@myapihq/sdk 1.2.5 → 1.2.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.2.5",
+  "version": "1.2.7",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/config.ts

@@ -15,6 +15,8 @@ export const FUNNEL_BASE  = process.env.MYAPI_FUNNEL_URL  ?? 'https://api.myfunn
 // New slots — routed via the gateway until brand hosts are DNS-wired
 // (mirrors the LLM/DATABASE/CRM pattern below).
 export const FUNCTION_BASE= process.env.MYAPI_FUNCTION_URL?? GATEWAY;
+export const PAYMENTS_BASE= process.env.MYAPI_PAYMENTS_URL?? GATEWAY;
+export const CONTAINER_BASE=process.env.MYAPI_CONTAINER_URL?? GATEWAY;
 export const IMAGE_BASE   = process.env.MYAPI_IMAGE_URL   ?? 'https://api.myimageapi.com';
 export const WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
 export const WORKFLOW_BASE= process.env.MYAPI_WORKFLOW_URL?? 'https://api.myworkflowapi.com';

package/src/container.ts

@@ -0,0 +1,90 @@
+import { request } from './client';
+import { CONTAINER_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// Backend: my-container-api per myapi-hq/internal/routes/container/. Phase 1
+// is metadata + scoped API key issuance; the Cloud Run build/deploy pipeline
+// is Phase 2 — `deployContainer` returns RUNTIME_UNAVAILABLE until it lands.
+export const EXPOSES: Exposes = [
+  'POST /container/orgs/{org_id}/containers',
+  'GET /container/orgs/{org_id}/containers',
+  'GET /container/orgs/{org_id}/containers/{id}',
+  'DELETE /container/orgs/{org_id}/containers/{id}',
+  'POST /container/orgs/{org_id}/containers/{id}/deploy',
+];
+
+// service = HTTP server, worker = always-on background process, job = runs
+// to completion (the only type that accepts a cron_schedule).
+export type ContainerType = 'service' | 'worker' | 'job';
+
+// Mirrors the backend's `Container` struct in crud.go. `url` is empty until
+// the container is deployed.
+export interface Container {
+  id: string;
+  org_id: string;
+  name: string;
+  type: ContainerType;
+  cron_schedule?: string;
+  env: Record<string, unknown>;
+  cpu: string;
+  memory: string;
+  min_instances: number;
+  max_instances: number;
+  port: number;
+  url?: string;
+  status: string;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreatePayload {
+  name: string;                  // required; ^[a-z0-9][a-z0-9-]{0,49}$
+  type?: ContainerType;          // defaults to 'service' server-side
+  cron_schedule?: string;        // only valid when type is 'job'
+  env?: Record<string, unknown>;
+  cpu?: string;                  // defaults to '1'
+  memory?: string;               // defaults to '512Mi'
+  min_instances?: number;        // defaults to 0 ('worker' is forced to >= 1)
+  max_instances?: number;        // defaults to 3
+  port?: number;
+}
+
+// POST response — the scoped API key is returned ONCE. It is delivered to
+// the running container as the MYAPI_KEY environment variable.
+export interface CreateResponse {
+  container: Container;
+  scoped_api_key: string;
+  scoped_api_key_id: string;
+}
+
+// deployContainer response. The scoped key is ROTATED on every deploy — the
+// value here is fresh and the only time it is knowable.
+export interface DeployResponse {
+  container_id: string;
+  revision_id: string;
+  url: string;
+  status: string;
+  scoped_api_key: string;
+}
+
+export async function createContainer(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse> {
+  return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers`, apiKey, payload);
+}
+
+export async function listContainers(apiKey: string, orgId: string): Promise<Container[]> {
+  return request('GET', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers`, apiKey);
+}
+
+export async function getContainer(apiKey: string, orgId: string, containerId: string): Promise<Container> {
+  return request('GET', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
+}
+
+export async function deleteContainer(apiKey: string, orgId: string, containerId: string): Promise<void> {
+  return request('DELETE', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
+}
+
+// deployContainer ships a revision from a pre-built image ref to Cloud Run
+// (source builds land in a later backend slice). Rotates the scoped key.
+export async function deployContainer(apiKey: string, orgId: string, containerId: string, image: string): Promise<DeployResponse> {
+  return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`, apiKey, { image });
+}

