgId)
+        body.org_id = opts.orgId;
+    if (opts.spendCapCents != null)
+        body.spend_cap_cents = opts.spendCapCents;
+    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/create/key`, apiKey, body);
 }
 async function listApiKeys(apiKey) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/keys`, apiKey);
@@ -74,6 +95,20 @@ async function listApiKeys(apiKey) {
 async function revokeApiKey(apiKey, keyId) {
     return (0, client_1.request)('DELETE', `${config_1.HQ_BASE}/hq/account/delete/key/${encodeURIComponent(keyId)}`, apiKey);
 }
+// The kill switch. With no `kind`, revokes every active key in the account —
+// including the caller's own; recovery is re-auth via login. A `kind` narrows
+// it to one provenance class.
+async function revokeAllKeys(apiKey, kind) {
+    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/keys/revoke-all`, apiKey, kind ? { kind } : {});
+}
+// Sets or clears the account-level spend ceiling (IAM "Layer 2"). Pass
+// `null` to clear. `period` defaults to 'month' server-side.
+async function setAccountSpendCap(apiKey, spendCapCents, period) {
+    const body = { spend_cap_cents: spendCapCents };
+    if (period)
+        body.period = period;
+    return (0, client_1.request)('PATCH', `${config_1.HQ_BASE}/hq/account/spend-cap`, apiKey, body);
+}
 async function createOrg(apiKey, payload) {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/orgs`, apiKey, payload);
 }

package/dist/index.d.ts

@@ -16,3 +16,5 @@ export * as audience from './audience';
 export * as llm from './llm';
 export * as database from './database';
 export * as crm from './crm';
+export * as fn from './function';
+export * as payments from './payments';

package/dist/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.hq = void 0;
+exports.payments = exports.fn = exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.hq = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./client"), exports);
 // Note: config constants (STORAGE_BASE etc.) are NOT re-exported from the
@@ -61,3 +61,5 @@ exports.audience = __importStar(require("./audience"));
 exports.llm = __importStar(require("./llm"));
 exports.database = __importStar(require("./database"));
 exports.crm = __importStar(require("./crm"));
+exports.fn = __importStar(require("./function"));
+exports.payments = __importStar(require("./payments"));

package/dist/payments.d.ts

@@ -0,0 +1,44 @@
+import type { Exposes } from './exposes';
+export declare const EXPOSES: Exposes;
+export interface ConnectStatus {
+    tier: string;
+    stripe_account_id: string;
+    onboarding_status: string;
+    application_fee_bps?: number;
+}
+export type ChargeInterval = 'month' | 'year';
+export interface Charge {
+    id: string;
+    amount_cents: number;
+    currency: string;
+    every?: ChargeInterval;
+    description?: string;
+    customer_email?: string;
+    status: string;
+    created_at: string;
+    succeeded_at?: string;
+    refunded_at?: string;
+}
+export interface CreateChargeResponse {
+    payment_id: string;
+    checkout_url: string;
+    status: string;
+}
+export interface CreateChargePayload {
+    amount_cents: number;
+    currency?: string;
+    email?: string;
+    description?: string;
+    every?: ChargeInterval;
+    success_url?: string;
+    cancel_url?: string;
+}
+export declare function connect(apiKey: string, orgId: string, stripeSecretKey: string, tier?: 't0' | 't1'): Promise<ConnectStatus>;
+export declare function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus>;
+export declare function createCharge(apiKey: string, orgId: string, payload: CreateChargePayload): Promise<CreateChargeResponse>;
+export declare function listCharges(apiKey: string, orgId: string): Promise<Charge[]>;
+export declare function getCharge(apiKey: string, orgId: string, chargeId: string): Promise<Charge>;
+export declare function refundCharge(apiKey: string, orgId: string, chargeId: string): Promise<{
+    id: string;
+    status: string;
+}>;

