@myapihq/sdk 1.3.13 → 2.1.0

package/dist/hq.d.ts

@@ -138,6 +138,26 @@ export declare function setupPayment(apiKey: string): Promise<{
 export declare function topUp(apiKey: string, amountDollars: number): Promise<{
     new_balance_display: string;
 }>;
+export type RechargeStatus = 'succeeded' | 'failed' | 'capped' | 'no_pm' | 'pending';
+export interface AutoRechargeConfig {
+    enabled: boolean;
+    threshold_cents: number | null;
+    amount_cents: number | null;
+    monthly_cap_cents: number | null;
+    month_to_date_recharged_cents: number;
+    has_payment_method: boolean;
+    last_recharge_status: RechargeStatus | null;
+    last_recharge_attempt_at: string | null;
+}
+export declare function getAutoRecharge(apiKey: string): Promise<AutoRechargeConfig>;
+export interface SetAutoRechargeInput {
+    enabled: boolean;
+    threshold_cents?: number;
+    amount_cents?: number;
+    monthly_cap_cents?: number;
+}
+export declare function setAutoRecharge(apiKey: string, input: SetAutoRechargeInput): Promise<AutoRechargeConfig>;
+export declare function disableAutoRecharge(apiKey: string): Promise<void>;
 export type DoctorSeverity = 'ok' | 'warn' | 'crit';
 export interface DoctorEntityRef {
     slot: string;
@@ -152,11 +172,13 @@ export interface DoctorIssue {
     category?: string;
     message: string;
     hint?: string;
+    operator_only?: boolean;
 }
 export interface DoctorSection {
     name: string;
     summary: string;
     issues: DoctorIssue[];
+    resource_count?: number;
 }
 export interface DoctorReport {
     org_id: string;

package/dist/hq.js

@@ -27,6 +27,9 @@ exports.getBillingHistory = getBillingHistory;
 exports.getBillingUsage = getBillingUsage;
 exports.setupPayment = setupPayment;
 exports.topUp = topUp;
+exports.getAutoRecharge = getAutoRecharge;
+exports.setAutoRecharge = setAutoRecharge;
+exports.disableAutoRecharge = disableAutoRecharge;
 exports.getDoctor = getDoctor;
 const client_1 = require("./client");
 const config_1 = require("./config");
@@ -170,6 +173,21 @@ async function setupPayment(apiKey) {
 async function topUp(apiKey, amountDollars) {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/billing/topup`, apiKey, { amount_dollars: amountDollars });
 }
+async function getAutoRecharge(apiKey) {
+    return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/billing/auto-recharge`, apiKey);
+}
+// Enable/update auto-recharge. The backend validates invariants and rejects
+// with a 400 (`MISSING_FIELDS`, `AMOUNT_BELOW_FLOOR` [$5 floor],
+// `AMOUNT_LT_THRESHOLD`, `CAP_LT_AMOUNT`, `NO_PAYMENT_METHOD`) — surfaced as a
+// MyApiError. Returns the full config on success.
+async function setAutoRecharge(apiKey, input) {
+    return (0, client_1.request)('PUT', `${config_1.HQ_BASE}/hq/billing/auto-recharge`, apiKey, input);
+}
+// Disable auto-recharge (the threshold/amount/cap are preserved for easy
+// re-enable). Backend returns 204 No Content.
+async function disableAutoRecharge(apiKey) {
+    return (0, client_1.request)('DELETE', `${config_1.HQ_BASE}/hq/billing/auto-recharge`, apiKey);
+}
 async function getDoctor(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/orgs/${encodeURIComponent(orgId)}/doctor`, apiKey);
 }

