@myapihq/sdk 1.3.5 → 1.3.8

package/dist/funnel.d.ts

@@ -4,9 +4,26 @@ export interface Funnel {
     id: string;
     org_id: string;
     name?: string;
+    org_webhook_id?: string;
     created_at: string;
     updated_at: string;
 }
+export interface FormFieldSpec {
+    name: string;
+    required?: boolean;
+    oneof?: string[];
+    max_length?: number;
+    regex?: string;
+}
+export interface FormBinding {
+    slug: string;
+    destination: string;
+    fields?: FormFieldSpec[];
+    honeypot_field?: string;
+    rate_limit?: {
+        per_minute: number;
+    };
+}
 export interface CreateFunnelResponse {
     funnel: Funnel;
     subdomain_url?: string;
@@ -67,3 +84,6 @@ export interface PublishResult {
     published_url: string;
 }
 export declare function publishFiles(apiKey: string, orgId: string, funnelId: string, files: PublishFile[], opts?: PublishOptions): Promise<PublishResult>;
+export declare function createFormBinding(apiKey: string, orgId: string, funnelId: string, binding: FormBinding): Promise<FormBinding>;
+export declare function listFormBindings(apiKey: string, orgId: string, funnelId: string): Promise<FormBinding[]>;
+export declare function deleteFormBinding(apiKey: string, orgId: string, funnelId: string, slug: string): Promise<void>;

package/dist/funnel.js

@@ -9,6 +9,9 @@ exports.pushFunnelPage = pushFunnelPage;
 exports.listFunnelPages = listFunnelPages;
 exports.verifyFunnel = verifyFunnel;
 exports.publishFiles = publishFiles;
+exports.createFormBinding = createFormBinding;
+exports.listFormBindings = listFormBindings;
+exports.deleteFormBinding = deleteFormBinding;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
@@ -20,6 +23,12 @@ exports.EXPOSES = [
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
+    // Backend (2026-06-03): canonical funnel-form proxy lands per-slug
+    // bindings — destination (webhook/workflow), fields, honeypot, rate
+    // limit. See docs/cross-repo-prompts/cli-funnel-form-canonical-followup-2026-06-04.md.
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}/forms/{slug}',
 ];
 async function createFunnel(apiKey, orgId, opts) {
     // v2: accept optional name for N-funnels-per-org. Backend rejects names
@@ -80,3 +89,17 @@ async function publishFiles(apiKey, orgId, funnelId, files, opts = {}) {
     }
     return result.data;
 }
+// ── Form bindings (canonical funnel-form proxy) ────────────────────────────
+function formsBase(orgId, funnelId) {
+    return `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/forms`;
+}
+async function createFormBinding(apiKey, orgId, funnelId, binding) {
+    return (0, client_1.request)('POST', formsBase(orgId, funnelId), apiKey, binding);
+}
+async function listFormBindings(apiKey, orgId, funnelId) {
+    const res = await (0, client_1.request)('GET', formsBase(orgId, funnelId), apiKey);
+    return Array.isArray(res) ? res : (res?.forms ?? []);
+}
+async function deleteFormBinding(apiKey, orgId, funnelId, slug) {
+    return (0, client_1.request)('DELETE', `${formsBase(orgId, funnelId)}/${encodeURIComponent(slug)}`, apiKey);
+}