package/dist/payments.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPOSES = void 0;
+exports.connect = connect;
+exports.getConnect = getConnect;
+exports.createCharge = createCharge;
+exports.listCharges = listCharges;
+exports.getCharge = getCharge;
+exports.refundCharge = refundCharge;
+const client_1 = require("./client");
+const config_1 = require("./config");
+// Backend: my-payments-api T0 (BYO Stripe) per
+// myapi-hq/internal/routes/payments/. T1 (Connect Express) is deferred —
+// connect with tier 't1' returns 501. The webhook receiver is public
+// (Stripe signs it); it is listed here for parity but has no SDK function.
+exports.EXPOSES = [
+    'POST /payments/orgs/{org_id}/connect',
+    'GET /payments/orgs/{org_id}/connect',
+    'POST /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges/{id}',
+    'POST /payments/orgs/{org_id}/charges/{id}/refund',
+    'POST /payments/webhook/{org_id}',
+];
+// connect links the org's own Stripe account (T0 — BYO secret key). The
+// key is validated live against Stripe and stored encrypted; it never
+// touches MyAPI Postgres or a log line. Pass a 't1' tier to see the
+// 501 T1_DEFERRED path.
+async function connect(apiKey, orgId, stripeSecretKey, tier = 't0') {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey, {
+        tier,
+        stripe_secret_key: stripeSecretKey,
+    });
+}
+// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// when the org has not connected Stripe.
+async function getConnect(apiKey, orgId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);
+}
+// createCharge opens a Stripe Checkout Session on the org's connected
+// account. `every` makes it a subscription; otherwise a one-off payment.
+async function createCharge(apiKey, orgId, payload) {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey, payload);
+}
+async function listCharges(apiKey, orgId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey);
+}
+async function getCharge(apiKey, orgId, chargeId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}`, apiKey);
+}
+// refundCharge issues a full refund (v1 — partial refunds out of scope).
+async function refundCharge(apiKey, orgId, chargeId) {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}/refund`, apiKey);
+}

package/dist/services.js

@@ -187,4 +187,35 @@ exports.SERVICES = [
         status: 'ga',
         keywords: k('llm', 'completion', 'embedding', 'gemini'),
     },
+    {
+        // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
+        // `my-function-api` (the agent-discoverable brand name).
+        //
+        // Backend status: deploy/env/runs shipped (CF Workers bundle upload,
+        // invocation URL, Worker Secrets, run history). /logs still pending —
+        // 'preview' reflects "usable, not yet stable GA."
+        module: 'fn',
+        skill: 'my-function-api',
+        domain: 'myfunctionapi.com',
+        description: 'Run JavaScript functions on the edge. HTTP or cron triggers. Pre-injected MYAPI SDK scoped to the org — no auth tokens in user code.',
+        category: 'compute',
+        status: 'preview',
+        keywords: k('function', 'serverless', 'edge', 'cloudflare-workers', 'http-handler', 'cron'),
+    },
+    {
+        // CLI top-level command + SDK namespace are both `payments`; skill
+        // directory is `my-payments-api`.
+        //
+        // Backend status: T0 (BYO Stripe) shipped — connect, charges (Checkout
+        // Sessions), refunds, per-org webhook. T1 (Connect Express) is deferred
+        // (connect returns 501 T1_DEFERRED). 'preview' reflects "T0 usable, T1
+        // pending."
+        module: 'payments',
+        skill: 'my-payments-api',
+        domain: 'mypaymentsapi.com',
+        description: 'Take payments with Stripe Checkout. Connect your Stripe account, create one-off or recurring charges, and refund — hosted checkout, no card handling.',
+        category: 'compute',
+        status: 'preview',
+        keywords: k('payments', 'stripe', 'checkout', 'billing', 'subscription'),
+    },
 ];

package/dist/webhook.d.ts

@@ -19,8 +19,16 @@ export interface Delivery {
 export interface CreateEndpointOptions {
     description?: string;
     crm_email_path?: string;
+    forward_url?: string;
+}
+export interface UpdateEndpointPayload {
+    name?: string;
+    description?: string;
+    crm_email_path?: string;
+    forward_url?: string;
 }
 export declare function createEndpoint(apiKey: string, orgId: string, name: string, opts?: CreateEndpointOptions): Promise<WebhookEndpoint>;
+export declare function updateEndpoint(apiKey: string, orgId: string, endpointId: string, payload: UpdateEndpointPayload): Promise<WebhookEndpoint>;
 export declare function listEndpoints(apiKey: string, orgId: string): Promise<WebhookEndpoint[]>;
 export declare function deleteEndpoint(apiKey: string, orgId: string, endpointId: string): Promise<void>;
 export declare function getDelivery(apiKey: string, orgId: string, deliveryId: string): Promise<Delivery>;