package/src/function.ts

@@ -1,24 +1,25 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { FUNCTION_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
-// Backend: Story 1 (per myapi-hq/internal/routes/function/crud.go). Metadata
-// + scoped API key issuance only — Cloudflare Worker upload, /logs, and /env
-// land in Story 2-5. The SDK surface stays minimal until those endpoints
-// exist; do not add forward-compat fields here that the backend will silently
-// ignore.
+// Backend: Story 1 (metadata + scoped API key) and Story 2/4/5 (deploy,
+// runs, env) per myapi-hq/internal/routes/function/. The /logs endpoint is
+// still pending — do not add forward-compat fields the backend will ignore.
 export const EXPOSES: Exposes = [
   'POST /function/orgs/{org_id}/functions',
   'GET /function/orgs/{org_id}/functions',
   'GET /function/orgs/{org_id}/functions/{id}',
   'DELETE /function/orgs/{org_id}/functions/{id}',
+  'POST /function/orgs/{org_id}/functions/{id}/bundle',
+  'POST /function/orgs/{org_id}/functions/{id}/env',
+  'GET /function/orgs/{org_id}/functions/{id}/runs',
 ];
 
 export type TriggerType = 'http' | 'cron';
 
 // Mirrors the backend's `Function` struct in crud.go. `invocation_url`
-// stays an empty string in Story 1; populated by Story 2 once the CF Worker
-// upload pipeline lands.
+// stays an empty string until the function is deployed (uploadBundle).
 export interface Fn {
   id: string;
   org_id: string;
@@ -38,14 +39,33 @@ export interface CreatePayload {
 
 // POST response envelope includes the scoped API key — returned ONCE. The
 // caller must persist it if they want to use it directly; the SDK does not
-// store it. Story 2+ will use this key internally inside the function's
-// runtime shim (`globalThis.MYAPI`).
+// store it. The function's runtime shim (`globalThis.MYAPI`) uses this key
+// internally.
 export interface CreateResponse {
   function: Fn;
   scoped_api_key: string;
   scoped_api_key_id: string;
 }
 
+// uploadBundle response. The scoped API key is ROTATED on every deploy —
+// the value here is fresh and the only time it is knowable. The previous
+// scoped key is revoked server-side.
+export interface DeployResponse {
+  function: Fn;
+  invocation_url: string;
+  scoped_api_key: string;
+}
+
+// One recorded invocation — mirrors the backend's `FunctionRun` struct.
+export interface FunctionRun {
+  id: string;
+  function_id: string;
+  invoked_at: string;
+  duration_ms?: number;
+  status?: string;
+  error_message?: string;
+}
+
 export async function createFunction(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse> {
   return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions`, apiKey, payload);
 }
@@ -61,3 +81,49 @@ export async function getFunction(apiKey: string, orgId: string, fnId: string):
 export async function deleteFunction(apiKey: string, orgId: string, fnId: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}`, apiKey);
 }
+
+// uploadBundle deploys a single-file JS bundle (Story 2). The backend
+// wraps it with the MYAPI shim and uploads to Cloudflare Workers. The
+// multipart field MUST be named `bundle`. Raw upload cap is 4MB.
+export async function uploadBundle(
+  apiKey: string,
+  orgId: string,
+  fnId: string,
+  bundle: Blob | Buffer | string,
+  filename = 'bundle.js',
+): Promise<DeployResponse> {
+  const formData = new FormData();
+  formData.append('bundle', new Blob([bundle as any], { type: 'application/javascript' }), filename);
+
+  const response = await fetch(
+    `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/bundle`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<DeployResponse>).data as DeployResponse;
+}
+
+// setFunctionEnv writes a secret (Stripe key, etc.) as a Cloudflare Worker
+// Secret on the deployed script (Story 5). The function must already be
+// deployed. The value is never stored in MyAPI Postgres or returned.
+export async function setFunctionEnv(apiKey: string, orgId: string, fnId: string, name: string, value: string): Promise<void> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
+}
+
+// listFunctionRuns returns recent invocation records, most recent first
+// (Story 4). Capped at 100 server-side.
+export async function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]> {
+  return request('GET', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/runs`, apiKey);
+}

