@myapihq/sdk 1.3.13 → 2.1.0

package/src/domain.ts

@@ -211,7 +211,7 @@ export async function deleteDnsRecord(apiKey: string, orgId: string, domain: str
 export interface EmailInfraResponse {
   domain: string;
   email_infra: 'pending' | 'ready' | 'error';
-  email_subdomain: string;
+  subdomain: string;
   next_step?: string;
 }
 

package/src/email.ts

@@ -31,18 +31,6 @@ export const EXPOSES: Exposes = [
   'POST /email/orgs/{org_id}/templates/{template_id}/send-test',
   'DELETE /email/orgs/{org_id}/templates/{template_id}',
   'GET /email/templates/{template_id}/preview',
-  // Campaigns
-  'POST /email/orgs/{org_id}/campaigns',
-  'GET /email/orgs/{org_id}/campaigns',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}',
-  'PATCH /email/orgs/{org_id}/campaigns/{campaign_id}',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/upload-list',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/upload-file',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}/contacts/status',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/start',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/pause',
-  'POST /email/orgs/{org_id}/campaigns/{campaign_id}/resume',
-  'GET /email/orgs/{org_id}/campaigns/{campaign_id}/stats',
   // Verify
   'POST /email/orgs/{org_id}/verify',
   'POST /email/orgs/{org_id}/verify-bulk',
@@ -51,14 +39,6 @@ export const EXPOSES: Exposes = [
 
 export interface EmailMessage { message_id: string; from: string; subject: string; body?: string; received_at: string }
 export interface EmailTemplate { id: string; name: string; subject: string; preview_url: string; created_at: string; updated_at: string }
-export interface WarmupConfig { enabled: boolean; start: number; increment: number; max: number; }
-export interface Campaign { id: string; name: string; status: string; template_id: string; from_address: string; per_day_limit: number; warmup_config?: WarmupConfig; created_at: string }
-export interface CampaignStats {
-  campaign: Campaign;
-  validation: { total: number; valid: number; invalid: number; pending: number; list_status: string };
-  dispatch: { sent: number; remaining: number; sent_this_hour: number; hour_limit: number; last_dispatch_at: string };
-  engagement: { sent: number; opens: number; clicks: number; page_visits: number };
-}
 
 // ── Email verification ──────────────────────────────────────────────────────
 //
@@ -138,8 +118,7 @@ export async function createMailbox(apiKey: string, domain: string, username: st
 }
 
 // Backend (2026-06-06): idempotent — 204 whether the mailbox existed or not.
-// Returns 409 MAILBOX_IN_USE when an active/paused campaign still sends from
-// this address; pause/delete the campaign first.
+// May return 409 MAILBOX_IN_USE if the address is still referenced server-side.
 export async function deleteMailbox(apiKey: string, address: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/email/mailboxes/${encodeURIComponent(address)}`, apiKey);
 }
@@ -264,59 +243,3 @@ export async function listTemplates(apiKey: string, orgId: string): Promise<Emai
 export async function deleteTemplate(apiKey: string, orgId: string, templateId: string): Promise<void> {
   return request('DELETE', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/templates/${encodeURIComponent(templateId)}`, apiKey);
 }
-
-// ── Campaigns (org-scoped) ───────────────────────────────────────────────────
-
-export async function createCampaign(apiKey: string, orgId: string, payload: { name: string; template_id: string; from_address: string; per_day_limit?: number; warmup_config?: WarmupConfig | null; }): Promise<Campaign> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns`, apiKey, payload);
-}
-
-export async function uploadContactList(apiKey: string, orgId: string, campaignId: string, emails: string[]): Promise<{ list_id: string; total: number; status: string }> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/upload-list`, apiKey, { emails });
-}
-
-export async function uploadContactsFile(apiKey: string, orgId: string, campaignId: string, file: Blob | ArrayBuffer | Uint8Array, filename: string = 'contacts.csv'): Promise<{ list_id: string; total: number; status: string }> {
-  const form = new FormData();
-  const blob = file instanceof Blob ? file : new Blob([file as BlobPart]);
-  form.append('file', blob, filename);
-  const res = await fetch(`${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/upload-file`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${apiKey}` },
-    body: form,
-  });
-  const json = await res.json();
-  if (!res.ok || !json.success) throw new Error(json.error?.code || json.error || 'upload_failed');
-  return json.data;
-}
-
-export async function getContactUploadStatus(apiKey: string, orgId: string, campaignId: string): Promise<{ upload_status: 'ready' | 'validating' | 'failed'; total: number; valid_count: number; invalid_count: number }> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/contacts/status`, apiKey);
-}
-
-export async function startCampaign(apiKey: string, orgId: string, campaignId: string): Promise<{ status: string }> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/start`, apiKey);
-}
-
-export async function pauseCampaign(apiKey: string, orgId: string, campaignId: string): Promise<void> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/pause`, apiKey);
-}
-
-export async function resumeCampaign(apiKey: string, orgId: string, campaignId: string): Promise<void> {
-  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/resume`, apiKey);
-}
-
-export async function getCampaignStats(apiKey: string, orgId: string, campaignId: string): Promise<CampaignStats> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}/stats`, apiKey);
-}
-
-export async function listCampaigns(apiKey: string, orgId: string): Promise<Campaign[]> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns`, apiKey);
-}
-
-export async function getCampaign(apiKey: string, orgId: string, campaignId: string): Promise<Campaign> {
-  return request('GET', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}`, apiKey);
-}
-
-export async function updateCampaign(apiKey: string, orgId: string, campaignId: string, payload: { name?: string; per_day_limit?: number }): Promise<Campaign> {
-  return request('PATCH', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/campaigns/${encodeURIComponent(campaignId)}`, apiKey, payload);
-}

