@myapihq/sdk 1.2.5 → 1.2.6

package/dist/config.d.ts

@@ -2,6 +2,7 @@ export declare const HQ_BASE: string;
 export declare const DOMAIN_BASE: string;
 export declare const FUNNEL_BASE: string;
 export declare const FUNCTION_BASE: string;
+export declare const PAYMENTS_BASE: string;
 export declare const IMAGE_BASE: string;
 export declare const WEBHOOK_BASE: string;
 export declare const WORKFLOW_BASE: string;

package/dist/config.js

@@ -8,7 +8,7 @@
 // local dev — `source scripts/local-env.sh` still points everything at
 // localhost:8080 regardless of the prod default.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CRM_BASE = exports.DATABASE_BASE = exports.LLM_BASE = exports.AUDIENCE_BASE = exports.COMPANY_BASE = exports.PEOPLE_BASE = exports.PIXEL_BASE = exports.URL_BASE = exports.STORAGE_BASE = exports.EMAIL_BASE = exports.WORKFLOW_BASE = exports.WEBHOOK_BASE = exports.IMAGE_BASE = exports.FUNCTION_BASE = exports.FUNNEL_BASE = exports.DOMAIN_BASE = exports.HQ_BASE = void 0;
+exports.CRM_BASE = exports.DATABASE_BASE = exports.LLM_BASE = exports.AUDIENCE_BASE = exports.COMPANY_BASE = exports.PEOPLE_BASE = exports.PIXEL_BASE = exports.URL_BASE = exports.STORAGE_BASE = exports.EMAIL_BASE = exports.WORKFLOW_BASE = exports.WEBHOOK_BASE = exports.IMAGE_BASE = exports.PAYMENTS_BASE = exports.FUNCTION_BASE = exports.FUNNEL_BASE = exports.DOMAIN_BASE = exports.HQ_BASE = void 0;
 const GATEWAY = 'https://api.myapihq.com';
 exports.HQ_BASE = process.env.MYAPI_HQ_URL ?? process.env.MYAPI_API_BASE ?? GATEWAY;
 exports.DOMAIN_BASE = process.env.MYAPI_DOMAIN_URL ?? 'https://api.mydomainapi.com';
@@ -16,6 +16,7 @@ exports.FUNNEL_BASE = process.env.MYAPI_FUNNEL_URL ?? 'https://api.myfunnelapi.c
 // New slots — routed via the gateway until brand hosts are DNS-wired
 // (mirrors the LLM/DATABASE/CRM pattern below).
 exports.FUNCTION_BASE = process.env.MYAPI_FUNCTION_URL ?? GATEWAY;
+exports.PAYMENTS_BASE = process.env.MYAPI_PAYMENTS_URL ?? GATEWAY;
 exports.IMAGE_BASE = process.env.MYAPI_IMAGE_URL ?? 'https://api.myimageapi.com';
 exports.WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
 exports.WORKFLOW_BASE = process.env.MYAPI_WORKFLOW_URL ?? 'https://api.myworkflowapi.com';

package/dist/function.d.ts

@@ -21,7 +21,23 @@ export interface CreateResponse {
     scoped_api_key: string;
     scoped_api_key_id: string;
 }
+export interface DeployResponse {
+    function: Fn;
+    invocation_url: string;
+    scoped_api_key: string;
+}
+export interface FunctionRun {
+    id: string;
+    function_id: string;
+    invoked_at: string;
+    duration_ms?: number;
+    status?: string;
+    error_message?: string;
+}
 export declare function createFunction(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse>;
 export declare function listFunctions(apiKey: string, orgId: string): Promise<Fn[]>;
 export declare function getFunction(apiKey: string, orgId: string, fnId: string): Promise<Fn>;
 export declare function deleteFunction(apiKey: string, orgId: string, fnId: string): Promise<void>;
+export declare function uploadBundle(apiKey: string, orgId: string, fnId: string, bundle: Blob | Buffer | string, filename?: string): Promise<DeployResponse>;
+export declare function setFunctionEnv(apiKey: string, orgId: string, fnId: string, name: string, value: string): Promise<void>;
+export declare function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]>;

