@myapihq/sdk 1.3.13 → 2.0.1

package/dist/services.js

@@ -28,6 +28,15 @@ exports.SERVICES = [
         status: 'ga',
         keywords: k('auth', 'identity', 'billing', 'organization'),
     },
+    {
+        module: 'auth',
+        skill: 'my-auth-api',
+        domain: 'myauthapi.com',
+        description: 'Managed OIDC identity provider for the end users of apps built on MyAPI. Per-org auth tenant + OIDC clients, RS256/JWKS, hosted login, managed Google sign-in. A Kinde alternative.',
+        category: 'identity',
+        status: 'ga',
+        keywords: k('auth', 'oidc', 'oauth', 'login', 'identity', 'sso'),
+    },
     {
         module: 'domain',
         skill: 'my-domain-api',
@@ -46,16 +55,16 @@ exports.SERVICES = [
         module: 'email',
         skill: 'my-email-api',
         domain: 'myemailapi.com',
-        description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, drip campaigns, and warmup.',
+        description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, and warmup.',
         category: 'send',
         status: 'ga',
-        keywords: k('email', 'transactional', 'campaign', 'smtp'),
+        keywords: k('email', 'transactional', 'smtp', 'mailbox'),
     },
     {
         module: 'email',
         skill: 'my-email-verify-api',
         domain: 'myemailapi.com',
-        description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for campaigns.',
+        description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for outbound.',
         category: 'send',
         status: 'ga',
         keywords: k('email', 'verification', 'deliverability', 'syntax', 'dns'),
@@ -175,10 +184,10 @@ exports.SERVICES = [
         module: 'llm',
         skill: 'my-llm-api',
         domain: 'myllmapi.com',
-        description: 'Provider-agnostic LLM completions + embeddings via MyAPI. Routes to managed models (Gemini today, more soon) at upstream cost. Use in workflow steps, not for your own reasoning.',
+        description: 'Self-hosted open-source LLM: raw chat completions (you pick the model) + objective verbs (classify/extract/summarize/draft). Billed in cents per 1M tokens from your balance. Use in workflow steps, not for your own reasoning.',
         category: 'compute',
         status: 'ga',
-        keywords: k('llm', 'completion', 'embedding', 'gemini'),
+        keywords: k('llm', 'completion', 'qwen', 'classify'),
     },
     {
         // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
@@ -236,7 +245,7 @@ exports.SERVICES = [
         domain: 'mygitapi.com',
         description: 'Hosted git repositories over HTTP — create repos, commit files, manage branches and tags, read trees, blobs, history, and diffs. No local clone required.',
         category: 'store',
-        status: 'preview',
+        status: 'ga',
         keywords: k('git', 'repository', 'version-control', 'commit', 'scm'),
     },
     // ── orchestrate ─────────────────────────────────────────────────────

package/dist/storage.d.ts

@@ -7,7 +7,7 @@ export interface Asset {
     created_at: string;
 }
 export declare function ingestAsset(apiKey: string, orgId: string, url: string, name?: string): Promise<Asset>;
-export type UploadContentType = 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'video/mp4' | 'video/webm';
+export type UploadContentType = 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'image/svg+xml' | 'application/pdf' | 'video/mp4' | 'video/webm';
 export declare function uploadAsset(apiKey: string, orgId: string, file: Blob | Buffer, contentType: UploadContentType, name?: string): Promise<Asset>;
 export declare function listAssets(apiKey: string, orgId: string): Promise<Asset[]>;
 export declare function deleteAsset(apiKey: string, orgId: string, assetId: string): Promise<void>;

package/dist/types.d.ts

@@ -7,6 +7,9 @@ export interface ApiResponse<T> {
         latency_ms: number;
         service: string;
         version: string;
+        next_cursor?: string;
+        has_more?: boolean;
+        limit?: number;
     };
 }
 export interface PaginatedResponse<T> {