package/dist/webhook.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXPOSES = void 0;
 exports.createEndpoint = createEndpoint;
+exports.updateEndpoint = updateEndpoint;
 exports.listEndpoints = listEndpoints;
 exports.deleteEndpoint = deleteEndpoint;
 exports.getDelivery = getDelivery;
@@ -10,6 +11,7 @@ const config_1 = require("./config");
 exports.EXPOSES = [
     'POST /webhook/orgs/{org_id}/endpoints',
     'GET /webhook/orgs/{org_id}/endpoints',
+    'PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'DELETE /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'GET /webhook/orgs/{org_id}/deliveries/{delivery_id}',
 ];
@@ -19,8 +21,13 @@ async function createEndpoint(apiKey, orgId, name, opts = {}) {
         body.description = opts.description;
     if (opts.crm_email_path !== undefined)
         body.crm_email_path = opts.crm_email_path;
+    if (opts.forward_url !== undefined)
+        body.forward_url = opts.forward_url;
     return (0, client_1.request)('POST', `${config_1.WEBHOOK_BASE}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints`, apiKey, body);
 }
+async function updateEndpoint(apiKey, orgId, endpointId, payload) {
+    return (0, client_1.request)('PATCH', `${config_1.WEBHOOK_BASE}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints/${encodeURIComponent(endpointId)}`, apiKey, payload);
+}
 async function listEndpoints(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.WEBHOOK_BASE}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints`, apiKey);
 }

package/dist/workflow.d.ts

@@ -22,6 +22,12 @@ export type WorkflowStep = {
     type: 'slack_message';
     webhook_url: string;
     text: string;
+} | {
+    type: 'http_request' | 'http';
+    url: string;
+    method?: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+    body?: string;
+    headers?: Record<string, string>;
 };
 export interface Workflow {
     id: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/config.ts

@@ -12,6 +12,10 @@ const GATEWAY = 'https://api.myapihq.com';
 export const HQ_BASE     = process.env.MYAPI_HQ_URL     ?? process.env.MYAPI_API_BASE ?? GATEWAY;
 export const DOMAIN_BASE  = process.env.MYAPI_DOMAIN_URL  ?? 'https://api.mydomainapi.com';
 export const FUNNEL_BASE  = process.env.MYAPI_FUNNEL_URL  ?? 'https://api.myfunnelapi.com';
+// New slots — routed via the gateway until brand hosts are DNS-wired
+// (mirrors the LLM/DATABASE/CRM pattern below).
+export const FUNCTION_BASE= process.env.MYAPI_FUNCTION_URL?? GATEWAY;
+export const PAYMENTS_BASE= process.env.MYAPI_PAYMENTS_URL?? GATEWAY;
 export const IMAGE_BASE   = process.env.MYAPI_IMAGE_URL   ?? 'https://api.myimageapi.com';
 export const WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
 export const WORKFLOW_BASE= process.env.MYAPI_WORKFLOW_URL?? 'https://api.myworkflowapi.com';

package/src/domain.ts

@@ -125,11 +125,29 @@ export async function getDomainStatus(apiKey: string, orgId: string, domain: str
   return request('GET', `${BASE_URL}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/status`, apiKey);
 }
 
-export async function assignDomain(apiKey: string, orgId: string, domain: string): Promise<DomainRecord> {
-  return request('POST', `${BASE_URL}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, { org_id: orgId });
+// Assign returns the bound Worker routes so the CLI can show users what's
+// live without hardcoding "apex + www" (which would skew if backend changes
+// the default convention). `include_www` defaults to true at the backend.
+export interface AssignDomainResponse {
+  domain: string;
+  org_id: string | null;
+  include_www: boolean;
+  routes_bound: string[];
+}
+
+export async function assignDomain(apiKey: string, orgId: string, domain: string, opts?: { includeWww?: boolean; funnelId?: string }): Promise<AssignDomainResponse> {
+  const body: Record<string, unknown> = { org_id: orgId };
+  if (opts?.includeWww === false) body.include_www = false;
+  // Backend (2026-05-15): optional funnel_id picks which funnel the domain
+  // is bound to. Defaults server-side to the org's only funnel (or first
+  // when ambiguous, today; will become required once N-funnels-per-org lands
+  // for real). Pre-emptively threading it through gives agents a way to be
+  // explicit when the migration completes without an SDK shape change.
+  if (opts?.funnelId) body.funnel_id = opts.funnelId;
+  return request('POST', `${BASE_URL}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, body);
 }
 