package/dist/function.js

@@ -5,18 +5,22 @@ exports.createFunction = createFunction;
 exports.listFunctions = listFunctions;
 exports.getFunction = getFunction;
 exports.deleteFunction = deleteFunction;
+exports.uploadBundle = uploadBundle;
+exports.setFunctionEnv = setFunctionEnv;
+exports.listFunctionRuns = listFunctionRuns;
 const client_1 = require("./client");
 const config_1 = require("./config");
-// Backend: Story 1 (per myapi-hq/internal/routes/function/crud.go). Metadata
-// + scoped API key issuance only — Cloudflare Worker upload, /logs, and /env
-// land in Story 2-5. The SDK surface stays minimal until those endpoints
-// exist; do not add forward-compat fields here that the backend will silently
-// ignore.
+// Backend: Story 1 (metadata + scoped API key) and Story 2/4/5 (deploy,
+// runs, env) per myapi-hq/internal/routes/function/. The /logs endpoint is
+// still pending — do not add forward-compat fields the backend will ignore.
 exports.EXPOSES = [
     'POST /function/orgs/{org_id}/functions',
     'GET /function/orgs/{org_id}/functions',
     'GET /function/orgs/{org_id}/functions/{id}',
     'DELETE /function/orgs/{org_id}/functions/{id}',
+    'POST /function/orgs/{org_id}/functions/{id}/bundle',
+    'POST /function/orgs/{org_id}/functions/{id}/env',
+    'GET /function/orgs/{org_id}/functions/{id}/runs',
 ];
 async function createFunction(apiKey, orgId, payload) {
     return (0, client_1.request)('POST', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey, payload);
@@ -30,3 +34,36 @@ async function getFunction(apiKey, orgId, fnId) {
 async function deleteFunction(apiKey, orgId, fnId) {
     return (0, client_1.request)('DELETE', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
 }
+// uploadBundle deploys a single-file JS bundle (Story 2). The backend
+// wraps it with the MYAPI shim and uploads to Cloudflare Workers. The
+// multipart field MUST be named `bundle`. Raw upload cap is 4MB.
+async function uploadBundle(apiKey, orgId, fnId, bundle, filename = 'bundle.js') {
+    const formData = new FormData();
+    formData.append('bundle', new Blob([bundle], { type: 'application/javascript' }), filename);
+    const response = await fetch(`${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/bundle`, { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData });
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw new client_1.MyApiError('invalid_json_response', response.status);
+    }
+    if (!response.ok || !result?.success) {
+        const err = result?.error;
+        const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+        const detail = typeof err === 'object' ? err?.message : undefined;
+        throw new client_1.MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+    }
+    return result.data;
+}
+// setFunctionEnv writes a secret (Stripe key, etc.) as a Cloudflare Worker
+// Secret on the deployed script (Story 5). The function must already be
+// deployed. The value is never stored in MyAPI Postgres or returned.
+async function setFunctionEnv(apiKey, orgId, fnId, name, value) {
+    return (0, client_1.request)('POST', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
+}
+// listFunctionRuns returns recent invocation records, most recent first
+// (Story 4). Capped at 100 server-side.
+async function listFunctionRuns(apiKey, orgId, fnId) {
+    return (0, client_1.request)('GET', `${config_1.FUNCTION_BASE}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/runs`, apiKey);
+}

package/dist/funnel.d.ts

@@ -49,3 +49,21 @@ export declare function verifyFunnel(apiKey: string, orgId: string, funnelId: st
     html?: string;
     slug?: string;
 }): Promise<VerifyResult>;
+export interface PublishFile {
+    path: string;
+    content: Blob | Buffer | string;
+}
+export interface PublishOptions {
+    env?: 'dev' | 'prod';
+    spaMode?: boolean;
+    apiFunctionId?: string;
+}
+export interface PublishResult {
+    manifest_id: string;
+    channel: 'dev' | 'prod';
+    file_count: number;
+    size_bytes: number;
+    spa_mode: boolean;
+    published_url: string;
+}
+export declare function publishFiles(apiKey: string, orgId: string, funnelId: string, files: PublishFile[], opts?: PublishOptions): Promise<PublishResult>;

package/dist/funnel.js

@@ -8,6 +8,7 @@ exports.deleteFunnel = deleteFunnel;
 exports.pushFunnelPage = pushFunnelPage;
 exports.listFunnelPages = listFunnelPages;
 exports.verifyFunnel = verifyFunnel;
+exports.publishFiles = publishFiles;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
@@ -18,6 +19,7 @@ exports.EXPOSES = [
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
 ];
 async function createFunnel(apiKey, orgId, opts) {
     // v2: accept optional name for N-funnels-per-org. Backend rejects names
@@ -48,3 +50,33 @@ async function listFunnelPages(apiKey, orgId, funnelId) {
 async function verifyFunnel(apiKey, orgId, funnelId, opts) {
     return (0, client_1.request)('POST', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/verify`, apiKey, opts || {});
 }
+// publishFiles is the my-funnel-api v2 directory publish. Every file is a
+// multipart part named `files`; the part's filename carries the site path.
+// 25MB total cap server-side.
+async function publishFiles(apiKey, orgId, funnelId, files, opts = {}) {
+    const formData = new FormData();
+    for (const f of files) {
+        formData.append('files', new Blob([f.content]), f.path);
+    }
+    if (opts.env)
+        formData.append('env', opts.env);
+    if (opts.spaMode !== undefined)
+        formData.append('spa_mode', String(opts.spaMode));
+    if (opts.apiFunctionId)
+        formData.append('api_function_id', opts.apiFunctionId);
+    const response = await fetch(`${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/files`, { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData });
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw new client_1.MyApiError('invalid_json_response', response.status);
+    }
+    if (!response.ok || !result?.success) {
+        const err = result?.error;
+        const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+        const detail = typeof err === 'object' ? err?.message : undefined;
+        throw new client_1.MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+    }
+    return result.data;
+}