package/dist/webhook.d.ts

@@ -8,6 +8,7 @@ export interface WebhookEndpoint {
     slug: string;
     url: string;
     crm_email_path?: string;
+    forward_url?: string;
     created_at: string;
 }
 export interface Delivery {
@@ -15,6 +16,9 @@ export interface Delivery {
     endpoint_id: string;
     payload: unknown;
     received_at: string;
+    forward_status?: number;
+    last_forward_at?: string;
+    last_forward_error?: string;
 }
 export interface CreateEndpointOptions {
     description?: string;

package/dist/workflow.d.ts

@@ -58,6 +58,16 @@ export interface WorkflowRun {
     started_at?: string;
     finished_at?: string;
     created_at: string;
+    step_outputs?: unknown[];
+}
+export interface ListRunsOptions {
+    limit?: number;
+    cursor?: string;
+}
+export interface WorkflowRunsPage {
+    runs: WorkflowRun[];
+    next_cursor?: string;
+    has_more?: boolean;
 }
 export declare function createWorkflow(apiKey: string, orgId: string, payload: {
     name: string;
@@ -78,5 +88,5 @@ export declare function updateWorkflow(apiKey: string, orgId: string, workflowId
 export declare function enableWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
 export declare function disableWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
 export declare function deleteWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
-export declare function listWorkflowRuns(apiKey: string, orgId: string, workflowId: string): Promise<WorkflowRun[]>;
+export declare function listWorkflowRuns(apiKey: string, orgId: string, workflowId: string, opts?: ListRunsOptions): Promise<WorkflowRunsPage>;
 export declare function getWorkflowRun(apiKey: string, orgId: string, runId: string): Promise<WorkflowRun>;

package/dist/workflow.js

@@ -72,8 +72,18 @@ async function disableWorkflow(apiKey, orgId, workflowId) {
 async function deleteWorkflow(apiKey, orgId, workflowId) {
     return (0, client_1.request)('DELETE', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey);
 }
-async function listWorkflowRuns(apiKey, orgId, workflowId) {
-    return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs`, apiKey);
+// listWorkflowRuns returns recent runs newest-first. The backend wraps this
+// in a keyset-pagination envelope (limit 1-500 + cursor), so we use
+// requestPage to preserve next_cursor — a plain `request` would drop it.
+async function listWorkflowRuns(apiKey, orgId, workflowId, opts = {}) {
+    const qs = new URLSearchParams();
+    if (opts.limit !== undefined)
+        qs.set('limit', String(opts.limit));
+    if (opts.cursor)
+        qs.set('cursor', opts.cursor);
+    const query = qs.toString() ? `?${qs.toString()}` : '';
+    const page = await (0, client_1.requestPage)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs${query}`, apiKey);
+    return { runs: page.data, next_cursor: page.next_cursor, has_more: page.has_more };
 }
 async function getWorkflowRun(apiKey, orgId, runId) {
     return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/runs/${encodeURIComponent(runId)}`, apiKey);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.3.13",
+  "version": "2.0.1",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth.ts