-export async function unassignDomain(apiKey: string, orgId: string, domain: string): Promise<DomainRecord> {
+export async function unassignDomain(apiKey: string, orgId: string, domain: string): Promise<AssignDomainResponse> {
   return request('POST', `${BASE_URL}/domain/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(domain)}/assign`, apiKey, { org_id: null });
 }
 

package/src/function.ts

@@ -0,0 +1,129 @@
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
+import { FUNCTION_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// Backend: Story 1 (metadata + scoped API key) and Story 2/4/5 (deploy,
+// runs, env) per myapi-hq/internal/routes/function/. The /logs endpoint is
+// still pending — do not add forward-compat fields the backend will ignore.
+export const EXPOSES: Exposes = [
+  'POST /function/orgs/{org_id}/functions',
+  'GET /function/orgs/{org_id}/functions',
+  'GET /function/orgs/{org_id}/functions/{id}',
+  'DELETE /function/orgs/{org_id}/functions/{id}',
+  'POST /function/orgs/{org_id}/functions/{id}/bundle',
+  'POST /function/orgs/{org_id}/functions/{id}/env',
+  'GET /function/orgs/{org_id}/functions/{id}/runs',
+];
+
+export type TriggerType = 'http' | 'cron';
+
+// Mirrors the backend's `Function` struct in crud.go. `invocation_url`
+// stays an empty string until the function is deployed (uploadBundle).
+export interface Fn {
+  id: string;
+  org_id: string;
+  name: string;
+  trigger_type: TriggerType;
+  cron_schedule?: string;
+  invocation_url: string;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreatePayload {
+  name: string;                        // required; ^[a-z0-9][a-z0-9-]{0,49}$
+  trigger_type?: TriggerType;          // optional, defaults to 'http' server-side
+  cron_schedule?: string;              // required if trigger_type === 'cron'
+}
+
+// POST response envelope includes the scoped API key — returned ONCE. The
+// caller must persist it if they want to use it directly; the SDK does not
+// store it. The function's runtime shim (`globalThis.MYAPI`) uses this key
+// internally.
+export interface CreateResponse {
+  function: Fn;
+  scoped_api_key: string;
+  scoped_api_key_id: string;
+}
+
+// uploadBundle response. The scoped API key is ROTATED on every deploy —
+// the value here is fresh and the only time it is knowable. The previous
+// scoped key is revoked server-side.
+export interface DeployResponse {
+  function: Fn;
+  invocation_url: string;
+  scoped_api_key: string;
+}
+
+// One recorded invocation — mirrors the backend's `FunctionRun` struct.
+export interface FunctionRun {
+  id: string;
+  function_id: string;
+  invoked_at: string;
+  duration_ms?: number;
+  status?: string;
+  error_message?: string;
+}
+
+export async function createFunction(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey, payload);
+}
+
+export async function listFunctions(apiKey: string, orgId: string): Promise<Fn[]> {
+  return request('GET', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey);
+}
+
+export async function getFunction(apiKey: string, orgId: string, fnId: string): Promise<Fn> {
+  return request('GET', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
+}
+
+export async function deleteFunction(apiKey: string, orgId: string, fnId: string): Promise<void> {
+  return request('DELETE', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
+}
+
+// uploadBundle deploys a single-file JS bundle (Story 2). The backend
+// wraps it with the MYAPI shim and uploads to Cloudflare Workers. The
+// multipart field MUST be named `bundle`. Raw upload cap is 4MB.
+export async function uploadBundle(
+  apiKey: string,
+  orgId: string,
+  fnId: string,
+  bundle: Blob | Buffer | string,
+  filename = 'bundle.js',
+): Promise<DeployResponse> {
+  const formData = new FormData();
+  formData.append('bundle', new Blob([bundle as any], { type: 'application/javascript' }), filename);
+
+  const response = await fetch(
+    `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/bundle`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<DeployResponse>).data as DeployResponse;
+}
+
+// setFunctionEnv writes a secret (Stripe key, etc.) as a Cloudflare Worker
+// Secret on the deployed script (Story 5). The function must already be
+// deployed. The value is never stored in MyAPI Postgres or returned.
+export async function setFunctionEnv(apiKey: string, orgId: string, fnId: string, name: string, value: string): Promise<void> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
+}
+
+// listFunctionRuns returns recent invocation records, most recent first
+// (Story 4). Capped at 100 server-side.
+export async function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]> {
+  return request('GET', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/runs`, apiKey);
+}

package/src/funnel.ts

@@ -1,4 +1,5 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { FUNNEL_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -10,11 +11,19 @@ export const EXPOSES: Exposes = [
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
   'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+  'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
 ];
 