package/dist/hq.d.ts

@@ -39,6 +39,25 @@ export interface AccountInfo {
     account_id: string;
     email?: string;
     is_anonymous?: boolean;
+    spend_cap_cents?: number;
+    current_period_spend_cents?: number;
+}
+export type GrantAccess = 'read' | 'write';
+export type Grants = Record<string, GrantAccess>;
+export declare const GRANTABLE_SLOTS: readonly ["domain", "email", "funnel", "storage", "image", "webhook", "workflow", "function", "url", "people", "company", "audience", "llm", "database", "crm"];
+export type KeyKind = 'account' | 'function' | 'manual';
+export type SpendCapPeriod = 'month' | 'day' | 'none';
+export interface ApiKey {
+    id: string;
+    name: string;
+    prefix: string;
+    kind: KeyKind;
+    org_id: string | null;
+    grants: Grants;
+    spend_cap_cents: number | null;
+    spend_cap_period: string;
+    current_period_spend_cents?: number;
+    api_key?: string;
 }
 export declare function createAnonymousAccount(): Promise<AuthResult & {
     subdomain_url: string;
@@ -55,19 +74,21 @@ export type FreeTierEntry = {
 };
 export declare function getFreeTier(apiKey: string): Promise<FreeTierEntry[] | null>;
 export declare function getAccount(apiKey: string): Promise<AccountInfo>;
-export declare function createApiKey(apiKey: string, name: string): Promise<{
-    api_key: string;
-    id: string;
-    prefix: string;
-}>;
-export declare function listApiKeys(apiKey: string): Promise<{
-    id: string;
-    name: string;
-    prefix: string;
-    created_at: string;
-    last_used_at?: string;
-}[]>;
+export interface CreateApiKeyOptions {
+    grants?: Grants;
+    orgId?: string;
+    spendCapCents?: number;
+}
+export declare function createApiKey(apiKey: string, name: string, opts?: CreateApiKeyOptions): Promise<ApiKey>;
+export declare function listApiKeys(apiKey: string): Promise<ApiKey[]>;
 export declare function revokeApiKey(apiKey: string, keyId: string): Promise<void>;
+export declare function revokeAllKeys(apiKey: string, kind?: KeyKind): Promise<{
+    revoked: number;
+}>;
+export declare function setAccountSpendCap(apiKey: string, spendCapCents: number | null, period?: SpendCapPeriod): Promise<{
+    spend_cap_cents: number | null;
+    spend_cap_period: string;
+}>;
 export declare function createOrg(apiKey: string, payload: OrgPayload): Promise<Org>;
 export declare function importOrg(apiKey: string, orgId: string, domain: string, autoAccept?: boolean): Promise<{
     job_id: string;

package/dist/hq.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPOSES = void 0;
+exports.GRANTABLE_SLOTS = exports.EXPOSES = void 0;
 exports.createAnonymousAccount = createAnonymousAccount;
 exports.sendCode = sendCode;
 exports.verifyCode = verifyCode;
@@ -10,6 +10,8 @@ exports.getAccount = getAccount;
 exports.createApiKey = createApiKey;
 exports.listApiKeys = listApiKeys;
 exports.revokeApiKey = revokeApiKey;
+exports.revokeAllKeys = revokeAllKeys;
+exports.setAccountSpendCap = setAccountSpendCap;
 exports.createOrg = createOrg;
 exports.importOrg = importOrg;
 exports.getOrgImportStatus = getOrgImportStatus;
@@ -33,7 +35,9 @@ exports.EXPOSES = [
     'GET /hq/account/free-tier',
     'POST /hq/account/create/key',
     'GET /hq/account/keys',
+    'POST /hq/account/keys/revoke-all',
     'DELETE /hq/account/delete/key/{key_id}',
+    'PATCH /hq/account/spend-cap',
     'POST /hq/orgs',
     'GET /hq/orgs',
     'GET /hq/orgs/{org_id}',
@@ -47,6 +51,13 @@ exports.EXPOSES = [
     'POST /hq/billing/setup-payment',
     'POST /hq/billing/topup',
 ];
+// The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
+// backend — keep in sync. Used to validate `--grant` client-side before the
+// network call. "*" is also valid in a Grants map but is not a slot name.
+exports.GRANTABLE_SLOTS = [
+    'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
+    'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+];
 async function createAnonymousAccount() {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/anonymous`, undefined, {});
 }
@@ -65,8 +76,18 @@ async function getFreeTier(apiKey) {
 async function getAccount(apiKey) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/me`, apiKey);
 }
-async function createApiKey(apiKey, name) {
-    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/create/key`, apiKey, { name });
+// Mints a manual API key. The requested (grants, org, spend cap) must be a
+// subset of the calling key's authority — the backend rejects escalation
+// with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.
+async function createApiKey(apiKey, name, opts = {}) {
+    const body = { name };
+    if (opts.grants)
+        body.grants = opts.grants;
+    if (opts.orgId)
+        body.org_id = opts.orgId;
+    if (opts.spendCapCents != null)
+        body.spend_cap_cents = opts.spendCapCents;
+    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/create/key`, apiKey, body);
 }
 async function listApiKeys(apiKey) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/keys`, apiKey);
@@ -74,6 +95,20 @@ async function listApiKeys(apiKey) {
 async function revokeApiKey(apiKey, keyId) {
     return (0, client_1.request)('DELETE', `${config_1.HQ_BASE}/hq/account/delete/key/${encodeURIComponent(keyId)}`, apiKey);
 }
+// The kill switch. With no `kind`, revokes every active key in the account —
+// including the caller's own; recovery is re-auth via login. A `kind` narrows
+// it to one provenance class.
+async function revokeAllKeys(apiKey, kind) {
+    return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/keys/revoke-all`, apiKey, kind ? { kind } : {});
+}
+// Sets or clears the account-level spend ceiling (IAM "Layer 2"). Pass
+// `null` to clear. `period` defaults to 'month' server-side.
+async function setAccountSpendCap(apiKey, spendCapCents, period) {
+    const body = { spend_cap_cents: spendCapCents };
+    if (period)
+        body.period = period;
+    return (0, client_1.request)('PATCH', `${config_1.HQ_BASE}/hq/account/spend-cap`, apiKey, body);
+}
 async function createOrg(apiKey, payload) {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/orgs`, apiKey, payload);
 }