package/src/function.ts

@@ -35,6 +35,10 @@ export interface CreatePayload {
   name: string;                        // required; ^[a-z0-9][a-z0-9-]{0,49}$
   trigger_type?: TriggerType;          // optional, defaults to 'http' server-side
   cron_schedule?: string;              // required if trigger_type === 'cron'
+  // Optional slot allow-list narrowing the minted function key's grants
+  // (backend crud.go: CreateFunction `scopes`). Empty/omitted inherits the
+  // deploying caller's grants (legacy). Grants can never exceed the caller.
+  scopes?: string[];
 }
 
 // POST response envelope includes the scoped API key — returned ONCE. The
@@ -122,6 +126,14 @@ export async function setFunctionEnv(apiKey: string, orgId: string, fnId: string
   return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { name, value });
 }
 
+// setFunctionEnvBulk writes multiple Worker Secrets in one call. The backend
+// (env.go) loops, calling Cloudflare once per secret, and returns `{set:N}`.
+// The single-secret `setFunctionEnv` above stays the canonical one-off path;
+// this is the bulk variant. The function must already be deployed.
+export async function setFunctionEnvBulk(apiKey: string, orgId: string, fnId: string, env: Record<string, string>): Promise<{ set: number }> {
+  return request('POST', `${BASE_URL}/function/orgs/${encodeURIComponent(orgId)}/functions/${encodeURIComponent(fnId)}/env`, apiKey, { env });
+}
+
 // listFunctionRuns returns recent invocation records, most recent first
 // (Story 4). Capped at 100 server-side.
 export async function listFunctionRuns(apiKey: string, orgId: string, fnId: string): Promise<FunctionRun[]> {