package/dist/llm.d.ts

@@ -12,15 +12,16 @@ export interface CompleteRequest {
     temperature?: number;
     stop?: string[];
 }
+export interface RawUsage {
+    input_tokens: number;
+    output_tokens?: number;
+    cost_cents: number;
+}
 export interface CompleteResponse {
     model: string;
     content: string;
     finish_reason: string;
-    usage: {
-        input_tokens: number;
-        output_tokens: number;
-        cost_usd: number;
-    };
+    usage: RawUsage;
 }
 export interface EmbedRequest {
     model: string;
@@ -29,18 +30,15 @@ export interface EmbedRequest {
 export interface EmbedResponse {
     model: string;
     embeddings: number[][];
-    usage: {
-        input_tokens: number;
-        cost_usd: number;
-    };
+    usage: RawUsage;
 }
 export interface Model {
     id: string;
     kind: 'chat' | 'embed';
-    context?: number;
+    context_window?: number;
     dimensions?: number;
-    input_per_1m: number;
-    output_per_1m?: number;
+    input_cost_per_1m_cents: number;
+    output_cost_per_1m_cents?: number;
 }
 export interface ModelsResponse {
     models: Model[];
@@ -48,3 +46,77 @@ export interface ModelsResponse {
 export declare function complete(apiKey: string, orgId: string, req: CompleteRequest): Promise<CompleteResponse>;
 export declare function embed(apiKey: string, orgId: string, req: EmbedRequest): Promise<EmbedResponse>;
 export declare function listModels(apiKey: string, orgId: string): Promise<ModelsResponse>;
+export type Verb = 'classify' | 'extract' | 'summarize' | 'draft';
+/** Routing hint; opaque — the server picks the model. With one served
+ *  model today every tier resolves to it. `tier_used` echoes back what was
+ *  actually selected. */
+export type Tier = 'fast' | 'reasoning' | 'cheap';
+export interface VerbUsage {
+    tier_used: Tier;
+    tokens_in: number;
+    tokens_out: number;
+    cost_cents: number;
+}
+interface VerbBase {
+    /** Routing hint. Defaults to 'fast'. */
+    tier?: Tier;
+}
+export interface ClassifyRequest extends VerbBase {
+    input: string;
+    /** Candidate labels — pick from this set. */
+    labels: string[];
+    /** When true, multiple labels may apply; response carries `labels[]`. */
+    multi?: boolean;
+}
+export interface ClassifyResponse {
+    data: {
+        label?: string;
+        labels?: string[];
+    };
+    usage: VerbUsage;
+}
+export interface ExtractRequest extends VerbBase {
+    input: string;
+    /** A JSON Schema (object) the extracted data must conform to. */
+    schema: Record<string, unknown>;
+}
+export interface ExtractResponse {
+    data: {
+        data: Record<string, unknown>;
+    };
+    usage: VerbUsage;
+}
+export interface SummarizeRequest extends VerbBase {
+    input: string;
+    /** `brief` (1-2 sentences), `exec` (3-4 decision-maker sentences), or
+     *  `bullet` (short bulleted list). Default `brief`. */
+    style?: 'brief' | 'exec' | 'bullet';
+}
+export interface SummarizeResponse {
+    data: {
+        summary: string;
+    };
+    usage: VerbUsage;
+}
+export interface DraftRequest extends VerbBase {
+    /** Optional source content — may be empty when `context`/`prompt` carry
+     *  the brief. */
+    input?: string;
+    /** What to write — `email`, `message`, `reply`, etc. */
+    kind: string;
+    /** Free-form structured context (recipient, tone, facts). */
+    context?: Record<string, unknown>;
+    /** Free-text instructions to the writer. */
+    prompt?: string;
+}
+export interface DraftResponse {
+    data: {
+        text: string;
+    };
+    usage: VerbUsage;
+}
+export declare function classify(apiKey: string, orgId: string, req: ClassifyRequest): Promise<ClassifyResponse>;
+export declare function extract(apiKey: string, orgId: string, req: ExtractRequest): Promise<ExtractResponse>;
+export declare function summarize(apiKey: string, orgId: string, req: SummarizeRequest): Promise<SummarizeResponse>;
+export declare function draft(apiKey: string, orgId: string, req: DraftRequest): Promise<DraftResponse>;
+export {};

package/dist/llm.js

@@ -9,12 +9,17 @@ exports.EXPOSES = void 0;
 exports.complete = complete;
 exports.embed = embed;
 exports.listModels = listModels;
+exports.classify = classify;
+exports.extract = extract;
+exports.summarize = summarize;
+exports.draft = draft;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
     'POST /llm/orgs/{org_id}/complete',
     'POST /llm/orgs/{org_id}/embed',
     'GET /llm/orgs/{org_id}/models',
+    'POST /llm/orgs/{org_id}/tasks/{verb}',
 ];
 async function complete(apiKey, orgId, req) {
     return (0, client_1.request)('POST', `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/complete`, apiKey, req);
@@ -25,3 +30,18 @@ async function embed(apiKey, orgId, req) {
 async function listModels(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/models`, apiKey);
 }
+function verbUrl(orgId, verb) {
+    return `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/tasks/${verb}`;
+}
+async function classify(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'classify'), apiKey, req);
+}
+async function extract(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'extract'), apiKey, req);
+}
+async function summarize(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'summarize'), apiKey, req);
+}
+async function draft(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'draft'), apiKey, req);
+}