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export * from './types';
 export * from './client';
+export * from './funds';
 export * as hq from './hq';
+export * as auth from './auth';
 export * as domain from './domain';
 export * as email from './email';
 export * as funnel from './funnel';

package/dist/index.js

@@ -36,9 +36,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.task = exports.queue = exports.git = exports.container = exports.payments = exports.fn = exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.hq = void 0;
+exports.task = exports.queue = exports.git = exports.container = exports.payments = exports.fn = exports.crm = exports.database = exports.llm = exports.audience = exports.company = exports.people = exports.url = exports.workflow = exports.webhook = exports.storage = exports.pixel = exports.image = exports.funnel = exports.email = exports.domain = exports.auth = exports.hq = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./client"), exports);
+__exportStar(require("./funds"), exports);
 // Note: config constants (STORAGE_BASE etc.) are NOT re-exported from the
 // barrel. TypeScript compiles `export * from './config'` to a runtime
 // `__exportStar` call that Node's cjs-module-lexer can't see through, so
@@ -46,6 +47,7 @@ __exportStar(require("./client"), exports);
 // CJS-compiled SDK. If you need a base URL in a downstream package, mirror
 // the constant locally — it's one line and the comment makes it obvious.
 exports.hq = __importStar(require("./hq"));
+exports.auth = __importStar(require("./auth"));
 exports.domain = __importStar(require("./domain"));
 exports.email = __importStar(require("./email"));
 exports.funnel = __importStar(require("./funnel"));

package/dist/payments.d.ts

@@ -1,6 +1,7 @@
 import type { Exposes } from './exposes';
 export declare const EXPOSES: Exposes;
 export interface ConnectStatus {
+    connected?: boolean;
     tier: string;
     stripe_account_id: string;
     onboarding_status: string;

package/dist/payments.js

@@ -32,7 +32,7 @@ async function connect(apiKey, orgId, stripeSecretKey, tier = 't0') {
         stripe_secret_key: stripeSecretKey,
     });
 }
-// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// getConnect reads the org's connection status. Returns { connected: false } when no Stripe is linked (no longer a 404).
 // when the org has not connected Stripe.
 async function getConnect(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.PAYMENTS_BASE}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);

package/dist/queue.d.ts

@@ -41,6 +41,7 @@ export interface EnqueueOptions {
 export declare function createQueue(apiKey: string, orgId: string, opts: CreateQueueOptions): Promise<Queue>;
 export declare function listQueues(apiKey: string, orgId: string): Promise<Queue[]>;
 export declare function getQueue(apiKey: string, orgId: string, name: string): Promise<Queue>;
+export declare function deleteQueue(apiKey: string, orgId: string, name: string): Promise<void>;
 export declare function enqueueJob(apiKey: string, orgId: string, name: string, opts?: EnqueueOptions): Promise<Job>;
 export declare function listJobs(apiKey: string, orgId: string, name: string, opts?: {
     status?: string;

package/dist/queue.js

@@ -4,6 +4,7 @@ exports.EXPOSES = void 0;
 exports.createQueue = createQueue;
 exports.listQueues = listQueues;
 exports.getQueue = getQueue;
+exports.deleteQueue = deleteQueue;
 exports.enqueueJob = enqueueJob;
 exports.listJobs = listJobs;
 exports.getJob = getJob;
@@ -17,6 +18,7 @@ exports.EXPOSES = [
     'POST /queue/orgs/{org_id}/queues',
     'GET /queue/orgs/{org_id}/queues',
     'GET /queue/orgs/{org_id}/queues/{name}',
+    'DELETE /queue/orgs/{org_id}/queues/{name}',
     'POST /queue/orgs/{org_id}/queues/{name}/jobs',
     'GET /queue/orgs/{org_id}/queues/{name}/jobs',
     'GET /queue/orgs/{org_id}/jobs/{id}',
@@ -41,6 +43,9 @@ async function listQueues(apiKey, orgId) {
 async function getQueue(apiKey, orgId, name) {
     return (0, client_1.request)('GET', `${queuesBase(orgId)}/${encodeURIComponent(name)}`, apiKey);
 }
+async function deleteQueue(apiKey, orgId, name) {
+    return (0, client_1.request)('DELETE', `${queuesBase(orgId)}/${encodeURIComponent(name)}`, apiKey);
+}
 // enqueueJob is idempotent on (queue, dedup_key). A job with unsucceeded
 // depends_on starts blocked.
 async function enqueueJob(apiKey, orgId, name, opts = {}) {