@@ -0,0 +1,129 @@
+import { request } from './client';
+import { AUTH_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// The end-user auth product (my-auth-api): a managed multi-tenant OIDC
+// Identity Provider for the END USERS of apps built on MyAPI. Distinct from
+// operator/account auth (hq/account/*). Each org gets one auth tenant; OIDC
+// clients (apps) register against it. End users sign in with managed Google,
+// email/password, or magic links (per the tenant's `connections`). Tokens are
+// RS256, verified via the tenant's JWKS.
+//
+// The browser/app-facing OIDC + sign-in flows — discovery, jwks, authorize,
+// token, userinfo, password/magic/google login, verify-email, password reset,
+// the hosted login page — are machine/end-user surfaces consumed by apps, the
+// JS SDK, and browsers, NOT management calls; they are not CLI/SDK verbs. This
+// module covers only the org-scoped MANAGEMENT surface: tenant, clients, MAU
+// usage, and the custom auth domain.
+export const EXPOSES: Exposes = [
+  'POST /auth/orgs/{org_id}/tenant',
+  'GET /auth/orgs/{org_id}/tenant',
+  'POST /auth/orgs/{org_id}/clients',
+  'GET /auth/orgs/{org_id}/clients',
+  'GET /auth/orgs/{org_id}/usage',
+  'POST /auth/orgs/{org_id}/domain',
+  'GET /auth/orgs/{org_id}/domain',
+  'DELETE /auth/orgs/{org_id}/domain',
+];
+
+// Sign-in methods a tenant offers on its hosted login page.
+export type AuthConnection = 'google' | 'password' | 'magic';
+
+export interface Tenant {
+  tenant_id: string;
+  issuer: string;     // OIDC issuer: <base>/<tenant_id>
+  login_url: string;  // hosted authorize endpoint
+  connections?: AuthConnection[];
+}
+
+export interface CreateTenantInput {
+  // Sign-in methods to enable. Defaults to ['google'] when omitted.
+  connections?: AuthConnection[];
+  // Opaque JSON for the hosted login page (branding).
+  theme?: unknown;
+}
+
+export interface AuthClient {
+  client_id: string;
+  name?: string;
+  type: 'spa' | 'web';
+  redirect_uris: string[];
+  issuer?: string;
+  // Returned exactly ONCE, on create, for confidential ('web') clients.
+  // SPA clients are public and have no secret.
+  client_secret?: string;
+  created_at?: string;
+}
+
+export interface ListClientsResponse {
+  clients: AuthClient[];
+}
+
+export interface CreateClientInput {
+  name: string;
+  type: 'spa' | 'web';
+  redirect_uris: string[];
+}
+
+// Monthly-active-user metering for the tenant (auth is billed per MAU).
+export interface AuthUsage {
+  period: string;            // 'YYYY-MM'
+  active_users: number;
+  price_cents_each: number;
+}
+
+// A custom auth domain (e.g. auth.acme.com) for the tenant's hosted login + issuer.
+export interface AuthDomain {
+  domain: string;
+  status: 'pending' | 'active';
+  dns: { type: string; name: string; value: string };
+  next?: string;
+  issuer?: string;     // present once active
+  login_url?: string;  // present once active
+}
+
+// Create (or update) the org's auth tenant. Idempotent. `connections` selects
+// the sign-in methods (subset of google/password/magic; defaults to google);
+// `theme` is opaque JSON for the hosted login page.
+export async function createTenant(apiKey: string, orgId: string, input: CreateTenantInput = {}): Promise<Tenant> {
+  const body: Record<string, unknown> = {};
+  if (input.connections !== undefined) body.connections = input.connections;
+  if (input.theme !== undefined) body.theme = input.theme;
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey, body);
+}
+
+// Fetch the org's auth tenant. Rejects with TENANT_NOT_FOUND if not created.
+export async function getTenant(apiKey: string, orgId: string): Promise<Tenant> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey);
+}
+
+// Register an OIDC client (an app) under the org's tenant. Auto-provisions the
+// tenant if absent. For type 'web' the response carries `client_secret` once.
+export async function createClient(apiKey: string, orgId: string, input: CreateClientInput): Promise<AuthClient> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey, input);
+}
+
+export async function listClients(apiKey: string, orgId: string): Promise<ListClientsResponse> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey);
+}
+
+// Monthly-active-user usage for the current period (auth is billed per MAU).
+export async function getUsage(apiKey: string, orgId: string): Promise<AuthUsage> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/usage`, apiKey);
+}
+
+// Set a custom auth domain (e.g. auth.acme.com). Returns the DNS record to
+// create; TLS provisions automatically and the domain becomes the issuer once
+// active. One custom domain per org.
+export async function registerDomain(apiKey: string, orgId: string, domain: string): Promise<AuthDomain> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
+}
+
+// Fetch the org's custom auth domain. Rejects with NO_DOMAIN if none set.
+export async function getDomain(apiKey: string, orgId: string): Promise<AuthDomain> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey);
+}
+
+export async function deleteDomain(apiKey: string, orgId: string, domain: string): Promise<{ domain: string; status: string }> {
+  return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
+}