package/dist/workflow.js

@@ -23,7 +23,33 @@ exports.EXPOSES = [
     'GET /workflow/orgs/{org_id}/workflows/{workflow_id}/runs',
     'GET /workflow/orgs/{org_id}/runs/{run_id}',
 ];
+// Local URL-shape check on http_request steps. Same shape as the SSRF
+// audit's scheme allowlist on webhook.forward_url and queue.consumer_url —
+// this is *UX defense*, not security: the backend MUST also validate
+// (which it does, via the same middleware) — see
+// docs/cross-repo-prompts/backend-workflow-step-validation.md.
+// Catches javascript:, file:, gopher:, data:, and whitespace/null-byte
+// hosts at agent typo-fix latency instead of at "why didn't my workflow
+// fire" investigation latency.
+function validateSteps(steps) {
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i];
+        if (s.type === 'http_request' || s.type === 'http') {
+            let parsed;
+            try {
+                parsed = new URL(s.url);
+            }
+            catch {
+                throw new Error(`step ${i} (${s.type}): "url" is not a valid URL — got ${JSON.stringify(s.url)}.`);
+            }
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                throw new Error(`step ${i} (${s.type}): "url" must use http:// or https:// scheme — got "${parsed.protocol}" in ${JSON.stringify(s.url)}.`);
+            }
+        }
+    }
+}
 async function createWorkflow(apiKey, orgId, payload) {
+    validateSteps(payload.steps);
     return (0, client_1.request)('POST', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows`, apiKey, payload);
 }
 async function listWorkflows(apiKey, orgId) {
@@ -33,6 +59,8 @@ async function getWorkflow(apiKey, orgId, workflowId) {
     return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey);
 }
 async function updateWorkflow(apiKey, orgId, workflowId, payload) {
+    if (payload.steps)
+        validateSteps(payload.steps);
     return (0, client_1.request)('PATCH', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey, payload);
 }
 async function enableWorkflow(apiKey, orgId, workflowId) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.3.5",
+  "version": "1.3.8",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/funnel.ts

@@ -12,6 +12,12 @@ export const EXPOSES: Exposes = [
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
   'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
+  // Backend (2026-06-03): canonical funnel-form proxy lands per-slug
+  // bindings — destination (webhook/workflow), fields, honeypot, rate
+  // limit. See docs/cross-repo-prompts/cli-funnel-form-canonical-followup-2026-06-04.md.
+  'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+  'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+  'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}/forms/{slug}',
 ];
 
 export interface Funnel {
@@ -21,9 +27,33 @@ export interface Funnel {
   // to the org's preview_subdomain for back-compat. Get / list responses
   // include it when set.
   name?: string;
+  // Backend (2026-06-03): every funnel auto-provisions a webhook_endpoints
+  // row at create. Submissions to `/submit/{slug}` without a per-slug
+  // binding fall through to this webhook. Optional only because legacy
+  // funnels migrated by the boot job may be briefly null.
+  org_webhook_id?: string;
   created_at: string;
   updated_at: string;
 }
+
+// Per-slug binding from `POST /funnel/.../forms`. Backend resolves a
+// submission's destination at submit time: per-slug binding wins, then
+// `Funnel.org_webhook_id`, else `NO_DESTINATION`.
+export interface FormFieldSpec {
+  name: string;
+  required?: boolean;
+  oneof?: string[];
+  max_length?: number;
+  regex?: string;
+}
+export interface FormBinding {
+  slug: string;
+  // "<kind>:<uuid>" — kind is "webhook" or "workflow".
+  destination: string;
+  fields?: FormFieldSpec[];
+  honeypot_field?: string;
+  rate_limit?: { per_minute: number };
+}
 export interface CreateFunnelResponse { funnel: Funnel; subdomain_url?: string; domain_url?: string }
 export interface VerifyResult {
   pages?: Array<{ slug: string; tests: VerifyTest[] }>;
@@ -138,3 +168,22 @@ export async function publishFiles(
   }
   return (result as ApiResponse<PublishResult>).data as PublishResult;
 }
+
+// ── Form bindings (canonical funnel-form proxy) ────────────────────────────
+
+function formsBase(orgId: string, funnelId: string): string {
+  return `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/forms`;
+}
+
+export async function createFormBinding(apiKey: string, orgId: string, funnelId: string, binding: FormBinding): Promise<FormBinding> {
+  return request('POST', formsBase(orgId, funnelId), apiKey, binding);
+}
+
+export async function listFormBindings(apiKey: string, orgId: string, funnelId: string): Promise<FormBinding[]> {
+  const res = await request<FormBinding[] | { forms?: FormBinding[] }>('GET', formsBase(orgId, funnelId), apiKey);
+  return Array.isArray(res) ? res : (res?.forms ?? []);
+}
+
+export async function deleteFormBinding(apiKey: string, orgId: string, funnelId: string, slug: string): Promise<void> {
+  return request('DELETE', `${formsBase(orgId, funnelId)}/${encodeURIComponent(slug)}`, apiKey);
+}