package/dist/services.js

@@ -28,6 +28,15 @@ exports.SERVICES = [
         status: 'ga',
         keywords: k('auth', 'identity', 'billing', 'organization'),
     },
+    {
+        module: 'auth',
+        skill: 'my-auth-api',
+        domain: 'myauthapi.com',
+        description: 'Managed OIDC identity provider for the end users of apps built on MyAPI. Per-org auth tenant + OIDC clients, RS256/JWKS, hosted login, managed Google sign-in. A Kinde alternative.',
+        category: 'identity',
+        status: 'ga',
+        keywords: k('auth', 'oidc', 'oauth', 'login', 'identity', 'sso'),
+    },
     {
         module: 'domain',
         skill: 'my-domain-api',
@@ -39,23 +48,23 @@ exports.SERVICES = [
     },
     // ── send ────────────────────────────────────────────────────────────
     {
-        // Customer-facing email surface — mailboxes, campaigns, templates,
-        // warmup. Launched 2026-05-17: the backend lifted the pre-launch gate
+        // Customer-facing email surface — mailboxes, transactional send,
+        // templates, warmup. Launched 2026-05-17: the backend lifted the pre-launch gate
         // (the [disabled, pre-launch] / 503 SERVICE_NOT_LAUNCHED state is gone).
         // Sibling `my-email-verify-api` is the sync single-address verifier.
         module: 'email',
         skill: 'my-email-api',
         domain: 'myemailapi.com',
-        description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, drip campaigns, and warmup.',
+        description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, and warmup.',
         category: 'send',
         status: 'ga',
-        keywords: k('email', 'transactional', 'campaign', 'smtp'),
+        keywords: k('email', 'transactional', 'smtp', 'mailbox'),
     },
     {
         module: 'email',
         skill: 'my-email-verify-api',
         domain: 'myemailapi.com',
-        description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for campaigns.',
+        description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for outbound.',
         category: 'send',
         status: 'ga',
         keywords: k('email', 'verification', 'deliverability', 'syntax', 'dns'),
@@ -175,10 +184,10 @@ exports.SERVICES = [
         module: 'llm',
         skill: 'my-llm-api',
         domain: 'myllmapi.com',
-        description: 'Provider-agnostic LLM completions + embeddings via MyAPI. Routes to managed models (Gemini today, more soon) at upstream cost. Use in workflow steps, not for your own reasoning.',
+        description: 'Self-hosted open-source LLM: raw chat completions (you pick the model) + objective verbs (classify/extract/summarize/draft). Billed in cents per 1M tokens from your balance. Use in workflow steps, not for your own reasoning.',
         category: 'compute',
         status: 'ga',
-        keywords: k('llm', 'completion', 'embedding', 'gemini'),
+        keywords: k('llm', 'completion', 'qwen', 'classify'),
     },
     {
         // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
@@ -236,7 +245,7 @@ exports.SERVICES = [
         domain: 'mygitapi.com',
         description: 'Hosted git repositories over HTTP — create repos, commit files, manage branches and tags, read trees, blobs, history, and diffs. No local clone required.',
         category: 'store',
-        status: 'preview',
+        status: 'ga',
         keywords: k('git', 'repository', 'version-control', 'commit', 'scm'),
     },
     // ── orchestrate ─────────────────────────────────────────────────────

package/dist/storage.d.ts

@@ -7,7 +7,7 @@ export interface Asset {
     created_at: string;
 }
 export declare function ingestAsset(apiKey: string, orgId: string, url: string, name?: string): Promise<Asset>;
-export type UploadContentType = 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'video/mp4' | 'video/webm';
+export type UploadContentType = 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'image/svg+xml' | 'application/pdf' | 'video/mp4' | 'video/webm';
 export declare function uploadAsset(apiKey: string, orgId: string, file: Blob | Buffer, contentType: UploadContentType, name?: string): Promise<Asset>;
 export declare function listAssets(apiKey: string, orgId: string): Promise<Asset[]>;
 export declare function deleteAsset(apiKey: string, orgId: string, assetId: string): Promise<void>;