package/src/funnel.ts

@@ -1,4 +1,5 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { FUNNEL_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -10,6 +11,7 @@ export const EXPOSES: Exposes = [
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
   'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+  'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
 ];
 
 export interface Funnel {
@@ -73,3 +75,66 @@ export async function listFunnelPages(apiKey: string, orgId: string, funnelId: s
 export async function verifyFunnel(apiKey: string, orgId: string, funnelId: string, opts?: { html?: string; slug?: string }): Promise<VerifyResult> {
   return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/verify`, apiKey, opts || {});
 }
+
+// One file in a directory publish: `path` is the path within the site
+// (e.g. "index.html", "assets/app.js"); the backend roots it ("/index.html").
+export interface PublishFile {
+  path: string;
+  content: Blob | Buffer | string;
+}
+
+export interface PublishOptions {
+  // 'dev' or 'prod' channel — defaults to 'prod' server-side.
+  env?: 'dev' | 'prod';
+  // Force SPA fallback. Auto-true server-side when an index.html is present.
+  spaMode?: boolean;
+  // Bind /api/* on the funnel to a deployed function.
+  apiFunctionId?: string;
+}
+
+export interface PublishResult {
+  manifest_id: string;
+  channel: 'dev' | 'prod';
+  file_count: number;
+  size_bytes: number;
+  spa_mode: boolean;
+  published_url: string;
+}
+
+// publishFiles is the my-funnel-api v2 directory publish. Every file is a
+// multipart part named `files`; the part's filename carries the site path.
+// 25MB total cap server-side.
+export async function publishFiles(
+  apiKey: string,
+  orgId: string,
+  funnelId: string,
+  files: PublishFile[],
+  opts: PublishOptions = {},
+): Promise<PublishResult> {
+  const formData = new FormData();
+  for (const f of files) {
+    formData.append('files', new Blob([f.content as any]), f.path);
+  }
+  if (opts.env) formData.append('env', opts.env);
+  if (opts.spaMode !== undefined) formData.append('spa_mode', String(opts.spaMode));
+  if (opts.apiFunctionId) formData.append('api_function_id', opts.apiFunctionId);
+
+  const response = await fetch(
+    `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/files`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<PublishResult>).data as PublishResult;
+}

package/src/hq.ts

@@ -11,7 +11,9 @@ export const EXPOSES: Exposes = [
   'GET /hq/account/free-tier',
   'POST /hq/account/create/key',
   'GET /hq/account/keys',
+  'POST /hq/account/keys/revoke-all',
   'DELETE /hq/account/delete/key/{key_id}',
+  'PATCH /hq/account/spend-cap',
   'POST /hq/orgs',
   'GET /hq/orgs',
   'GET /hq/orgs/{org_id}',
@@ -22,6 +24,7 @@ export const EXPOSES: Exposes = [
   'POST /hq/org-imports/{import_id}/confirm',
   'GET /hq/billing/balance',
   'GET /hq/billing/history',
+  'GET /hq/billing/usage',
   'POST /hq/billing/setup-payment',
   'POST /hq/billing/topup',
 ];
@@ -68,6 +71,44 @@ export interface AccountInfo {
   account_id: string;
   email?: string;
   is_anonymous?: boolean;
+  // Account-level spend cap (IAM "Layer 2"). Present only when a cap is set.
+  spend_cap_cents?: number;
+  current_period_spend_cents?: number;
+}
+
+// ── Capability IAM (design-iam-capability-keys-2026-05-15) ───────────────────
+
+export type GrantAccess = 'read' | 'write';
+
+// A key's slot grants: slot name (or "*" wildcard) → access level.
+// `write` implies `read`. A slot absent from the map = no access.
+export type Grants = Record<string, GrantAccess>;
+
+// The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
+// backend — keep in sync. Used to validate `--grant` client-side before the
+// network call. "*" is also valid in a Grants map but is not a slot name.
+export const GRANTABLE_SLOTS = [
+  'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
+  'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+] as const;
+
+export type KeyKind = 'account' | 'function' | 'manual';
+export type SpendCapPeriod = 'month' | 'day' | 'none';
+
+// Mirrors the backend `keyView`. `api_key` is present ONLY in the create
+// response (returned once). `current_period_spend_cents` is present on list
+// (metered), absent on create (a new key has no spend yet).
+export interface ApiKey {
+  id: string;
+  name: string;
+  prefix: string;
+  kind: KeyKind;
+  org_id: string | null;
+  grants: Grants;
+  spend_cap_cents: number | null;
+  spend_cap_period: string;
+  current_period_spend_cents?: number;
+  api_key?: string;
 }
 