package/src/client.ts

@@ -12,13 +12,13 @@ export class MyApiError extends Error {
   }
 }
 
-export async function request<T>(
+async function requestFull<T>(
   method: string,
   url: string,
   apiKey?: string,
   body?: unknown,
   extraHeaders?: Record<string, string>,
-): Promise<T> {
+): Promise<ApiResponse<T>> {
   const headers: Record<string, string> = {};
 
   if (apiKey) {
@@ -48,7 +48,7 @@ export async function request<T>(
   const response = await fetch(url, options);
 
   if (response.status === 204) {
-    return undefined as T;
+    return { success: true, data: null, error: null, meta: {} as ApiResponse<T>['meta'] };
   }
 
   // Read the body as text first so we can include a snippet in errors when
@@ -85,5 +85,37 @@ export async function request<T>(
     throw new MyApiError(code, response.status, detail, errBody);
   }
 
-  return apiResponse.data as T;
+  return apiResponse;
+}
+
+// Returns the unwrapped `data` payload — the common case.
+export async function request<T>(
+  method: string,
+  url: string,
+  apiKey?: string,
+  body?: unknown,
+  extraHeaders?: Record<string, string>,
+): Promise<T> {
+  return (await requestFull<T>(method, url, apiKey, body, extraHeaders)).data as T;
+}
+
+export interface Page<T> {
+  data: T[];
+  next_cursor?: string;
+  has_more?: boolean;
+}
+
+// For keyset-paginated endpoints (backend `envelope.WrapPage`): `data` is a
+// bare array and the cursor/has_more live under `meta`. `request` would drop
+// the cursor, so list endpoints with pagination must use this.
+export async function requestPage<T>(
+  method: string,
+  url: string,
+  apiKey?: string,
+  body?: unknown,
+  extraHeaders?: Record<string, string>,
+): Promise<Page<T>> {
+  const r = await requestFull<T[]>(method, url, apiKey, body, extraHeaders);
+  const meta = (r.meta ?? {}) as { next_cursor?: string; has_more?: boolean };
+  return { data: (r.data ?? []) as T[], next_cursor: meta.next_cursor, has_more: meta.has_more };
 }

package/src/config.ts

@@ -36,3 +36,4 @@ export const AUDIENCE_BASE= process.env.MYAPI_AUDIENCE_URL?? GATEWAY;
 export const LLM_BASE     = process.env.MYAPI_LLM_URL     ?? GATEWAY;
 export const DATABASE_BASE= process.env.MYAPI_DATABASE_URL?? GATEWAY;
 export const CRM_BASE     = process.env.MYAPI_CRM_URL     ?? GATEWAY;
+export const AUTH_BASE    = process.env.MYAPI_AUTH_URL    ?? GATEWAY;

package/src/container.ts

@@ -1,4 +1,5 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { CONTAINER_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -39,6 +40,9 @@ export interface Container {
   // Origin Rule that rewrites Host + SNI to the Cloud Run hostname.
   custom_domain?: string;
   status: string;
+  // Egress mode for the container's outbound traffic (backend returns it on
+  // every row, container/crud.go). Static-IP vs. default depending on config.
+  egress: string;
   created_at: string;
   updated_at: string;
 }
@@ -89,12 +93,58 @@ export async function deleteContainer(apiKey: string, orgId: string, containerId
   return request('DELETE', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
 }
 