package/dist/types.d.ts

@@ -7,6 +7,9 @@ export interface ApiResponse<T> {
         latency_ms: number;
         service: string;
         version: string;
+        next_cursor?: string;
+        has_more?: boolean;
+        limit?: number;
     };
 }
 export interface PaginatedResponse<T> {

package/dist/webhook.d.ts

@@ -8,6 +8,7 @@ export interface WebhookEndpoint {
     slug: string;
     url: string;
     crm_email_path?: string;
+    forward_url?: string;
     created_at: string;
 }
 export interface Delivery {
@@ -15,6 +16,9 @@ export interface Delivery {
     endpoint_id: string;
     payload: unknown;
     received_at: string;
+    forward_status?: number;
+    last_forward_at?: string;
+    last_forward_error?: string;
 }
 export interface CreateEndpointOptions {
     description?: string;

package/dist/workflow.d.ts

@@ -58,6 +58,16 @@ export interface WorkflowRun {
     started_at?: string;
     finished_at?: string;
     created_at: string;
+    step_outputs?: unknown[];
+}
+export interface ListRunsOptions {
+    limit?: number;
+    cursor?: string;
+}
+export interface WorkflowRunsPage {
+    runs: WorkflowRun[];
+    next_cursor?: string;
+    has_more?: boolean;
 }
 export declare function createWorkflow(apiKey: string, orgId: string, payload: {
     name: string;
@@ -78,5 +88,5 @@ export declare function updateWorkflow(apiKey: string, orgId: string, workflowId
 export declare function enableWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
 export declare function disableWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
 export declare function deleteWorkflow(apiKey: string, orgId: string, workflowId: string): Promise<void>;
-export declare function listWorkflowRuns(apiKey: string, orgId: string, workflowId: string): Promise<WorkflowRun[]>;
+export declare function listWorkflowRuns(apiKey: string, orgId: string, workflowId: string, opts?: ListRunsOptions): Promise<WorkflowRunsPage>;
 export declare function getWorkflowRun(apiKey: string, orgId: string, runId: string): Promise<WorkflowRun>;

package/dist/workflow.js

@@ -72,8 +72,18 @@ async function disableWorkflow(apiKey, orgId, workflowId) {
 async function deleteWorkflow(apiKey, orgId, workflowId) {
     return (0, client_1.request)('DELETE', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey);
 }
-async function listWorkflowRuns(apiKey, orgId, workflowId) {
-    return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs`, apiKey);
+// listWorkflowRuns returns recent runs newest-first. The backend wraps this
+// in a keyset-pagination envelope (limit 1-500 + cursor), so we use
+// requestPage to preserve next_cursor — a plain `request` would drop it.
+async function listWorkflowRuns(apiKey, orgId, workflowId, opts = {}) {
+    const qs = new URLSearchParams();
+    if (opts.limit !== undefined)
+        qs.set('limit', String(opts.limit));
+    if (opts.cursor)
+        qs.set('cursor', opts.cursor);
+    const query = qs.toString() ? `?${qs.toString()}` : '';
+    const page = await (0, client_1.requestPage)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs${query}`, apiKey);
+    return { runs: page.data, next_cursor: page.next_cursor, has_more: page.has_more };
 }
 async function getWorkflowRun(apiKey, orgId, runId) {
     return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/runs/${encodeURIComponent(runId)}`, apiKey);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.3.13",
+  "version": "2.1.0",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth.ts