 export async function createAnonymousAccount(): Promise<AuthResult & { subdomain_url: string }> {
@@ -106,11 +147,27 @@ export async function getAccount(apiKey: string): Promise<AccountInfo> {
   return request('GET', `${BASE_URL}/hq/account/me`, apiKey);
 }
 
-export async function createApiKey(apiKey: string, name: string): Promise<{ api_key: string; id: string; prefix: string }> {
-  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, { name });
+export interface CreateApiKeyOptions {
+  // Slot grants. Omitted → backend defaults to unrestricted ({"*":"write"}).
+  grants?: Grants;
+  // Lock the key to a single org. Omitted → account-wide.
+  orgId?: string;
+  // Per-key spend ceiling, in cents. Omitted → no per-key cap.
+  spendCapCents?: number;
+}
+
+// Mints a manual API key. The requested (grants, org, spend cap) must be a
+// subset of the calling key's authority — the backend rejects escalation
+// with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.
+export async function createApiKey(apiKey: string, name: string, opts: CreateApiKeyOptions = {}): Promise<ApiKey> {
+  const body: Record<string, unknown> = { name };
+  if (opts.grants) body.grants = opts.grants;
+  if (opts.orgId) body.org_id = opts.orgId;
+  if (opts.spendCapCents != null) body.spend_cap_cents = opts.spendCapCents;
+  return request('POST', `${BASE_URL}/hq/account/create/key`, apiKey, body);
 }
 
-export async function listApiKeys(apiKey: string): Promise<{ id: string; name: string; prefix: string; created_at: string; last_used_at?: string }[]> {
+export async function listApiKeys(apiKey: string): Promise<ApiKey[]> {
   return request('GET', `${BASE_URL}/hq/account/keys`, apiKey);
 }
 
@@ -118,6 +175,25 @@ export async function revokeApiKey(apiKey: string, keyId: string): Promise<void>
   return request('DELETE', `${BASE_URL}/hq/account/delete/key/${encodeURIComponent(keyId)}`, apiKey);
 }
 
+// The kill switch. With no `kind`, revokes every active key in the account —
+// including the caller's own; recovery is re-auth via login. A `kind` narrows
+// it to one provenance class.
+export async function revokeAllKeys(apiKey: string, kind?: KeyKind): Promise<{ revoked: number }> {
+  return request('POST', `${BASE_URL}/hq/account/keys/revoke-all`, apiKey, kind ? { kind } : {});
+}
+
+// Sets or clears the account-level spend ceiling (IAM "Layer 2"). Pass
+// `null` to clear. `period` defaults to 'month' server-side.
+export async function setAccountSpendCap(
+  apiKey: string,
+  spendCapCents: number | null,
+  period?: SpendCapPeriod,
+): Promise<{ spend_cap_cents: number | null; spend_cap_period: string }> {
+  const body: Record<string, unknown> = { spend_cap_cents: spendCapCents };
+  if (period) body.period = period;
+  return request('PATCH', `${BASE_URL}/hq/account/spend-cap`, apiKey, body);
+}
+
 export async function createOrg(apiKey: string, payload: OrgPayload): Promise<Org> {
   return request('POST', `${BASE_URL}/hq/orgs`, apiKey, payload);
 }
@@ -158,6 +234,29 @@ export async function getBillingHistory(apiKey: string): Promise<{ type: string;
   return request('GET', `${BASE_URL}/hq/billing/history`, apiKey);
 }
 