-// deployContainer ships a revision from a pre-built image ref to Cloud Run
-// (source builds land in a later backend slice). Rotates the scoped key.
+// deployContainer ships a revision from a pre-built image ref to Cloud Run.
+// Synchronous — returns status='active' with a rotated scoped key.
 export async function deployContainer(apiKey: string, orgId: string, containerId: string, image: string): Promise<DeployResponse> {
   return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`, apiKey, { image });
 }
 
+// BuildDeployResponse — the async source-build path. The backend records a
+// `building` revision, kicks off Cloud Build on a background goroutine, and
+// returns immediately. The scoped key is minted later (once the image
+// exists), so it is NOT in this response. Poll getContainer until
+// status='active' (or 'build_error'/'deploy_error').
+export interface BuildDeployResponse {
+  container_id: string;
+  revision_id: string;
+  status: string;       // 'building'
+  message?: string;
+}
+
+// deployContainerSource uploads a build-context tarball via multipart `source`
+// (backend deploy.go builds it via Cloud Build → Artifact Registry, then
+// deploys). Asynchronous: returns status='building' to poll. The tarball is
+// capped at 100MB server-side. Mirrors the multipart upload in storage.ts.
+export async function deployContainerSource(
+  apiKey: string,
+  orgId: string,
+  containerId: string,
+  tarball: Blob | Buffer,
+  filename = 'source.tar.gz',
+): Promise<BuildDeployResponse> {
+  const formData = new FormData();
+  formData.append('source', new Blob([tarball as any], { type: 'application/gzip' }), filename);
+
+  const response = await fetch(
+    `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<BuildDeployResponse>).data as BuildDeployResponse;
+}
+
 // One runtime log line from the container's Cloud Run resource.
 export interface LogEntry {
   timestamp: string;

package/src/crm.ts

@@ -1,4 +1,4 @@
-import { request } from './client';
+import { request, requestPage } from './client';
 import { CRM_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -46,7 +46,8 @@ export type EventKind =
   | 'email_clicked'
   | 'email_replied'
   | 'pixel_visit'
-  | 'webhook_received';
+  | 'webhook_received'
+  | 'payment';
 
 // Goldfox enrichment is a live join — the response embeds the current
 // Goldfox row when goldfox_person_id is set. v1: returns null until the
@@ -204,7 +205,10 @@ export async function getContactEvents(apiKey: string, orgId: string, id: string
   if (opts.kind != null) qs.append('kind', opts.kind);
   const q = qs.toString();
   const url = `${BASE_URL}/crm/orgs/${encodeURIComponent(orgId)}/contacts/${encodeURIComponent(id)}/events${q ? `?${q}` : ''}`;
-  return request('GET', url, apiKey);
+  // Paginated (WrapPage): events are the bare `data` array with the cursor
+  // under `meta` — use requestPage so `next_cursor` survives.
+  const page = await requestPage<ContactEvent>('GET', url, apiKey);
+  return { events: page.data, next_cursor: page.next_cursor };
 }
 
 // ── Companies ─────────────────────────────────────────────────────────────

package/src/database.ts

@@ -1,4 +1,4 @@
-import { request } from './client';
+import { request, requestPage } from './client';
 import { DATABASE_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -71,7 +71,10 @@ export async function listKeys(apiKey: string, orgId: string, ns: string, opts:
   if (opts.values) qs.append('values', 'true');
   const q = qs.toString();
   const url = `${BASE_URL}/database/orgs/${encodeURIComponent(orgId)}/namespaces/${encodeURIComponent(ns)}/keys${q ? `?${q}` : ''}`;
-  return request('GET', url, apiKey);
+  // Paginated (WrapPage): keys come back as the bare `data` array with the
+  // cursor under `meta` — must use requestPage or the cursor is lost.
+  const page = await requestPage<KeyEntry>('GET', url, apiKey);
+  return { keys: page.data, next_cursor: page.next_cursor };
 }
 
 export async function getKey(apiKey: string, orgId: string, ns: string, key: string): Promise<KeyEntry> {