package/dist/index.d.ts

@@ -17,3 +17,4 @@ export * as llm from './llm';
 export * as database from './database';
 export * as crm from './crm';
 export * as fn from './function';
+export * as payments from './payments';

package/dist/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fn = exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.hq = void 0;
+exports.payments = exports.fn = exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.hq = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./client"), exports);
 // Note: config constants (STORAGE_BASE etc.) are NOT re-exported from the
@@ -62,3 +62,4 @@ exports.llm = __importStar(require("./llm"));
 exports.database = __importStar(require("./database"));
 exports.crm = __importStar(require("./crm"));
 exports.fn = __importStar(require("./function"));
+exports.payments = __importStar(require("./payments"));

package/dist/payments.d.ts

@@ -0,0 +1,44 @@
+import type { Exposes } from './exposes';
+export declare const EXPOSES: Exposes;
+export interface ConnectStatus {
+    tier: string;
+    stripe_account_id: string;
+    onboarding_status: string;
+    application_fee_bps?: number;
+}
+export type ChargeInterval = 'month' | 'year';
+export interface Charge {
+    id: string;
+    amount_cents: number;
+    currency: string;
+    every?: ChargeInterval;
+    description?: string;
+    customer_email?: string;
+    status: string;
+    created_at: string;
+    succeeded_at?: string;
+    refunded_at?: string;
+}
+export interface CreateChargeResponse {
+    payment_id: string;
+    checkout_url: string;
+    status: string;
+}
+export interface CreateChargePayload {
+    amount_cents: number;
+    currency?: string;
+    email?: string;
+    description?: string;
+    every?: ChargeInterval;
+    success_url?: string;
+    cancel_url?: string;
+}
+export declare function connect(apiKey: string, orgId: string, stripeSecretKey: string, tier?: 't0' | 't1'): Promise<ConnectStatus>;
+export declare function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus>;
+export declare function createCharge(apiKey: string, orgId: string, payload: CreateChargePayload): Promise<CreateChargeResponse>;
+export declare function listCharges(apiKey: string, orgId: string): Promise<Charge[]>;
+export declare function getCharge(apiKey: string, orgId: string, chargeId: string): Promise<Charge>;
+export declare function refundCharge(apiKey: string, orgId: string, chargeId: string): Promise<{
+    id: string;
+    status: string;
+}>;

package/dist/payments.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPOSES = void 0;
+exports.connect = connect;
+exports.getConnect = getConnect;
+exports.createCharge = createCharge;
+exports.listCharges = listCharges;
+exports.getCharge = getCharge;
+exports.refundCharge = refundCharge;
+const client_1 = require("./client");
+const config_1 = require("./config");
+// Backend: my-payments-api T0 (BYO Stripe) per
+// myapi-hq/internal/routes/payments/. T1 (Connect Express) is deferred —
+// connect with tier 't1' returns 501. The webhook receiver is public
+// (Stripe signs it); it is listed here for parity but has no SDK function.
+exports.EXPOSES = [
+    'POST /payments/orgs/{org_id}/connect',
+    'GET /payments/orgs/{org_id}/connect',
+    'POST /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges/{id}',
+    'POST /payments/orgs/{org_id}/charges/{id}/refund',
+    'POST /payments/webhook/{org_id}',
+];
+// connect links the org's own Stripe account (T0 — BYO secret key). The
+// key is validated live against Stripe and stored encrypted; it never
+// touches MyAPI Postgres or a log line. Pass a 't1' tier to see the
+// 501 T1_DEFERRED path.
+async function connect(apiKey, orgId, stripeSecretKey, tier = 't0') {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey, {
+        tier,
+        stripe_secret_key: stripeSecretKey,
+    });
+}
+// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// when the org has not connected Stripe.
+async function getConnect(apiKey, orgId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);
+}
+// createCharge opens a Stripe Checkout Session on the org's connected
+// account. `every` makes it a subscription; otherwise a one-off payment.
+async function createCharge(apiKey, orgId, payload) {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey, payload);
+}
+async function listCharges(apiKey, orgId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey);
+}
+async function getCharge(apiKey, orgId, chargeId) {
+    return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}`, apiKey);
+}
+// refundCharge issues a full refund (v1 — partial refunds out of scope).
+async function refundCharge(apiKey, orgId, chargeId) {
+    return (0, client_1.request)('POST', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}/refund`, apiKey);
+}