package/src/funds.ts

@@ -0,0 +1,66 @@
+import { MyApiError } from './client';
+
+// The auto-recharge state the backend carries on an `INSUFFICIENT_FUNDS` 402.
+// `in_flight` = a refill was triggered and is on its way (retry); everything
+// else needs a human action, not a retry.
+export type AutoRechargeState = 'in_flight' | 'disabled' | 'capped' | 'no_pm' | 'failed';
+
+// Wallet empty. Matches the unified `INSUFFICIENT_FUNDS` and the legacy
+// `INSUFFICIENT_BALANCE` (still emitted by imagegen's free-tier path until the
+// backend finishes the split — tolerate both).
+export function isInsufficientFunds(err: unknown): err is MyApiError {
+  return err instanceof MyApiError &&
+    (err.code === 'INSUFFICIENT_FUNDS' || err.code === 'INSUFFICIENT_BALANCE');
+}
+
+// Hard account spend ceiling hit (distinct from an empty wallet). Always needs
+// a human — raising/clearing the cap — never a retry or top-up.
+export function isSpendCapExceeded(err: unknown): err is MyApiError {
+  return err instanceof MyApiError && err.code === 'SPEND_CAP_EXCEEDED';
+}
+
+// The auto_recharge state on an INSUFFICIENT_FUNDS error, if the backend set it.
+export function autoRechargeState(err: unknown): AutoRechargeState | undefined {
+  if (!(err instanceof MyApiError)) return undefined;
+  const s = err.body?.auto_recharge;
+  return typeof s === 'string' ? (s as AutoRechargeState) : undefined;
+}
+
+export interface FundsRetryOptions {
+  // Max poll-and-retry attempts on an in-flight refill (default 3).
+  maxRetries?: number;
+  // Injectable sleep (tests pass a no-op; default is real setTimeout).
+  sleep?: (ms: number) => Promise<void>;
+  // Called before each wait — e.g. to log "balance low, refill in flight…".
+  onRetry?: (attempt: number, waitSeconds: number) => void;
+}
+
+const defaultSleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+// Wrap a billable call so an empty wallet with an auto-recharge IN FLIGHT is
+// polled-and-retried instead of failing — the whole point of the 402 split,
+// so an autonomous agent doesn't escalate to a human for a refill that's
+// already coming. Retries ONLY on `INSUFFICIENT_FUNDS` + `auto_recharge ===
+// 'in_flight'`, sleeping the server-provided `retry_after_seconds` (fallback
+// 5s), up to maxRetries. Every other case — capped / no_pm / failed /
+// disabled, or a `SPEND_CAP_EXCEEDED` hard ceiling — rethrows immediately:
+// those need a human (top up, fix the card, raise the cap), not a retry.
+export async function withFundsRetry<T>(call: () => Promise<T>, opts: FundsRetryOptions = {}): Promise<T> {
+  const maxRetries = opts.maxRetries ?? 3;
+  const sleep = opts.sleep ?? defaultSleep;
+  let attempt = 0;
+  for (;;) {
+    try {
+      return await call();
+    } catch (err) {
+      if (attempt >= maxRetries || !isInsufficientFunds(err) || autoRechargeState(err) !== 'in_flight') {
+        throw err;
+      }
+      attempt++;
+      const hinted = (err as MyApiError).body?.retry_after_seconds;
+      const waitSec = typeof hinted === 'number' && hinted > 0 ? hinted : 5;
+      opts.onRetry?.(attempt, waitSec);
+      await sleep(waitSec * 1000);
+    }
+  }
+}

package/src/funnel.ts

@@ -62,7 +62,7 @@ export interface VerifyResult {
   pages?: Array<{ slug: string; tests: VerifyTest[] }>;
   tests?: VerifyTest[];
 }
-export interface VerifyTest { type: 'link' | 'webhook'; url: string; passed: boolean; details: string }
+export interface VerifyTest { type: 'link' | 'image' | 'webhook'; url: string; passed: boolean; details: string }
 
 export async function createFunnel(apiKey: string, orgId: string, opts?: { name?: string }): Promise<CreateFunnelResponse> {
   // v2: accept optional name for N-funnels-per-org. Backend rejects names

package/src/hq.ts

@@ -281,6 +281,51 @@ export async function topUp(apiKey: string, amountDollars: number): Promise<{ ne
   return request('POST', `${BASE_URL}/hq/billing/topup`, apiKey, { amount_dollars: amountDollars });
 }
 