-
-
-export interface Funnel { id: string; org_id: string; created_at: string; updated_at: string }
+export interface Funnel {
+  id: string;
+  org_id: string;
+  // Backend (2026-05-15): POST /funnels now accepts optional `name`. Defaults
+  // to the org's preview_subdomain for back-compat. Get / list responses
+  // include it when set.
+  name?: string;
+  created_at: string;
+  updated_at: string;
+}
 export interface CreateFunnelResponse { funnel: Funnel; subdomain_url?: string; domain_url?: string }
 export interface VerifyResult {
   pages?: Array<{ slug: string; tests: VerifyTest[] }>;
@@ -22,8 +31,10 @@ export interface VerifyResult {
 }
 export interface VerifyTest { type: 'link' | 'webhook'; url: string; passed: boolean; details: string }
 
-export async function createFunnel(apiKey: string, orgId: string): Promise<CreateFunnelResponse> {
-  return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, {});
+export async function createFunnel(apiKey: string, orgId: string, opts?: { name?: string }): Promise<CreateFunnelResponse> {
+  // v2: accept optional name for N-funnels-per-org. Backend rejects names
+  // matching the reserved-suffix rules; agent should pre-validate.
+  return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, opts?.name ? { name: opts.name } : {});
 }
 export async function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<Funnel> {
   return request('GET', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`, apiKey);
@@ -64,3 +75,66 @@ export async function listFunnelPages(apiKey: string, orgId: string, funnelId: s
 export async function verifyFunnel(apiKey: string, orgId: string, funnelId: string, opts?: { html?: string; slug?: string }): Promise<VerifyResult> {
   return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/verify`, apiKey, opts || {});
 }
+
+// One file in a directory publish: `path` is the path within the site
+// (e.g. "index.html", "assets/app.js"); the backend roots it ("/index.html").
+export interface PublishFile {
+  path: string;
+  content: Blob | Buffer | string;
+}
+
+export interface PublishOptions {
+  // 'dev' or 'prod' channel — defaults to 'prod' server-side.
+  env?: 'dev' | 'prod';
+  // Force SPA fallback. Auto-true server-side when an index.html is present.
+  spaMode?: boolean;
+  // Bind /api/* on the funnel to a deployed function.
+  apiFunctionId?: string;
+}
+
+export interface PublishResult {
+  manifest_id: string;
+  channel: 'dev' | 'prod';
+  file_count: number;
+  size_bytes: number;
+  spa_mode: boolean;
+  published_url: string;
+}
+
+// publishFiles is the my-funnel-api v2 directory publish. Every file is a
+// multipart part named `files`; the part's filename carries the site path.
+// 25MB total cap server-side.
+export async function publishFiles(
+  apiKey: string,
+  orgId: string,
+  funnelId: string,
+  files: PublishFile[],
+  opts: PublishOptions = {},
+): Promise<PublishResult> {
+  const formData = new FormData();
+  for (const f of files) {
+    formData.append('files', new Blob([f.content as any]), f.path);
+  }
+  if (opts.env) formData.append('env', opts.env);
+  if (opts.spaMode !== undefined) formData.append('spa_mode', String(opts.spaMode));
+  if (opts.apiFunctionId) formData.append('api_function_id', opts.apiFunctionId);
+
+  const response = await fetch(
+    `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/files`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<PublishResult>).data as PublishResult;
+}