package/src/llm.ts

@@ -12,8 +12,15 @@ export const EXPOSES: Exposes = [
   'POST /llm/orgs/{org_id}/complete',
   'POST /llm/orgs/{org_id}/embed',
   'GET /llm/orgs/{org_id}/models',
+  'POST /llm/orgs/{org_id}/tasks/{verb}',
 ];
 
+// ── Raw surface ──────────────────────────────────────────────────────────
+// Backed *exclusively* by self-hosted open-source models (Qwen on our TPU).
+// The customer picks the model id from the catalog. Proprietary models are
+// not callable here — that rule is what keeps the LLM slot off the
+// reseller framing.
+
 export type Role = 'system' | 'user' | 'assistant';
 
 export interface Message {
@@ -29,15 +36,17 @@ export interface CompleteRequest {
   stop?: string[];
 }
 
+export interface RawUsage {
+  input_tokens: number;
+  output_tokens?: number;
+  cost_cents: number;
+}
+
 export interface CompleteResponse {
   model: string;
   content: string;
-  finish_reason: string; // 'stop' | 'length' | 'safety' | ...
-  usage: {
-    input_tokens: number;
-    output_tokens: number;
-    cost_usd: number;
-  };
+  finish_reason: string; // 'stop' | 'length' | 'filter'
+  usage: RawUsage;
 }
 
 export interface EmbedRequest {
@@ -47,26 +56,22 @@ export interface EmbedRequest {
 
 // Always returned as an array — even for a single-string input you get a
 // one-element array. Each element is the dense vector as a flat number[].
-// Embed-only usage has no output_tokens.
 export interface EmbedResponse {
   model: string;
   embeddings: number[][];
-  usage: {
-    input_tokens: number;
-    cost_usd: number;
-  };
+  usage: RawUsage;
 }
 
-// Catalog row. 'chat' models have context + output_per_1m; 'embed' models
-// have dimensions instead. Pricing is per 1M tokens at upstream rates
-// (we resell at-cost while building our own inference).
+// Catalog row. `chat` models have context_window + output_cost_per_1m_cents;
+// `embed` models have dimensions instead. Pricing is in cents per 1M tokens
+// (the platform's native unit — cost_cents everywhere).
 export interface Model {
   id: string;
   kind: 'chat' | 'embed';
-  context?: number;
+  context_window?: number;
   dimensions?: number;
-  input_per_1m: number;
-  output_per_1m?: number;
+  input_cost_per_1m_cents: number;
+  output_cost_per_1m_cents?: number;
 }
 