package/dist/services.js

@@ -191,17 +191,31 @@ exports.SERVICES = [
         // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
         // `my-function-api` (the agent-discoverable brand name).
         //
-        // Backend status: Story 1 shipped (metadata + scoped API key issuance).
-        // Story 2 (CF Workers upload, invocation URL), Story 4 (/logs), Story 5
-        // (/env) pending. 'planned' reflects "partial backend, not stable GA."
+        // Backend status: deploy/env/runs shipped (CF Workers bundle upload,
+        // invocation URL, Worker Secrets, run history). /logs still pending —
+        // 'preview' reflects "usable, not yet stable GA."
         module: 'fn',
         skill: 'my-function-api',
         domain: 'myfunctionapi.com',
         description: 'Run JavaScript functions on the edge. HTTP or cron triggers. Pre-injected MYAPI SDK scoped to the org — no auth tokens in user code.',
         category: 'compute',
-        status: 'planned',
+        status: 'preview',
         keywords: k('function', 'serverless', 'edge', 'cloudflare-workers', 'http-handler', 'cron'),
     },
-    // Note: my-payments-api removed from registry — backend has no /payments/*
-    // endpoints yet. Re-add when backend ships per tech-spec-my-payments-api-2026-05-14.md.
+    {
+        // CLI top-level command + SDK namespace are both `payments`; skill
+        // directory is `my-payments-api`.
+        //
+        // Backend status: T0 (BYO Stripe) shipped — connect, charges (Checkout
+        // Sessions), refunds, per-org webhook. T1 (Connect Express) is deferred
+        // (connect returns 501 T1_DEFERRED). 'preview' reflects "T0 usable, T1
+        // pending."
+        module: 'payments',
+        skill: 'my-payments-api',
+        domain: 'mypaymentsapi.com',
+        description: 'Take payments with Stripe Checkout. Connect your Stripe account, create one-off or recurring charges, and refund — hosted checkout, no card handling.',
+        category: 'compute',
+        status: 'preview',
+        keywords: k('payments', 'stripe', 'checkout', 'billing', 'subscription'),
+    },
 ];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/config.ts

@@ -15,6 +15,7 @@ export const FUNNEL_BASE  = process.env.MYAPI_FUNNEL_URL  ?? 'https://api.myfunn
 // New slots — routed via the gateway until brand hosts are DNS-wired
 // (mirrors the LLM/DATABASE/CRM pattern below).
 export const FUNCTION_BASE= process.env.MYAPI_FUNCTION_URL?? GATEWAY;
+export const PAYMENTS_BASE= process.env.MYAPI_PAYMENTS_URL?? GATEWAY;
 export const IMAGE_BASE   = process.env.MYAPI_IMAGE_URL   ?? 'https://api.myimageapi.com';
 export const WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
 export const WORKFLOW_BASE= process.env.MYAPI_WORKFLOW_URL?? 'https://api.myworkflowapi.com';

package/src/function.ts

@@ -1,24 +1,25 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { FUNCTION_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
-// Backend: Story 1 (per myapi-hq/internal/routes/function/crud.go). Metadata
-// + scoped API key issuance only — Cloudflare Worker upload, /logs, and /env
-// land in Story 2-5. The SDK surface stays minimal until those endpoints
-// exist; do not add forward-compat fields here that the backend will silently
-// ignore.
+// Backend: Story 1 (metadata + scoped API key) and Story 2/4/5 (deploy,
+// runs, env) per myapi-hq/internal/routes/function/. The /logs endpoint is
+// still pending — do not add forward-compat fields the backend will ignore.
 export const EXPOSES: Exposes = [
   'POST /function/orgs/{org_id}/functions',
   'GET /function/orgs/{org_id}/functions',
   'GET /function/orgs/{org_id}/functions/{id}',
   'DELETE /function/orgs/{org_id}/functions/{id}',
+  'POST /function/orgs/{org_id}/functions/{id}/bundle',
+  'POST /function/orgs/{org_id}/functions/{id}/env',
+  'GET /function/orgs/{org_id}/functions/{id}/runs',
 ];
 
 export type TriggerType = 'http' | 'cron';
 
 // Mirrors the backend's `Function` struct in crud.go. `invocation_url`
-// stays an empty string in Story 1; populated by Story 2 once the CF Worker
-// upload pipeline lands.
+// stays an empty string until the function is deployed (uploadBundle).
 export interface Fn {
   id: string;
   org_id: string;
@@ -38,14 +39,33 @@ export interface CreatePayload {
 
 // POST response envelope includes the scoped API key — returned ONCE. The
 // caller must persist it if they want to use it directly; the SDK does not
-// store it. Story 2+ will use this key internally inside the function's
-// runtime shim (`globalThis.MYAPI`).
+// store it. The function's runtime shim (`globalThis.MYAPI`) uses this key
+// internally.
 export interface CreateResponse {
   function: Fn;
   scoped_api_key: string;
   scoped_api_key_id: string;
 }
 