package/src/hq.ts

@@ -11,7 +11,9 @@ export const EXPOSES: Exposes = [
   'GET /hq/account/free-tier',
   'POST /hq/account/create/key',
   'GET /hq/account/keys',
+  'POST /hq/account/keys/revoke-all',
   'DELETE /hq/account/delete/key/{key_id}',
+  'PATCH /hq/account/spend-cap',
   'POST /hq/orgs',
   'GET /hq/orgs',
   'GET /hq/orgs/{org_id}',
@@ -68,6 +70,44 @@ export interface AccountInfo {
   account_id: string;
   email?: string;
   is_anonymous?: boolean;
+  // Account-level spend cap (IAM "Layer 2"). Present only when a cap is set.
+  spend_cap_cents?: number;
+  current_period_spend_cents?: number;
+}
+
+// ── Capability IAM (design-iam-capability-keys-2026-05-15) ───────────────────
+
+export type GrantAccess = 'read' | 'write';
+
+// A key's slot grants: slot name (or "*" wildcard) → access level.
+// `write` implies `read`. A slot absent from the map = no access.
+export type Grants = Record<string, GrantAccess>;
+
+// The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
+// backend — keep in sync. Used to validate `--grant` client-side before the
+// network call. "*" is also valid in a Grants map but is not a slot name.
+export const GRANTABLE_SLOTS = [
+  'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
+  'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+] as const;
+
+export type KeyKind = 'account' | 'function' | 'manual';
+export type SpendCapPeriod = 'month' | 'day' | 'none';
+
+// Mirrors the backend `keyView`. `api_key` is present ONLY in the create
+// response (returned once). `current_period_spend_cents` is present on list
+// (metered), absent on create (a new key has no spend yet).
+export interface ApiKey {
+  id: string;
+  name: string;
+  prefix: string;
+  kind: KeyKind;
+  org_id: string | null;
+  grants: Grants;
+  spend_cap_cents: number | null;
+  spend_cap_period: string;
+  current_period_spend_cents?: number;
+  api_key?: string;
 }
 
 export async function createAnonymousAccount(): Promise<AuthResult & { subdomain_url: string }> {
@@ -106,11 +146,27 @@ export async function getAccount(apiKey: string): Promise<AccountInfo> {
   return request('GET', `${BASE_URL}/hq/account/me`, apiKey);
 }
 
-export async function createApiKey(apiKey: string, name: string): Promise<{ api_key: string; id: string; prefix: string }> {
-  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, { name });
+export interface CreateApiKeyOptions {
+  // Slot grants. Omitted → backend defaults to unrestricted ({"*":"write"}).
+  grants?: Grants;
+  // Lock the key to a single org. Omitted → account-wide.
+  orgId?: string;
+  // Per-key spend ceiling, in cents. Omitted → no per-key cap.
+  spendCapCents?: number;
+}
+
+// Mints a manual API key. The requested (grants, org, spend cap) must be a
+// subset of the calling key's authority — the backend rejects escalation
+// with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.
+export async function createApiKey(apiKey: string, name: string, opts: CreateApiKeyOptions = {}): Promise<ApiKey> {
+  const body: Record<string, unknown> = { name };
+  if (opts.grants) body.grants = opts.grants;
+  if (opts.orgId) body.org_id = opts.orgId;
+  if (opts.spendCapCents != null) body.spend_cap_cents = opts.spendCapCents;
+  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, body);
 }
 
-export async function listApiKeys(apiKey: string): Promise<{ id: string; name: string; prefix: string; created_at: string; last_used_at?: string }[]> {
+export async function listApiKeys(apiKey: string): Promise<ApiKey[]> {
   return request('GET', `${BASE_URL}/hq/account/keys`, apiKey);
 }
 
@@ -118,6 +174,25 @@ export async function revokeApiKey(apiKey: string, keyId: string): Promise<void>
   return request('DELETE', `${BASE_URL}/hq/account/delete/key/${encodeURIComponent(keyId)}`, apiKey);
 }
 
+// The kill switch. With no `kind`, revokes every active key in the account —
+// including the caller's own; recovery is re-auth via login. A `kind` narrows
+// it to one provenance class.
+export async function revokeAllKeys(apiKey: string, kind?: KeyKind): Promise<{ revoked: number }> {
+  return request('POST', `${BASE_URL}/hq/account/keys/revoke-all`, apiKey, kind ? { kind } : {});
+}
+
+// Sets or clears the account-level spend ceiling (IAM "Layer 2"). Pass
+// `null` to clear. `period` defaults to 'month' server-side.
+export async function setAccountSpendCap(
+  apiKey: string,
+  spendCapCents: number | null,
+  period?: SpendCapPeriod,
+): Promise<{ spend_cap_cents: number | null; spend_cap_period: string }> {
+  const body: Record<string, unknown> = { spend_cap_cents: spendCapCents };
+  if (period) body.period = period;
+  return request('PATCH', `${BASE_URL}/hq/account/spend-cap`, apiKey, body);
+}
+
 export async function createOrg(apiKey: string, payload: OrgPayload): Promise<Org> {
   return request('POST', `${BASE_URL}/hq/orgs`, apiKey, payload);
 }