+// ── Auto-recharge ──────────────────────────────────────────────────────
+// Keeps the prepaid wallet funded without a human in the loop: when the
+// balance drops below `threshold_cents`, the backend charges the saved card
+// `amount_cents` off-session, bounded by `monthly_cap_cents`. Opt-in, off by
+// default; enabling requires a saved payment method.
+
+export type RechargeStatus = 'succeeded' | 'failed' | 'capped' | 'no_pm' | 'pending';
+
+export interface AutoRechargeConfig {
+  enabled: boolean;
+  threshold_cents: number | null;
+  amount_cents: number | null;
+  monthly_cap_cents: number | null;
+  // Auto-recharge dollars charged this calendar month (vs the cap).
+  month_to_date_recharged_cents: number;
+  has_payment_method: boolean;
+  last_recharge_status: RechargeStatus | null;
+  last_recharge_attempt_at: string | null;
+}
+
+export async function getAutoRecharge(apiKey: string): Promise<AutoRechargeConfig> {
+  return request('GET', `${BASE_URL}/hq/billing/auto-recharge`, apiKey);
+}
+
+export interface SetAutoRechargeInput {
+  enabled: boolean;
+  threshold_cents?: number;
+  amount_cents?: number;
+  monthly_cap_cents?: number;
+}
+
+// Enable/update auto-recharge. The backend validates invariants and rejects
+// with a 400 (`MISSING_FIELDS`, `AMOUNT_BELOW_FLOOR` [$5 floor],
+// `AMOUNT_LT_THRESHOLD`, `CAP_LT_AMOUNT`, `NO_PAYMENT_METHOD`) — surfaced as a
+// MyApiError. Returns the full config on success.
+export async function setAutoRecharge(apiKey: string, input: SetAutoRechargeInput): Promise<AutoRechargeConfig> {
+  return request('PUT', `${BASE_URL}/hq/billing/auto-recharge`, apiKey, input);
+}
+
+// Disable auto-recharge (the threshold/amount/cap are preserved for easy
+// re-enable). Backend returns 204 No Content.
+export async function disableAutoRecharge(apiKey: string): Promise<void> {
+  return request('DELETE', `${BASE_URL}/hq/billing/auto-recharge`, apiKey);
+}
+
 // ── Org doctor ─────────────────────────────────────────────────────────
 // Aggregated consistency report across slots. The endpoint resolves the
 // reported org from the API key's binding, so the `{org_id}` path param
@@ -310,12 +355,26 @@ export interface DoctorIssue {
   category?: string;
   message: string;
   hint?: string;
+  // True when the issue is platform-side and NOT actionable by the customer
+  // (e.g. a degraded internal dependency the MyAPI team owns). The backend
+  // sets this together with `category: 'internal'` and a customer-appropriate
+  // message; the operator detail is routed to an internal sink, not here.
+  // Consumers should surface these for transparency but must NOT count them
+  // as customer-actionable failures (they don't fail `doctor`'s exit code).
+  operator_only?: boolean;
 }
 
 export interface DoctorSection {
   name: string;
   summary: string;
   issues: DoctorIssue[];
+  // Authoritative count of resources of this section's kind in the org,
+  // independent of how many issues were emitted. Lets a consumer tell
+  // "zero resources" apart from "resources present, all healthy" without
+  // inferring it from `issues.length` (which breaks the moment the backend
+  // stops emitting an `ok` row per healthy resource). Optional: older
+  // backends omit it, and consumers must fall back to the issue-count proxy.
+  resource_count?: number;
 }
 
 export interface DoctorReport {

package/src/index.ts

@@ -1,5 +1,6 @@
 export * from './types';
 export * from './client';
+export * from './funds';
 // Note: config constants (STORAGE_BASE etc.) are NOT re-exported from the
 // barrel. TypeScript compiles `export * from './config'` to a runtime
 // `__exportStar` call that Node's cjs-module-lexer can't see through, so
@@ -7,6 +8,7 @@ export * from './client';
 // CJS-compiled SDK. If you need a base URL in a downstream package, mirror
 // the constant locally — it's one line and the comment makes it obvious.
 export * as hq from './hq';
+export * as auth from './auth';
 export * as domain from './domain';
 export * as email from './email';
 export * as funnel from './funnel';

package/src/payments.ts

@@ -19,6 +19,7 @@ export const EXPOSES: Exposes = [
 // Connection status — the org's Stripe link. T0 takes no platform fee, so
 // `application_fee_bps` is 0.
 export interface ConnectStatus {
+  connected?: boolean;
   tier: string;
   stripe_account_id: string;
   onboarding_status: string;
@@ -71,7 +72,7 @@ export async function connect(apiKey: string, orgId: string, stripeSecretKey: st
   });
 }
 
-// getConnect reads the org's connection status. Throws NOT_CONNECTED (404)
+// getConnect reads the org's connection status. Returns { connected: false } when no Stripe is linked (no longer a 404).
 // when the org has not connected Stripe.
 export async function getConnect(apiKey: string, orgId: string): Promise<ConnectStatus> {
   return request('GET', `${BASE_URL}/payments/orgs/${encodeURIComponent(orgId)}/connect`, apiKey);

package/src/queue.ts

@@ -10,6 +10,7 @@ export const EXPOSES: Exposes = [
   'POST /queue/orgs/{org_id}/queues',
   'GET /queue/orgs/{org_id}/queues',
   'GET /queue/orgs/{org_id}/queues/{name}',
+  'DELETE /queue/orgs/{org_id}/queues/{name}',
   'POST /queue/orgs/{org_id}/queues/{name}/jobs',
   'GET /queue/orgs/{org_id}/queues/{name}/jobs',
   'GET /queue/orgs/{org_id}/jobs/{id}',
@@ -84,6 +85,10 @@ export async function getQueue(apiKey: string, orgId: string, name: string): Pro
   return request('GET', `${queuesBase(orgId)}/${encodeURIComponent(name)}`, apiKey);
 }
 