 export interface ModelsResponse {
@@ -84,3 +89,101 @@ export async function embed(apiKey: string, orgId: string, req: EmbedRequest): P
 export async function listModels(apiKey: string, orgId: string): Promise<ModelsResponse> {
   return request('GET', `${BASE_URL}/llm/orgs/${encodeURIComponent(orgId)}/models`, apiKey);
 }
+
+// ── Verb surface — objective-based completion ────────────────────────────
+// The customer asks for a task done (classify / extract / summarize /
+// draft); the model is implementation detail and is never named in the
+// response. This is where any future proprietary model lives — wrapped, not
+// resold.
+
+export type Verb = 'classify' | 'extract' | 'summarize' | 'draft';
+
+/** Routing hint; opaque — the server picks the model. With one served
+ *  model today every tier resolves to it. `tier_used` echoes back what was
+ *  actually selected. */
+export type Tier = 'fast' | 'reasoning' | 'cheap';
+
+export interface VerbUsage {
+  tier_used: Tier;
+  tokens_in: number;
+  tokens_out: number;
+  cost_cents: number;
+}
+
+interface VerbBase {
+  /** Routing hint. Defaults to 'fast'. */
+  tier?: Tier;
+}
+
+export interface ClassifyRequest extends VerbBase {
+  input: string;
+  /** Candidate labels — pick from this set. */
+  labels: string[];
+  /** When true, multiple labels may apply; response carries `labels[]`. */
+  multi?: boolean;
+}
+
+export interface ClassifyResponse {
+  data: { label?: string; labels?: string[] };
+  usage: VerbUsage;
+}
+
+export interface ExtractRequest extends VerbBase {
+  input: string;
+  /** A JSON Schema (object) the extracted data must conform to. */
+  schema: Record<string, unknown>;
+}
+
+export interface ExtractResponse {
+  data: { data: Record<string, unknown> };
+  usage: VerbUsage;
+}
+
+export interface SummarizeRequest extends VerbBase {
+  input: string;
+  /** `brief` (1-2 sentences), `exec` (3-4 decision-maker sentences), or
+   *  `bullet` (short bulleted list). Default `brief`. */
+  style?: 'brief' | 'exec' | 'bullet';
+}
+
+export interface SummarizeResponse {
+  data: { summary: string };
+  usage: VerbUsage;
+}
+
+export interface DraftRequest extends VerbBase {
+  /** Optional source content — may be empty when `context`/`prompt` carry
+   *  the brief. */
+  input?: string;
+  /** What to write — `email`, `message`, `reply`, etc. */
+  kind: string;
+  /** Free-form structured context (recipient, tone, facts). */
+  context?: Record<string, unknown>;
+  /** Free-text instructions to the writer. */
+  prompt?: string;
+}
+
+export interface DraftResponse {
+  data: { text: string };
+  usage: VerbUsage;
+}
+
+function verbUrl(orgId: string, verb: Verb): string {
+  return `${BASE_URL}/llm/orgs/${encodeURIComponent(orgId)}/tasks/${verb}`;
+}
+
+export async function classify(apiKey: string, orgId: string, req: ClassifyRequest): Promise<ClassifyResponse> {
+  return request('POST', verbUrl(orgId, 'classify'), apiKey, req);
+}
+
+export async function extract(apiKey: string, orgId: string, req: ExtractRequest): Promise<ExtractResponse> {
+  return request('POST', verbUrl(orgId, 'extract'), apiKey, req);
+}
+
+export async function summarize(apiKey: string, orgId: string, req: SummarizeRequest): Promise<SummarizeResponse> {
+  return request('POST', verbUrl(orgId, 'summarize'), apiKey, req);
+}
+
+export async function draft(apiKey: string, orgId: string, req: DraftRequest): Promise<DraftResponse> {
+  return request('POST', verbUrl(orgId, 'draft'), apiKey, req);
+}

package/src/workflow.ts

@@ -64,11 +64,36 @@ export interface WorkflowRun {
   created_at: string;
 }
 
+// Local URL-shape check on http_request steps. Same shape as the SSRF
+// audit's scheme allowlist on webhook.forward_url and queue.consumer_url —
+// this is *UX defense*, not security: the backend MUST also validate
+// (which it does, via the same middleware) — see
+// docs/cross-repo-prompts/backend-workflow-step-validation.md.
+// Catches javascript:, file:, gopher:, data:, and whitespace/null-byte
+// hosts at agent typo-fix latency instead of at "why didn't my workflow
+// fire" investigation latency.
+function validateSteps(steps: WorkflowStep[]): void {
+  for (let i = 0; i < steps.length; i++) {
+    const s = steps[i];
+    if (s.type === 'http_request' || s.type === 'http') {
+      let parsed: URL;
+      try { parsed = new URL(s.url); }
+      catch {
+        throw new Error(`step ${i} (${s.type}): "url" is not a valid URL — got ${JSON.stringify(s.url)}.`);
+      }
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`step ${i} (${s.type}): "url" must use http:// or https:// scheme — got "${parsed.protocol}" in ${JSON.stringify(s.url)}.`);
+      }
+    }
+  }
+}
+
 export async function createWorkflow(apiKey: string, orgId: string, payload: {
   name: string;
   trigger_config: { endpoint_id: string };
   steps: WorkflowStep[];
 }): Promise<Workflow> {
+  validateSteps(payload.steps);
   return request('POST', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows`, apiKey, payload);
 }
 
@@ -81,6 +106,7 @@ export async function getWorkflow(apiKey: string, orgId: string, workflowId: str
 }
 
 export async function updateWorkflow(apiKey: string, orgId: string, workflowId: string, payload: { name?: string; trigger_config?: { endpoint_id: string }; steps?: WorkflowStep[] }): Promise<Workflow> {
+  if (payload.steps) validateSteps(payload.steps);
   return request('PATCH', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey, payload);
 }