package/src/index.ts

@@ -22,3 +22,5 @@ export * as audience from './audience';
 export * as llm from './llm';
 export * as database from './database';
 export * as crm from './crm';
+export * as fn from './function';
+export * as payments from './payments';

package/src/payments.ts

@@ -0,0 +1,97 @@
+import { request } from './client';
+import { PAYMENTS_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// Backend: my-payments-api T0 (BYO Stripe) per
+// myapi-hq/internal/routes/payments/. T1 (Connect Express) is deferred —
+// connect with tier 't1' returns 501. The webhook receiver is public
+// (Stripe signs it); it is listed here for parity but has no SDK function.
+export const EXPOSES: Exposes = [
+  'POST /payments/orgs/{org_id}/connect',
+  'GET /payments/orgs/{org_id}/connect',
+  'POST /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges/{id}',
+  'POST /payments/orgs/{org_id}/charges/{id}/refund',
+  'POST /payments/webhook/{org_id}',
+];
+
+// Connection status — the org's Stripe link. T0 takes no platform fee, so
+// `application_fee_bps` is 0.
+export interface ConnectStatus {
+  tier: string;
+  stripe_account_id: string;
+  onboarding_status: string;
+  application_fee_bps?: number;
+}
+
+// Charge billing interval. Absent = a one-off payment.
+export type ChargeInterval = 'month' | 'year';
+
+// A charge — mirrors the backend's `chargeView`.
+export interface Charge {
+  id: string;
+  amount_cents: number;
+  currency: string;
+  every?: ChargeInterval;
+  description?: string;
+  customer_email?: string;
+  status: string;
+  created_at: string;
+  succeeded_at?: string;
+  refunded_at?: string;
+}
+
+// CreateCharge returns a hosted Stripe Checkout URL the agent pastes into
+// its frontend — not a completed payment.
+export interface CreateChargeResponse {
+  payment_id: string;
+  checkout_url: string;
+  status: string;
+}
+
+export interface CreateChargePayload {
+  amount_cents: number;                // required, > 0
+  currency?: string;                   // defaults to 'usd' server-side
+  email?: string;                      // pre-fills the Checkout customer
+  description?: string;                // shows on the Checkout line item
+  every?: ChargeInterval;              // present = a subscription
+  success_url?: string;
+  cancel_url?: string;
+}
+
+// connect links the org's own Stripe account (T0 — BYO secret key). The
+// key is validated live against Stripe and stored encrypted; it never
+// touches MyAPI Postgres or a log line. Pass a 't1' tier to see the
+// 501 T1_DEFERRED path.
+export async function connect(apiKey: string, orgId: string, stripeSecretKey: string, tier: 't0' | 't1' = 't0'): Promise<ConnectStatus> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey, {
+    tier,
+    stripe_secret_key: stripeSecretKey,
+  });
+}
+
+// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// when the org has not connected Stripe.
+export async function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);
+}
+
+// createCharge opens a Stripe Checkout Session on the org's connected
+// account. `every` makes it a subscription; otherwise a one-off payment.
+export async function createCharge(apiKey: string, orgId: string, payload: CreateChargePayload): Promise<CreateChargeResponse> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey, payload);
+}
+
+export async function listCharges(apiKey: string, orgId: string): Promise<Charge[]> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey);
+}
+
+export async function getCharge(apiKey: string, orgId: string, chargeId: string): Promise<Charge> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}`, apiKey);
+}
+
+// refundCharge issues a full refund (v1 — partial refunds out of scope).
+export async function refundCharge(apiKey: string, orgId: string, chargeId: string): Promise<{ id: string; status: string }> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}/refund`, apiKey);
+}