+export async function deleteQueue(apiKey: string, orgId: string, name: string): Promise<void> {
+  return request('DELETE', `${queuesBase(orgId)}/${encodeURIComponent(name)}`, apiKey);
+}
+
 // enqueueJob is idempotent on (queue, dedup_key). A job with unsucceeded
 // depends_on starts blocked.
 export async function enqueueJob(apiKey: string, orgId: string, name: string, opts: EnqueueOptions = {}): Promise<Job> {

package/src/services.ts

@@ -54,6 +54,15 @@ export const SERVICES: readonly ServiceMeta[] = [
     status: 'ga',
     keywords: k('auth', 'identity', 'billing', 'organization'),
   },
+  {
+    module: 'auth',
+    skill: 'my-auth-api',
+    domain: 'myauthapi.com',
+    description: 'Managed OIDC identity provider for the end users of apps built on MyAPI. Per-org auth tenant + OIDC clients, RS256/JWKS, hosted login, managed Google sign-in. A Kinde alternative.',
+    category: 'identity',
+    status: 'ga',
+    keywords: k('auth', 'oidc', 'oauth', 'login', 'identity', 'sso'),
+  },
   {
     module: 'domain',
     skill: 'my-domain-api',
@@ -66,23 +75,23 @@ export const SERVICES: readonly ServiceMeta[] = [
 
   // ── send ────────────────────────────────────────────────────────────
   {
-    // Customer-facing email surface — mailboxes, campaigns, templates,
-    // warmup. Launched 2026-05-17: the backend lifted the pre-launch gate
+    // Customer-facing email surface — mailboxes, transactional send,
+    // templates, warmup. Launched 2026-05-17: the backend lifted the pre-launch gate
     // (the [disabled, pre-launch] / 503 SERVICE_NOT_LAUNCHED state is gone).
     // Sibling `my-email-verify-api` is the sync single-address verifier.
     module: 'email',
     skill: 'my-email-api',
     domain: 'myemailapi.com',
-    description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, drip campaigns, and warmup.',
+    description: 'Send transactional and bulk email from your own domain. Mailboxes, AI templates, and warmup.',
     category: 'send',
     status: 'ga',
-    keywords: k('email', 'transactional', 'campaign', 'smtp'),
+    keywords: k('email', 'transactional', 'smtp', 'mailbox'),
   },
   {
     module: 'email',
     skill: 'my-email-verify-api',
     domain: 'myemailapi.com',
-    description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for campaigns.',
+    description: 'Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for outbound.',
     category: 'send',
     status: 'ga',
     keywords: k('email', 'verification', 'deliverability', 'syntax', 'dns'),
@@ -206,10 +215,10 @@ export const SERVICES: readonly ServiceMeta[] = [
     module: 'llm',
     skill: 'my-llm-api',
     domain: 'myllmapi.com',
-    description: 'Provider-agnostic LLM completions + embeddings via MyAPI. Routes to managed models (Gemini today, more soon) at upstream cost. Use in workflow steps, not for your own reasoning.',
+    description: 'Self-hosted open-source LLM: raw chat completions (you pick the model) + objective verbs (classify/extract/summarize/draft). Billed in cents per 1M tokens from your balance. Use in workflow steps, not for your own reasoning.',
     category: 'compute',
     status: 'ga',
-    keywords: k('llm', 'completion', 'embedding', 'gemini'),
+    keywords: k('llm', 'completion', 'qwen', 'classify'),
   },
   {
     // CLI top-level command is `fn`; SDK namespace is `fn`; skill directory is
@@ -267,7 +276,7 @@ export const SERVICES: readonly ServiceMeta[] = [
     domain: 'mygitapi.com',
     description: 'Hosted git repositories over HTTP — create repos, commit files, manage branches and tags, read trees, blobs, history, and diffs. No local clone required.',
     category: 'store',
-    status: 'preview',
+    status: 'ga',
     keywords: k('git', 'repository', 'version-control', 'commit', 'scm'),
   },
 