@@ -0,0 +1,129 @@
+import { request } from './client';
+import { AUTH_BASE as BASE_URL } from './config';
+import type { Exposes } from './exposes';
+
+// The end-user auth product (my-auth-api): a managed multi-tenant OIDC
+// Identity Provider for the END USERS of apps built on MyAPI. Distinct from
+// operator/account auth (hq/account/*). Each org gets one auth tenant; OIDC
+// clients (apps) register against it. End users sign in with managed Google,
+// email/password, or magic links (per the tenant's `connections`). Tokens are
+// RS256, verified via the tenant's JWKS.
+//
+// The browser/app-facing OIDC + sign-in flows — discovery, jwks, authorize,
+// token, userinfo, password/magic/google login, verify-email, password reset,
+// the hosted login page — are machine/end-user surfaces consumed by apps, the
+// JS SDK, and browsers, NOT management calls; they are not CLI/SDK verbs. This
+// module covers only the org-scoped MANAGEMENT surface: tenant, clients, MAU
+// usage, and the custom auth domain.
+export const EXPOSES: Exposes = [
+  'POST /auth/orgs/{org_id}/tenant',
+  'GET /auth/orgs/{org_id}/tenant',
+  'POST /auth/orgs/{org_id}/clients',
+  'GET /auth/orgs/{org_id}/clients',
+  'GET /auth/orgs/{org_id}/usage',
+  'POST /auth/orgs/{org_id}/domain',
+  'GET /auth/orgs/{org_id}/domain',
+  'DELETE /auth/orgs/{org_id}/domain',
+];
+
+// Sign-in methods a tenant offers on its hosted login page.
+export type AuthConnection = 'google' | 'password' | 'magic';
+
+export interface Tenant {
+  tenant_id: string;
+  issuer: string;     // OIDC issuer: <base>/<tenant_id>
+  login_url: string;  // hosted authorize endpoint
+  connections?: AuthConnection[];
+}
+
+export interface CreateTenantInput {
+  // Sign-in methods to enable. Defaults to ['google'] when omitted.
+  connections?: AuthConnection[];
+  // Opaque JSON for the hosted login page (branding).
+  theme?: unknown;
+}
+
+export interface AuthClient {
+  client_id: string;
+  name?: string;
+  type: 'spa' | 'web';
+  redirect_uris: string[];
+  issuer?: string;
+  // Returned exactly ONCE, on create, for confidential ('web') clients.
+  // SPA clients are public and have no secret.
+  client_secret?: string;
+  created_at?: string;
+}
+
+export interface ListClientsResponse {
+  clients: AuthClient[];
+}
+
+export interface CreateClientInput {
+  name: string;
+  type: 'spa' | 'web';
+  redirect_uris: string[];
+}
+
+// Monthly-active-user metering for the tenant (auth is billed per MAU).
+export interface AuthUsage {
+  period: string;            // 'YYYY-MM'
+  active_users: number;
+  price_cents_each: number;
+}
+
+// A custom auth domain (e.g. auth.acme.com) for the tenant's hosted login + issuer.
+export interface AuthDomain {
+  domain: string;
+  status: 'pending' | 'active';
+  dns: { type: string; name: string; value: string };
+  next?: string;
+  issuer?: string;     // present once active
+  login_url?: string;  // present once active
+}
+
+// Create (or update) the org's auth tenant. Idempotent. `connections` selects
+// the sign-in methods (subset of google/password/magic; defaults to google);
+// `theme` is opaque JSON for the hosted login page.
+export async function createTenant(apiKey: string, orgId: string, input: CreateTenantInput = {}): Promise<Tenant> {
+  const body: Record<string, unknown> = {};
+  if (input.connections !== undefined) body.connections = input.connections;
+  if (input.theme !== undefined) body.theme = input.theme;
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey, body);
+}
+
+// Fetch the org's auth tenant. Rejects with TENANT_NOT_FOUND if not created.
+export async function getTenant(apiKey: string, orgId: string): Promise<Tenant> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey);
+}
+
+// Register an OIDC client (an app) under the org's tenant. Auto-provisions the
+// tenant if absent. For type 'web' the response carries `client_secret` once.
+export async function createClient(apiKey: string, orgId: string, input: CreateClientInput): Promise<AuthClient> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey, input);
+}
+
+export async function listClients(apiKey: string, orgId: string): Promise<ListClientsResponse> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey);
+}
+
+// Monthly-active-user usage for the current period (auth is billed per MAU).
+export async function getUsage(apiKey: string, orgId: string): Promise<AuthUsage> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/usage`, apiKey);
+}
+
+// Set a custom auth domain (e.g. auth.acme.com). Returns the DNS record to
+// create; TLS provisions automatically and the domain becomes the issuer once
+// active. One custom domain per org.
+export async function registerDomain(apiKey: string, orgId: string, domain: string): Promise<AuthDomain> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
+}
+
+// Fetch the org's custom auth domain. Rejects with NO_DOMAIN if none set.
+export async function getDomain(apiKey: string, orgId: string): Promise<AuthDomain> {
+  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey);
+}
+
+export async function deleteDomain(apiKey: string, orgId: string, domain: string): Promise<{ domain: string; status: string }> {
+  return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
+}