package/src/domain.ts

@@ -211,7 +211,7 @@ export async function deleteDnsRecord(apiKey: string, orgId: string, domain: str
 export interface EmailInfraResponse {
   domain: string;
   email_infra: 'pending' | 'ready' | 'error';
-  email_subdomain: string;
+  subdomain: string;
   next_step?: string;
 }
 

package/src/email.ts

@@ -31,18 +31,6 @@ export const EXPOSES: Exposes = [
   'POST /email/orgs/{org_id}/templates/{template_id}/send-test',
   'DELETE /email/orgs/{org_id}/templates/{template_id}',
   'GET /email/templates/{template_id}/preview',
-  // Campaigns
-  'POST /email/orgs/{org_id}/campaigns',
-  'GET /email/orgs/{org_id}/campaigns',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}',
-  'PATCH /email/orgs/{org_id}/campaigns/{campaign_id}',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/upload-list',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/upload-file',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/status',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/start',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/pause',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/resume',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}/stats',
   // Verify
   'POST /email/orgs/{org_id}/verify',
   'POST /email/orgs/{org_id}/verify-bulk',
@@ -51,14 +39,6 @@ export const EXPOSES: Exposes = [
 
 export interface EmailMessage { message_id: string; from: string; subject: string; body?: string; received_at: string }
 export interface EmailTemplate { id: string; name: string; subject: string; preview_url: string; created_at: string; updated_at: string }
-export interface WarmupConfig { enabled: boolean; start: number; increment: number; max: number; }
-export interface Campaign { id: string; name: string; status: string; template_id: string; from_address: string; per_day_limit: number; warmup_config?: WarmupConfig; created_at: string }
-export interface CampaignStats {
-  campaign: Campaign;
-  validation: { total: number; valid: number; invalid: number; pending: number; list_status: string };
-  dispatch: { sent: number; remaining: number; sent_this_hour: number; hour_limit: number; last_dispatch_at: string };
-  engagement: { sent: number; opens: number; clicks: number; page_visits: number };
-}
 
 // ── Email verification ──────────────────────────────────────────────────────
 //
@@ -138,8 +118,7 @@ export async function createMailbox(apiKey: string, domain: string, username: st
 }
 
 // Backend (2026-06-06): idempotent — 204 whether the mailbox existed or not.
-// Returns 409 MAILBOX_IN_USE when an active/paused campaign still sends from
-// this address; pause/delete the campaign first.
+// May return 409 MAILBOX_IN_USE if the address is still referenced server-side.
 export async function deleteMailbox(apiKey: string, address: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/email/mailboxes/${encodeURIComponent(address)}`, apiKey);
 }
@@ -264,59 +243,3 @@ export async function listTemplates(apiKey: string, orgId: string): Promise<Emai
 export async function deleteTemplate(apiKey: string, orgId: string, templateId: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/templates/${encodeURIComponent(templateId)}`, apiKey);
 }
-
-// ── Campaigns (org-scoped) ───────────────────────────────────────────────────
-
-export async function createCampaign(apiKey: string, orgId: string, payload: { name: string; template_id: string; from_address: string; per_day_limit?: number; warmup_config?: WarmupConfig | null; }): Promise<Campaign> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns`, apiKey, payload);
-}
-
-export async function uploadContactList(apiKey: string, orgId: string, campaignId: string, emails: string[]): Promise<{ list_id: string; total: number; status: string }> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/upload-list`, apiKey, { emails });
-}
-
-export async function uploadContactsFile(apiKey: string, orgId: string, campaignId: string, file: Blob | ArrayBuffer | Uint8Array, filename: string = 'contacts.csv'): Promise<{ list_id: string; total: number; status: string }> {
-  const form = new FormData();
-  const blob = file instanceof Blob ? file : new Blob([file as BlobPart]);
-  form.append('file', blob, filename);
-  const res = await fetch(`${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/upload-file`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${apiKey}` },
-    body: form,
-  });
-  const json = await res.json();
-  if (!res.ok || !json.success) throw new Error(json.error?.code || json.error || 'upload_failed');
-  return json.data;
-}
-
-export async function getContactUploadStatus(apiKey: string, orgId: string, campaignId: string): Promise<{ upload_status: 'ready' | 'validating' | 'failed'; total: number; valid_count: number; invalid_count: number }> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/status`, apiKey);
-}
-
-export async function startCampaign(apiKey: string, orgId: string, campaignId: string): Promise<{ status: string }> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/start`, apiKey);
-}
-
-export async function pauseCampaign(apiKey: string, orgId: string, campaignId: string): Promise<void> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/pause`, apiKey);
-}
-
-export async function resumeCampaign(apiKey: string, orgId: string, campaignId: string): Promise<void> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/resume`, apiKey);
-}
-
-export async function getCampaignStats(apiKey: string, orgId: string, campaignId: string): Promise<CampaignStats> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/stats`, apiKey);
-}
-
-export async function listCampaigns(apiKey: string, orgId: string): Promise<Campaign[]> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns`, apiKey);
-}
-
-export async function getCampaign(apiKey: string, orgId: string, campaignId: string): Promise<Campaign> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}`, apiKey);
-}
-
-export async function updateCampaign(apiKey: string, orgId: string, campaignId: string, payload: { name?: string; per_day_limit?: number }): Promise<Campaign> {
-  return request('PATCH', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}`, apiKey, payload);
-}