+// uploadBundle response. The scoped API key is ROTATED on every deploy —
+// the value here is fresh and the only time it is knowable. The previous
+// scoped key is revoked server-side.
+export interface DeployResponse {
+  function: Fn;
+  invocation_url: string;
+  scoped_api_key: string;
+}
+
+// One recorded invocation — mirrors the backend's `FunctionRun` struct.
+export interface FunctionRun {
+  id: string;
+  function_id: string;
+  invoked_at: string;
+  duration_ms?: number;
+  status?: string;
+  error_message?: string;
+}
+
 export async function createFunction(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse> {
   return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey, payload);
 }
@@ -61,3 +81,49 @@ export async function getFunction(apiKey: string, orgId: string, fnId: string):
 export async function deleteFunction(apiKey: string, orgId: string, fnId: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
 }
+
+// uploadBundle deploys a single-file JS bundle (Story 2). The backend
+// wraps it with the MYAPI shim and uploads to Cloudflare Workers. The
+// multipart field MUST be named `bundle`. Raw upload cap is 4MB.
+export async function uploadBundle(
+  apiKey: string,
+  orgId: string,
+  fnId: string,
+  bundle: Blob | Buffer | string,
+  filename = 'bundle.js',
+): Promise<DeployResponse> {
+  const formData = new FormData();
+  formData.append('bundle', new Blob([bundle as any], { type: 'application/javascript' }), filename);
+
+  const response = await fetch(
+    `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/bundle`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<DeployResponse>).data as DeployResponse;
+}
+
+// setFunctionEnv writes a secret (Stripe key, etc.) as a Cloudflare Worker
+// Secret on the deployed script (Story 5). The function must already be
+// deployed. The value is never stored in MyAPI Postgres or returned.
+export async function setFunctionEnv(apiKey: string, orgId: string, fnId: string, name: string, value: string): Promise<void> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
+}
+
+// listFunctionRuns returns recent invocation records, most recent first
+// (Story 4). Capped at 100 server-side.
+export async function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]> {
+  return request('GET', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/runs`, apiKey);
+}

package/src/funnel.ts

@@ -1,4 +1,5 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { FUNNEL_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -10,6 +11,7 @@ export const EXPOSES: Exposes = [
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
   'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+  'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
 ];
 
 export interface Funnel {
@@ -73,3 +75,66 @@ export async function listFunnelPages(apiKey: string, orgId: string, funnelId: s
 export async function verifyFunnel(apiKey: string, orgId: string, funnelId: string, opts?: { html?: string; slug?: string }): Promise<VerifyResult> {
   return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/verify`, apiKey, opts || {});
 }
+
+// One file in a directory publish: `path` is the path within the site
+// (e.g. "index.html", "assets/app.js"); the backend roots it ("/index.html").
+export interface PublishFile {
+  path: string;
+  content: Blob | Buffer | string;
+}
+
+export interface PublishOptions {
+  // 'dev' or 'prod' channel — defaults to 'prod' server-side.
+  env?: 'dev' | 'prod';
+  // Force SPA fallback. Auto-true server-side when an index.html is present.
+  spaMode?: boolean;
+  // Bind /api/* on the funnel to a deployed function.
+  apiFunctionId?: string;
+}
+
+export interface PublishResult {
+  manifest_id: string;
+  channel: 'dev' | 'prod';
+  file_count: number;
+  size_bytes: number;
+  spa_mode: boolean;
+  published_url: string;
+}
+
+// publishFiles is the my-funnel-api v2 directory publish. Every file is a
+// multipart part named `files`; the part's filename carries the site path.
+// 25MB total cap server-side.
+export async function publishFiles(
+  apiKey: string,
+  orgId: string,
+  funnelId: string,
+  files: PublishFile[],
+  opts: PublishOptions = {},
+): Promise<PublishResult> {
+  const formData = new FormData();
+  for (const f of files) {
+    formData.append('files', new Blob([f.content as any]), f.path);
+  }
+  if (opts.env) formData.append('env', opts.env);
+  if (opts.spaMode !== undefined) formData.append('spa_mode', String(opts.spaMode));
+  if (opts.apiFunctionId) formData.append('api_function_id', opts.apiFunctionId);
+
+  const response = await fetch(
+    `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/files`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<PublishResult>).data as PublishResult;
+}