package/src/client.ts

@@ -12,13 +12,13 @@ export class MyApiError extends Error {
   }
 }
 
-export async function request<T>(
+async function requestFull<T>(
   method: string,
   url: string,
   apiKey?: string,
   body?: unknown,
   extraHeaders?: Record<string, string>,
-): Promise<T> {
+): Promise<ApiResponse<T>> {
   const headers: Record<string, string> = {};
 
   if (apiKey) {
@@ -48,7 +48,7 @@ export async function request<T>(
   const response = await fetch(url, options);
 
   if (response.status === 204) {
-    return undefined as T;
+    return { success: true, data: null, error: null, meta: {} as ApiResponse<T>['meta'] };
   }
 
   // Read the body as text first so we can include a snippet in errors when
@@ -85,5 +85,37 @@ export async function request<T>(
     throw new MyApiError(code, response.status, detail, errBody);
   }
 
-  return apiResponse.data as T;
+  return apiResponse;
+}
+
+// Returns the unwrapped `data` payload — the common case.
+export async function request<T>(
+  method: string,
+  url: string,
+  apiKey?: string,
+  body?: unknown,
+  extraHeaders?: Record<string, string>,
+): Promise<T> {
+  return (await requestFull<T>(method, url, apiKey, body, extraHeaders)).data as T;
+}
+
+export interface Page<T> {
+  data: T[];
+  next_cursor?: string;
+  has_more?: boolean;
+}
+
+// For keyset-paginated endpoints (backend `envelope.WrapPage`): `data` is a
+// bare array and the cursor/has_more live under `meta`. `request` would drop
+// the cursor, so list endpoints with pagination must use this.
+export async function requestPage<T>(
+  method: string,
+  url: string,
+  apiKey?: string,
+  body?: unknown,
+  extraHeaders?: Record<string, string>,
+): Promise<Page<T>> {
+  const r = await requestFull<T[]>(method, url, apiKey, body, extraHeaders);
+  const meta = (r.meta ?? {}) as { next_cursor?: string; has_more?: boolean };
+  return { data: (r.data ?? []) as T[], next_cursor: meta.next_cursor, has_more: meta.has_more };
 }

package/src/config.ts

@@ -36,3 +36,4 @@ export const AUDIENCE_BASE= process.env.MYAPI_AUDIENCE_URL?? GATEWAY;
 export const LLM_BASE     = process.env.MYAPI_LLM_URL     ?? GATEWAY;
 export const DATABASE_BASE= process.env.MYAPI_DATABASE_URL?? GATEWAY;
 export const CRM_BASE     = process.env.MYAPI_CRM_URL     ?? GATEWAY;
+export const AUTH_BASE    = process.env.MYAPI_AUTH_URL    ?? GATEWAY;

package/src/container.ts

@@ -1,4 +1,5 @@
-import { request } from './client';
+import { request, MyApiError } from './client';
+import { ApiResponse } from './types';
 import { CONTAINER_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -39,6 +40,9 @@ export interface Container {
   // Origin Rule that rewrites Host + SNI to the Cloud Run hostname.
   custom_domain?: string;
   status: string;
+  // Egress mode for the container's outbound traffic (backend returns it on
+  // every row, container/crud.go). Static-IP vs. default depending on config.
+  egress: string;
   created_at: string;
   updated_at: string;
 }
@@ -89,12 +93,58 @@ export async function deleteContainer(apiKey: string, orgId: string, containerId
   return request('DELETE', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
 }
 
-// deployContainer ships a revision from a pre-built image ref to Cloud Run
-// (source builds land in a later backend slice). Rotates the scoped key.
+// deployContainer ships a revision from a pre-built image ref to Cloud Run.
+// Synchronous — returns status='active' with a rotated scoped key.
 export async function deployContainer(apiKey: string, orgId: string, containerId: string, image: string): Promise<DeployResponse> {
   return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`, apiKey, { image });
 }
 