+// One service's rolled-up spend over the usage window.
+export interface ServiceUsage {
+  service: string;
+  requests: number;
+  cost_display: string;
+}
+
+// Spend rolled up by service — the accurate "where is my money going" view.
+// Aggregates every billing event, unlike the flat/capped history log.
+export interface BillingUsage {
+  period: 'month' | '30d';
+  since: string;
+  services: ServiceUsage[];
+  total_display: string;
+}
+
+// getBillingUsage rolls up spend by service for a window: the current
+// calendar month (default) or the trailing 30 days ('30d').
+export async function getBillingUsage(apiKey: string, period?: 'month' | '30d'): Promise<BillingUsage> {
+  const query = period ? `?period=${encodeURIComponent(period)}` : '';
+  return request('GET', `${BASE_URL}/hq/billing/usage${query}`, apiKey);
+}
+
 export async function setupPayment(apiKey: string): Promise<{ url: string }> {
   return request('POST', `${BASE_URL}/hq/billing/setup-payment`, apiKey);
 }

package/src/index.ts

@@ -23,3 +23,5 @@ export * as llm from './llm';
 export * as database from './database';
 export * as crm from './crm';
 export * as fn from './function';
+export * as payments from './payments';
+export * as container from './container';

package/src/payments.ts

@@ -0,0 +1,97 @@
+import { request } from './client';
+import { PAYMENTS_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// Backend: my-payments-api T0 (BYO Stripe) per
+// myapi-hq/internal/routes/payments/. T1 (Connect Express) is deferred —
+// connect with tier 't1' returns 501. The webhook receiver is public
+// (Stripe signs it); it is listed here for parity but has no SDK function.
+export const EXPOSES: Exposes = [
+  'POST /payments/orgs/{org_id}/connect',
+  'GET /payments/orgs/{org_id}/connect',
+  'POST /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges',
+  'GET /payments/orgs/{org_id}/charges/{id}',
+  'POST /payments/orgs/{org_id}/charges/{id}/refund',
+  'POST /payments/webhook/{org_id}',
+];
+
+// Connection status — the org's Stripe link. T0 takes no platform fee, so
+// `application_fee_bps` is 0.
+export interface ConnectStatus {
+  tier: string;
+  stripe_account_id: string;
+  onboarding_status: string;
+  application_fee_bps?: number;
+}
+
+// Charge billing interval. Absent = a one-off payment.
+export type ChargeInterval = 'month' | 'year';
+
+// A charge — mirrors the backend's `chargeView`.
+export interface Charge {
+  id: string;
+  amount_cents: number;
+  currency: string;
+  every?: ChargeInterval;
+  description?: string;
+  customer_email?: string;
+  status: string;
+  created_at: string;
+  succeeded_at?: string;
+  refunded_at?: string;
+}
+
+// CreateCharge returns a hosted Stripe Checkout URL the agent pastes into
+// its frontend — not a completed payment.
+export interface CreateChargeResponse {
+  payment_id: string;
+  checkout_url: string;
+  status: string;
+}
+
+export interface CreateChargePayload {
+  amount_cents: number;                // required, > 0
+  currency?: string;                   // defaults to 'usd' server-side
+  email?: string;                      // pre-fills the Checkout customer
+  description?: string;                // shows on the Checkout line item
+  every?: ChargeInterval;              // present = a subscription
+  success_url?: string;
+  cancel_url?: string;
+}
+
+// connect links the org's own Stripe account (T0 — BYO secret key). The
+// key is validated live against Stripe and stored encrypted; it never
+// touches MyAPI Postgres or a log line. Pass a 't1' tier to see the
+// 501 T1_DEFERRED path.
+export async function connect(apiKey: string, orgId: string, stripeSecretKey: string, tier: 't0' | 't1' = 't0'): Promise<ConnectStatus> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey, {
+    tier,
+    stripe_secret_key: stripeSecretKey,
+  });
+}
+
+// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// when the org has not connected Stripe.
+export async function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);
+}
+
+// createCharge opens a Stripe Checkout Session on the org's connected
+// account. `every` makes it a subscription; otherwise a one-off payment.
+export async function createCharge(apiKey: string, orgId: string, payload: CreateChargePayload): Promise<CreateChargeResponse> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey, payload);
+}
+
+export async function listCharges(apiKey: string, orgId: string): Promise<Charge[]> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges`, apiKey);
+}
+
+export async function getCharge(apiKey: string, orgId: string, chargeId: string): Promise<Charge> {
+  return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}`, apiKey);
+}
+
+// refundCharge issues a full refund (v1 — partial refunds out of scope).
+export async function refundCharge(apiKey: string, orgId: string, chargeId: string): Promise<{ id: string; status: string }> {
+  return request('POST', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/charges/${encodeURIComponent(chargeId)}/refund`, apiKey);
+}