package/src/services.ts

@@ -217,4 +217,35 @@ export const SERVICES: readonly ServiceMeta[] = [
     status: 'ga',
     keywords: k('llm', 'completion', 'embedding', 'gemini'),
   },
+  {
+    // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
+    // `my-function-api` (the agent-discoverable brand name).
+    //
+    // Backend status: deploy/env/runs shipped (CF Workers bundle upload,
+    // invocation URL, Worker Secrets, run history). /logs still pending —
+    // 'preview' reflects "usable, not yet stable GA."
+    module: 'fn',
+    skill: 'my-function-api',
+    domain: 'myfunctionapi.com',
+    description: 'Run JavaScript functions on the edge. HTTP or cron triggers. Pre-injected MYAPI SDK scoped to the org — no auth tokens in user code.',
+    category: 'compute',
+    status: 'preview',
+    keywords: k('function', 'serverless', 'edge', 'cloudflare-workers', 'http-handler', 'cron'),
+  },
+  {
+    // CLI top-level command + SDK namespace are both `payments`; skill
+    // directory is `my-payments-api`.
+    //
+    // Backend status: T0 (BYO Stripe) shipped — connect, charges (Checkout
+    // Sessions), refunds, per-org webhook. T1 (Connect Express) is deferred
+    // (connect returns 501 T1_DEFERRED). 'preview' reflects "T0 usable, T1
+    // pending."
+    module: 'payments',
+    skill: 'my-payments-api',
+    domain: 'mypaymentsapi.com',
+    description: 'Take payments with Stripe Checkout. Connect your Stripe account, create one-off or recurring charges, and refund — hosted checkout, no card handling.',
+    category: 'compute',
+    status: 'preview',
+    keywords: k('payments', 'stripe', 'checkout', 'billing', 'subscription'),
+  },
 ] as const;

package/src/webhook.ts

@@ -5,6 +5,7 @@ import type { Exposes } from './exposes';
 export const EXPOSES: Exposes = [
   'POST /webhook/orgs/{org_id}/endpoints',
   'GET /webhook/orgs/{org_id}/endpoints',
+  'PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
   'DELETE /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
   'GET /webhook/orgs/{org_id}/deliveries/{delivery_id}',
 ];
@@ -36,15 +37,34 @@ export interface CreateEndpointOptions {
   // 'email' (top-level). For nested shapes pass the dot-path (e.g.
   // 'data.object.customer_email' for Stripe, 'sender.email' for GitHub).
   crm_email_path?: string;
+  // Backend (2026-05-15): optional URL to forward every inbound delivery to
+  // (POST, async, best-effort). Headers `X-MyAPI-Webhook-Endpoint-Id` and
+  // `X-MyAPI-Webhook-Delivery-Id` are attached. Use http:// or https://.
+  // Empty string disables forwarding.
+  forward_url?: string;
+}
+
+// All fields optional — only those passed are mutated. Mirrors the backend
+// PATCH /webhook/orgs/{org_id}/endpoints/{id} contract (slug is immutable).
+export interface UpdateEndpointPayload {
+  name?: string;
+  description?: string;
+  crm_email_path?: string;
+  forward_url?: string;
 }
 
 export async function createEndpoint(apiKey: string, orgId: string, name: string, opts: CreateEndpointOptions = {}): Promise<WebhookEndpoint> {
   const body: Record<string, unknown> = { name };
   if (opts.description !== undefined) body.description = opts.description;
   if (opts.crm_email_path !== undefined) body.crm_email_path = opts.crm_email_path;
+  if (opts.forward_url !== undefined) body.forward_url = opts.forward_url;
   return request('POST', `${BASE_URL}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints`, apiKey, body);
 }
 
+export async function updateEndpoint(apiKey: string, orgId: string, endpointId: string, payload: UpdateEndpointPayload): Promise<WebhookEndpoint> {
+  return request('PATCH', `${BASE_URL}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints/${encodeURIComponent(endpointId)}`, apiKey, payload);
+}
+
 export async function listEndpoints(apiKey: string, orgId: string): Promise<WebhookEndpoint[]> {
   return request('GET', `${BASE_URL}/webhook/orgs/${encodeURIComponent(orgId)}/endpoints`, apiKey);
 }

package/src/workflow.ts

@@ -29,7 +29,11 @@ export const EXPOSES: Exposes = [
  */
 export type WorkflowStep =
   | { type: 'send_email'; from: string; to: string; subject: string; template_id?: string; html?: string }
-  | { type: 'slack_message'; webhook_url: string; text: string };
+  | { type: 'slack_message'; webhook_url: string; text: string }
+  // Backend (2026-05-15): `http_request` step is now accepted (alias: `http`).
+  // POSTs (or other method) to `url` with the inbound payload; supports
+  // template substitution in url/body the same way email steps do.
+  | { type: 'http_request' | 'http'; url: string; method?: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'; body?: string; headers?: Record<string, string> };
 
 export interface Workflow {
   id: string;