package/src/hq.ts

@@ -11,7 +11,9 @@ export const EXPOSES: Exposes = [
   'GET /hq/account/free-tier',
   'POST /hq/account/create/key',
   'GET /hq/account/keys',
+  'POST /hq/account/keys/revoke-all',
   'DELETE /hq/account/delete/key/{key_id}',
+  'PATCH /hq/account/spend-cap',
   'POST /hq/orgs',
   'GET /hq/orgs',
   'GET /hq/orgs/{org_id}',
@@ -68,6 +70,44 @@ export interface AccountInfo {
   account_id: string;
   email?: string;
   is_anonymous?: boolean;
+  // Account-level spend cap (IAM "Layer 2"). Present only when a cap is set.
+  spend_cap_cents?: number;
+  current_period_spend_cents?: number;
+}
+
+// ── Capability IAM (design-iam-capability-keys-2026-05-15) ───────────────────
+
+export type GrantAccess = 'read' | 'write';
+
+// A key's slot grants: slot name (or "*" wildcard) → access level.
+// `write` implies `read`. A slot absent from the map = no access.
+export type Grants = Record<string, GrantAccess>;
+
+// The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
+// backend — keep in sync. Used to validate `--grant` client-side before the
+// network call. "*" is also valid in a Grants map but is not a slot name.
+export const GRANTABLE_SLOTS = [
+  'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
+  'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+] as const;
+
+export type KeyKind = 'account' | 'function' | 'manual';
+export type SpendCapPeriod = 'month' | 'day' | 'none';
+
+// Mirrors the backend `keyView`. `api_key` is present ONLY in the create
+// response (returned once). `current_period_spend_cents` is present on list
+// (metered), absent on create (a new key has no spend yet).
+export interface ApiKey {
+  id: string;
+  name: string;
+  prefix: string;
+  kind: KeyKind;
+  org_id: string | null;
+  grants: Grants;
+  spend_cap_cents: number | null;
+  spend_cap_period: string;
+  current_period_spend_cents?: number;
+  api_key?: string;
 }
 
 export async function createAnonymousAccount(): Promise<AuthResult & { subdomain_url: string }> {
@@ -106,11 +146,27 @@ export async function getAccount(apiKey: string): Promise<AccountInfo> {
   return request('GET', `${BASE_URL}/hq/account/me`, apiKey);
 }
 
-export async function createApiKey(apiKey: string, name: string): Promise<{ api_key: string; id: string; prefix: string }> {
-  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, { name });
+export interface CreateApiKeyOptions {
+  // Slot grants. Omitted → backend defaults to unrestricted ({"*":"write"}).
+  grants?: Grants;
+  // Lock the key to a single org. Omitted → account-wide.
+  orgId?: string;
+  // Per-key spend ceiling, in cents. Omitted → no per-key cap.
+  spendCapCents?: number;
+}
+
+// Mints a manual API key. The requested (grants, org, spend cap) must be a
+// subset of the calling key's authority — the backend rejects escalation
+// with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.
+export async function createApiKey(apiKey: string, name: string, opts: CreateApiKeyOptions = {}): Promise<ApiKey> {
+  const body: Record<string, unknown> = { name };
+  if (opts.grants) body.grants = opts.grants;
+  if (opts.orgId) body.org_id = opts.orgId;
+  if (opts.spendCapCents != null) body.spend_cap_cents = opts.spendCapCents;
+  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, body);
 }
 
-export async function listApiKeys(apiKey: string): Promise<{ id: string; name: string; prefix: string; created_at: string; last_used_at?: string }[]> {
+export async function listApiKeys(apiKey: string): Promise<ApiKey[]> {
   return request('GET', `${BASE_URL}/hq/account/keys`, apiKey);
 }
 
@@ -118,6 +174,25 @@ export async function revokeApiKey(apiKey: string, keyId: string): Promise<void>
   return request('DELETE', `${BASE_URL}/hq/account/delete/key/${encodeURIComponent(keyId)}`, apiKey);
 }
 
+// The kill switch. With no `kind`, revokes every active key in the account —
+// including the caller's own; recovery is re-auth via login. A `kind` narrows
+// it to one provenance class.
+export async function revokeAllKeys(apiKey: string, kind?: KeyKind): Promise<{ revoked: number }> {
+  return request('POST', `${BASE_URL}/hq/account/keys/revoke-all`, apiKey, kind ? { kind } : {});
+}
+
+// Sets or clears the account-level spend ceiling (IAM "Layer 2"). Pass
+// `null` to clear. `period` defaults to 'month' server-side.
+export async function setAccountSpendCap(
+  apiKey: string,
+  spendCapCents: number | null,
+  period?: SpendCapPeriod,
+): Promise<{ spend_cap_cents: number | null; spend_cap_period: string }> {
+  const body: Record<string, unknown> = { spend_cap_cents: spendCapCents };
+  if (period) body.period = period;
+  return request('PATCH', `${BASE_URL}/hq/account/spend-cap`, apiKey, body);
+}
+
 export async function createOrg(apiKey: string, payload: OrgPayload): Promise<Org> {
   return request('POST', `${BASE_URL}/hq/orgs`, apiKey, payload);
 }

package/src/index.ts

@@ -23,3 +23,4 @@ export * as llm from './llm';
 export * as database from './database';
 export * as crm from './crm';
 export * as fn from './function';
+export * as payments from './payments';