package/src/storage.ts

@@ -27,6 +27,8 @@ export type UploadContentType =
   | 'image/png'
   | 'image/gif'
   | 'image/webp'
+  | 'image/svg+xml'
+  | 'application/pdf'
   | 'video/mp4'
   | 'video/webm';
 

package/src/types.ts

@@ -2,7 +2,9 @@ export interface ApiResponse<T> {
   success: boolean;
   data: T | null;
   error: string | null;
-  meta: { request_id: string; latency_ms: number; service: string; version: string };
+  // Pagination fields (next_cursor / has_more / limit) appear on keyset-paginated
+  // list endpoints (backend `envelope.WrapPage`) — read via `requestPage`.
+  meta: { request_id: string; latency_ms: number; service: string; version: string; next_cursor?: string; has_more?: boolean; limit?: number };
 }
 
 export interface PaginatedResponse<T> {

package/src/webhook.ts

@@ -21,6 +21,9 @@ export interface WebhookEndpoint {
   // into CRM as a contact + webhook_received event on each delivery.
   // Default 'email' (top-level). Empty string disables CRM ingest.
   crm_email_path?: string;
+  // URL every inbound delivery is forwarded to (POST, async, best-effort).
+  // Empty/absent when forwarding is disabled. Backend webhook/endpoints.go.
+  forward_url?: string;
   created_at: string;
 }
 
@@ -29,6 +32,13 @@ export interface Delivery {
   endpoint_id: string;
   payload: unknown;
   received_at: string;
+  // Forwarding outcome for this delivery, present only when the endpoint has
+  // a forward_url configured (backend webhook/endpoints.go). forward_status
+  // is the HTTP status of the forward POST; last_forward_error carries the
+  // failure message when the forward attempt errored.
+  forward_status?: number;
+  last_forward_at?: string;
+  last_forward_error?: string;
 }
 
 export interface CreateEndpointOptions {

package/src/workflow.ts

@@ -1,4 +1,4 @@
-import { request } from './client';
+import { request, requestPage } from './client';
 import { WORKFLOW_BASE as BASE_URL } from './config';
 import type { Exposes } from './exposes';
 
@@ -62,6 +62,20 @@ export interface WorkflowRun {
   started_at?: string;
   finished_at?: string;
   created_at: string;
+  // Per-step output records, populated by GetRun only (backend crud.go:639
+  // returns step_outputs; ListRuns omits them). Empty array when none.
+  step_outputs?: unknown[];
+}
+
+export interface ListRunsOptions {
+  limit?: number;   // 1-500, default 100 server-side
+  cursor?: string;  // last run id from the prior page (keyset)
+}
+
+export interface WorkflowRunsPage {
+  runs: WorkflowRun[];
+  next_cursor?: string;
+  has_more?: boolean;
 }
 
 // Local URL-shape check on http_request steps. Same shape as the SSRF
@@ -122,8 +136,25 @@ export async function deleteWorkflow(apiKey: string, orgId: string, workflowId:
   return request('DELETE', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey);
 }
 
-export async function listWorkflowRuns(apiKey: string, orgId: string, workflowId: string): Promise<WorkflowRun[]> {
-  return request('GET', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs`, apiKey);
+// listWorkflowRuns returns recent runs newest-first. The backend wraps this
+// in a keyset-pagination envelope (limit 1-500 + cursor), so we use
+// requestPage to preserve next_cursor — a plain `request` would drop it.
+export async function listWorkflowRuns(
+  apiKey: string,
+  orgId: string,
+  workflowId: string,
+  opts: ListRunsOptions = {},
+): Promise<WorkflowRunsPage> {
+  const qs = new URLSearchParams();
+  if (opts.limit !== undefined) qs.set('limit', String(opts.limit));
+  if (opts.cursor) qs.set('cursor', opts.cursor);
+  const query = qs.toString() ? `?${qs.toString()}` : '';
+  const page = await requestPage<WorkflowRun>(
+    'GET',
+    `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}/runs${query}`,
+    apiKey,
+  );
+  return { runs: page.data, next_cursor: page.next_cursor, has_more: page.has_more };
 }
 
 export async function getWorkflowRun(apiKey: string, orgId: string, runId: string): Promise<WorkflowRun> {