package/src/function.ts

@@ -35,6 +35,10 @@ export interface CreatePayload {
   name: string;                        // required; ^[a-z0-9][a-z0-9-]{0,49}$
   trigger_type?: TriggerType;          // optional, defaults to 'http' server-side
   cron_schedule?: string;              // required if trigger_type === 'cron'
+  // Optional slot allow-list narrowing the minted function key's grants
+  // (backend crud.go: CreateFunction `scopes`). Empty/omitted inherits the
+  // deploying caller's grants (legacy). Grants can never exceed the caller.
+  scopes?: string[];
 }
 
 // POST response envelope includes the scoped API key — returned ONCE. The
@@ -122,6 +126,14 @@ export async function setFunctionEnv(apiKey: string, orgId: string, fnId: string
   return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
 }
 
+// setFunctionEnvBulk writes multiple Worker Secrets in one call. The backend
+// (env.go) loops, calling Cloudflare once per secret, and returns `{set:N}`.
+// The single-secret `setFunctionEnv` above stays the canonical one-off path;
+// this is the bulk variant. The function must already be deployed.
+export async function setFunctionEnvBulk(apiKey: string, orgId: string, fnId: string, env: Record<string, string>): Promise<{ set: number }> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { env });
+}
+
 // listFunctionRuns returns recent invocation records, most recent first
 // (Story 4). Capped at 100 server-side.
 export async function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]> {

package/src/funnel.ts

@@ -62,7 +62,7 @@ export interface VerifyResult {
   pages?: Array<{ slug: string; tests: VerifyTest[] }>;
   tests?: VerifyTest[];
 }
-export interface VerifyTest { type: 'link' | 'webhook'; url: string; passed: boolean; details: string }
+export interface VerifyTest { type: 'link' | 'image' | 'webhook'; url: string; passed: boolean; details: string }
 
 export async function createFunnel(apiKey: string, orgId: string, opts?: { name?: string }): Promise<CreateFunnelResponse> {
   // v2: accept optional name for N-funnels-per-org. Backend rejects names

package/src/index.ts

@@ -7,6 +7,7 @@ export * from './client';
 // CJS-compiled SDK. If you need a base URL in a downstream package, mirror
 // the constant locally — it's one line and the comment makes it obvious.
 export * as hq from './hq';
+export * as auth from './auth';
 export * as domain from './domain';
 export * as email from './email';
 export * as funnel from './funnel';