+// BuildDeployResponse — the async source-build path. The backend records a
+// `building` revision, kicks off Cloud Build on a background goroutine, and
+// returns immediately. The scoped key is minted later (once the image
+// exists), so it is NOT in this response. Poll getContainer until
+// status='active' (or 'build_error'/'deploy_error').
+export interface BuildDeployResponse {
+  container_id: string;
+  revision_id: string;
+  status: string;       // 'building'
+  message?: string;
+}
+
+// deployContainerSource uploads a build-context tarball via multipart `source`
+// (backend deploy.go builds it via Cloud Build → Artifact Registry, then
+// deploys). Asynchronous: returns status='building' to poll. The tarball is
+// capped at 100MB server-side. Mirrors the multipart upload in storage.ts.
+export async function deployContainerSource(
+  apiKey: string,
+  orgId: string,
+  containerId: string,
+  tarball: Blob | Buffer,
+  filename = 'source.tar.gz',
+): Promise<BuildDeployResponse> {
+  const formData = new FormData();
+  formData.append('source', new Blob([tarball as any], { type: 'application/gzip' }), filename);
+
+  const response = await fetch(
+    `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`,
+    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
+  );
+
+  let result: any;
+  try {
+    result = await response.json();
+  } catch {
+    throw new MyApiError('invalid_json_response', response.status);
+  }
+  if (!response.ok || !result?.success) {
+    const err = result?.error;
+    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
+    const detail = typeof err === 'object' ? err?.message : undefined;
+    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
+  }
+  return (result as ApiResponse<BuildDeployResponse>).data as BuildDeployResponse;
+}
+
 // One runtime log line from the container's Cloud Run resource.
 export interface LogEntry {
   timestamp: string;

package/src/crm.ts

@@ -1,4 +1,4 @@
-import { request } from './client';
+import { request, requestPage } from './client';
 import { CRM_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -46,7 +46,8 @@ export type EventKind =
   | 'email_clicked'
   | 'email_replied'
   | 'pixel_visit'
-  | 'webhook_received';
+  | 'webhook_received'
+  | 'payment';
 
 // Goldfox enrichment is a live join — the response embeds the current
 // Goldfox row when goldfox_person_id is set. v1: returns null until the
@@ -204,7 +205,10 @@ export async function getContactEvents(apiKey: string, orgId: string, id: string
   if (opts.kind != null) qs.append('kind', opts.kind);
   const q = qs.toString();
   const url = `${BASE_URL}/crm/orgs/${encodeURIComponent(orgId)}/contacts/${encodeURIComponent(id)}/events${q ? `?${q}` : ''}`;
-  return request('GET', url, apiKey);
+  // Paginated (WrapPage): events are the bare `data` array with the cursor
+  // under `meta` — use requestPage so `next_cursor` survives.
+  const page = await requestPage<ContactEvent>('GET', url, apiKey);
+  return { events: page.data, next_cursor: page.next_cursor };
 }
 
 // ── Companies ─────────────────────────────────────────────────────────────

package/src/database.ts

@@ -1,4 +1,4 @@
-import { request } from './client';
+import { request, requestPage } from './client';
 import { DATABASE_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -71,7 +71,10 @@ export async function listKeys(apiKey: string, orgId: string, ns: string, opts:
   if (opts.values) qs.append('values', 'true');
   const q = qs.toString();
   const url = `${BASE_URL}/database/orgs/${encodeURIComponent(orgId)}/namespaces/${encodeURIComponent(ns)}/keys${q ? `?${q}` : ''}`;
-  return request('GET', url, apiKey);
+  // Paginated (WrapPage): keys come back as the bare `data` array with the
+  // cursor under `meta` — must use requestPage or the cursor is lost.
+  const page = await requestPage<KeyEntry>('GET', url, apiKey);
+  return { keys: page.data, next_cursor: page.next_cursor };
 }
 
 export async function getKey(apiKey: string, orgId: string, ns: string, key: string): Promise<KeyEntry> {