package/src/services.ts

@@ -171,7 +171,9 @@ export const SERVICES: readonly ServiceMeta[] = [
   {
     module: 'crm',
     skill: 'my-crm-api',
-    domain: 'mycrmapi.com',
+    // Brand domain — mycrmapi.com was unavailable; mypipelineapi.com chosen
+    // and acquired. (Skill stays my-crm-api — domain/skill mismatch accepted.)
+    domain: 'mypipelineapi.com',
     description: 'The canonical store of engaged people + companies. Auto-ingest from inbound webhooks (configurable dot-path). Fixed lifecycle_stage enum, soft delete, event timeline.',
     category: 'data',
     status: 'ga',
@@ -221,17 +223,47 @@ export const SERVICES: readonly ServiceMeta[] = [
     // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
     // `my-function-api` (the agent-discoverable brand name).
     //
-    // Backend status: Story 1 shipped (metadata + scoped API key issuance).
-    // Story 2 (CF Workers upload, invocation URL), Story 4 (/logs), Story 5
-    // (/env) pending. 'planned' reflects "partial backend, not stable GA."
+    // Backend status: deploy/env/runs shipped (CF Workers bundle upload,
+    // invocation URL, Worker Secrets, run history). /logs still pending —
+    // 'preview' reflects "usable, not yet stable GA."
     module: 'fn',
     skill: 'my-function-api',
     domain: 'myfunctionapi.com',
     description: 'Run JavaScript functions on the edge. HTTP or cron triggers. Pre-injected MYAPI SDK scoped to the org — no auth tokens in user code.',
     category: 'compute',
-    status: 'planned',
+    status: 'preview',
     keywords: k('function', 'serverless', 'edge', 'cloudflare-workers', 'http-handler', 'cron'),
   },
-  // Note: my-payments-api removed from registry — backend has no /payments/*
-  // endpoints yet. Re-add when backend ships per tech-spec-my-payments-api-2026-05-14.md.
+  {
+    // CLI top-level command + SDK namespace are both `payments`; skill
+    // directory is `my-payments-api`.
+    //
+    // Backend status: T0 (BYO Stripe) shipped — connect, charges (Checkout
+    // Sessions), refunds, per-org webhook. T1 (Connect Express) is deferred
+    // (connect returns 501 T1_DEFERRED). 'preview' reflects "T0 usable, T1
+    // pending."
+    module: 'payments',
+    skill: 'my-payments-api',
+    domain: 'mypaymentsapi.com',
+    description: 'Take payments with Stripe Checkout. Connect your Stripe account, create one-off or recurring charges, and refund — hosted checkout, no card handling.',
+    category: 'compute',
+    status: 'preview',
+    keywords: k('payments', 'stripe', 'checkout', 'billing', 'subscription'),
+  },
+  {
+    // CLI top-level command + SDK namespace are both `container`; skill
+    // directory is `my-container-api`.
+    //
+    // Backend status: Phase 1 shipped (metadata + scoped API key). The
+    // Cloud Run build/deploy pipeline is Phase 2 — deploy returns
+    // RUNTIME_UNAVAILABLE until it lands. 'preview' reflects "usable
+    // surface, deploy not yet GA."
+    module: 'container',
+    skill: 'my-container-api',
+    domain: 'mycontainerapi.com',
+    description: 'Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.',
+    category: 'compute',
+    status: 'preview',
+    keywords: k('container', 'cloud-run', 'service', 'worker', 'job'),
+  },
 ] as const;