package/src/payments.ts

@@ -0,0 +1,97 @@
+import { request } from './client';
+import { PAYMENTS_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// Backend: my-payments-api T0 (BYO Stripe) per
+// myapi-hq/internal/routes/payments/. T1 (Connect Express) is deferred —
+// connect with tier 't1' returns 501. The webhook receiver is public
+// (Stripe signs it); it is listed here for parity but has no SDK function.
+export const EXPOSES: Exposes = [
+  'POST /payments/orgs/{org_id}/connect',
+  'GET /payments/orgs/{org_id}/connect',
+  'POST /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges/{id}',
+  'POST /payments/orgs/{org_id}/charges/{id}/refund',
+  'POST /payments/webhook/{org_id}',
+];
+
+// Connection status — the org's Stripe link. T0 takes no platform fee, so
+// `application_fee_bps` is 0.
+export interface ConnectStatus {
+  tier: string;
+  stripe_account_id: string;
+  onboarding_status: string;
+  application_fee_bps?: number;
+}
+
+// Charge billing interval. Absent = a one-off payment.
+export type ChargeInterval = 'month' | 'year';
+
+// A charge — mirrors the backend's `chargeView`.
+export interface Charge {
+  id: string;
+  amount_cents: number;
+  currency: string;
+  every?: ChargeInterval;
+  description?: string;
+  customer_email?: string;
+  status: string;
+  created_at: string;
+  succeeded_at?: string;
+  refunded_at?: string;
+}
+
+// CreateCharge returns a hosted Stripe Checkout URL the agent pastes into
+// its frontend — not a completed payment.
+export interface CreateChargeResponse {
+  payment_id: string;
+  checkout_url: string;
+  status: string;
+}
+
+export interface CreateChargePayload {
+  amount_cents: number;                // required, > 0
+  currency?: string;                   // defaults to 'usd' server-side
+  email?: string;                      // pre-fills the Checkout customer
+  description?: string;                // shows on the Checkout line item
+  every?: ChargeInterval;              // present = a subscription
+  success_url?: string;
+  cancel_url?: string;
+}
+
+// connect links the org's own Stripe account (T0 — BYO secret key). The
+// key is validated live against Stripe and stored encrypted; it never
+// touches MyAPI Postgres or a log line. Pass a 't1' tier to see the
+// 501 T1_DEFERRED path.
+export async function connect(apiKey: string, orgId: string, stripeSecretKey: string, tier: 't0' | 't1' = 't0'): Promise<ConnectStatus> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey, {
+    tier,
+    stripe_secret_key: stripeSecretKey,
+  });
+}
+
+// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// when the org has not connected Stripe.
+export async function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);
+}
+
+// createCharge opens a Stripe Checkout Session on the org's connected
+// account. `every` makes it a subscription; otherwise a one-off payment.
+export async function createCharge(apiKey: string, orgId: string, payload: CreateChargePayload): Promise<CreateChargeResponse> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey, payload);
+}
+
+export async function listCharges(apiKey: string, orgId: string): Promise<Charge[]> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey);
+}
+
+export async function getCharge(apiKey: string, orgId: string, chargeId: string): Promise<Charge> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}`, apiKey);
+}
+
+// refundCharge issues a full refund (v1 — partial refunds out of scope).
+export async function refundCharge(apiKey: string, orgId: string, chargeId: string): Promise<{ id: string; status: string }> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}/refund`, apiKey);
+}

package/src/services.ts

@@ -221,17 +221,31 @@ export const SERVICES: readonly ServiceMeta[] = [
     // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
     // `my-function-api` (the agent-discoverable brand name).
     //
-    // Backend status: Story 1 shipped (metadata + scoped API key issuance).
-    // Story 2 (CF Workers upload, invocation URL), Story 4 (/logs), Story 5
-    // (/env) pending. 'planned' reflects "partial backend, not stable GA."
+    // Backend status: deploy/env/runs shipped (CF Workers bundle upload,
+    // invocation URL, Worker Secrets, run history). /logs still pending —
+    // 'preview' reflects "usable, not yet stable GA."
     module: 'fn',
     skill: 'my-function-api',
     domain: 'myfunctionapi.com',
     description: 'Run JavaScript functions on the edge. HTTP or cron triggers. Pre-injected MYAPI SDK scoped to the org — no auth tokens in user code.',
     category: 'compute',
-    status: 'planned',
+    status: 'preview',
     keywords: k('function', 'serverless', 'edge', 'cloudflare-workers', 'http-handler', 'cron'),
   },
-  // Note: my-payments-api removed from registry — backend has no /payments/*
-  // endpoints yet. Re-add when backend ships per tech-spec-my-payments-api-2026-05-14.md.
+  {
+    // CLI top-level command + SDK namespace are both `payments`; skill
+    // directory is `my-payments-api`.
+    //
+    // Backend status: T0 (BYO Stripe) shipped — connect, charges (Checkout
+    // Sessions), refunds, per-org webhook. T1 (Connect Express) is deferred
+    // (connect returns 501 T1_DEFERRED). 'preview' reflects "T0 usable, T1
+    // pending."
+    module: 'payments',
+    skill: 'my-payments-api',
+    domain: 'mypaymentsapi.com',
+    description: 'Take payments with Stripe Checkout. Connect your Stripe account, create one-off or recurring charges, and refund — hosted checkout, no card handling.',
+    category: 'compute',
+    status: 'preview',
+    keywords: k('payments', 'stripe', 'checkout', 'billing', 'subscription'),
+  },
 ] as const;