@myapihq/sdk 1.3.6 → 1.3.11

package/dist/email.d.ts

@@ -106,6 +106,10 @@ export declare function createMailbox(apiKey: string, domain: string, username:
     address: string;
     created_at: string;
 }>;
+export declare function deleteMailbox(apiKey: string, address: string): Promise<void>;
+export declare function mailServerResync(apiKey: string, orgId: string, domain: string): Promise<{
+    ok: boolean;
+} & Record<string, unknown>>;
 export declare function listMailboxes(apiKey: string, options?: {
     domain?: string;
     filter?: 'unassigned';

package/dist/email.js

@@ -5,6 +5,8 @@ exports.verifyEmail = verifyEmail;
 exports.verifyBulk = verifyBulk;
 exports.getVerifyJob = getVerifyJob;
 exports.createMailbox = createMailbox;
+exports.deleteMailbox = deleteMailbox;
+exports.mailServerResync = mailServerResync;
 exports.listMailboxes = listMailboxes;
 exports.activateSending = activateSending;
 exports.setForwarding = setForwarding;
@@ -107,6 +109,20 @@ async function getVerifyJob(apiKey, orgId, jobId) {
 async function createMailbox(apiKey, domain, username, displayName) {
     return (0, client_1.request)('POST', `${config_1.EMAIL_BASE}/email/mailboxes/create`, apiKey, { domain, username, display_name: displayName });
 }
+// Backend (2026-06-06): idempotent — 204 whether the mailbox existed or not.
+// Returns 409 MAILBOX_IN_USE when an active/paused campaign still sends from
+// this address; pause/delete the campaign first.
+async function deleteMailbox(apiKey, address) {
+    return (0, client_1.request)('DELETE', `${config_1.EMAIL_BASE}/email/mailboxes/${encodeURIComponent(address)}`, apiKey);
+}
+// Backend (2026-06-06): re-run Stalwart provisioning for a domain. Use when
+// mailbox-create on a domain returns DOMAIN_NOT_MAIL_READY /
+// MAILBOX_PROVISION_FAILED, or when the inbox endpoint returns
+// "mail server error" on a domain whose `email_infra_ready` flag is stale.
+// Idempotent.
+async function mailServerResync(apiKey, orgId, domain) {
+    return (0, client_1.request)('POST', `${config_1.EMAIL_BASE}/email/orgs/${encodeURIComponent(orgId)}/domains/${encodeURIComponent(domain)}/mail-server-resync`, apiKey);
+}
 async function listMailboxes(apiKey, options) {
     const query = new URLSearchParams();
     if (options?.domain)

package/dist/funnel.d.ts

@@ -4,14 +4,36 @@ export interface Funnel {
     id: string;
     org_id: string;
     name?: string;
+    org_webhook_id?: string;
     created_at: string;
     updated_at: string;
 }
+export interface FormFieldSpec {
+    name: string;
+    required?: boolean;
+    oneof?: string[];
+    max_length?: number;
+    regex?: string;
+}
+export interface FormBinding {
+    slug: string;
+    destination: string;
+    fields?: FormFieldSpec[];
+    honeypot_field?: string;
+    rate_limit?: {
+        per_minute: number;
+    };
+}
 export interface CreateFunnelResponse {
     funnel: Funnel;
     subdomain_url?: string;
     domain_url?: string;
 }
+export interface GetFunnelResponse {
+    funnel: Funnel;
+    subdomain_url?: string;
+    domain_url?: string;
+}
 export interface VerifyResult {
     pages?: Array<{
         slug: string;
@@ -28,7 +50,7 @@ export interface VerifyTest {
 export declare function createFunnel(apiKey: string, orgId: string, opts?: {
     name?: string;
 }): Promise<CreateFunnelResponse>;
-export declare function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<Funnel>;
+export declare function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<GetFunnelResponse>;
 export declare function listFunnels(apiKey: string, orgId: string): Promise<Funnel[]>;
 export declare function deleteFunnel(apiKey: string, orgId: string, funnelId: string): Promise<void>;
 export declare function pushFunnelPage(apiKey: string, orgId: string, funnelId: string, payload: {
@@ -67,3 +89,6 @@ export interface PublishResult {
     published_url: string;
 }
 export declare function publishFiles(apiKey: string, orgId: string, funnelId: string, files: PublishFile[], opts?: PublishOptions): Promise<PublishResult>;
+export declare function createFormBinding(apiKey: string, orgId: string, funnelId: string, binding: FormBinding): Promise<FormBinding>;
+export declare function listFormBindings(apiKey: string, orgId: string, funnelId: string): Promise<FormBinding[]>;
+export declare function deleteFormBinding(apiKey: string, orgId: string, funnelId: string, slug: string): Promise<void>;

package/dist/funnel.js

@@ -9,6 +9,9 @@ exports.pushFunnelPage = pushFunnelPage;
 exports.listFunnelPages = listFunnelPages;
 exports.verifyFunnel = verifyFunnel;
 exports.publishFiles = publishFiles;
+exports.createFormBinding = createFormBinding;
+exports.listFormBindings = listFormBindings;
+exports.deleteFormBinding = deleteFormBinding;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
@@ -20,6 +23,12 @@ exports.EXPOSES = [
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
+    // Backend (2026-06-03): canonical funnel-form proxy lands per-slug
+    // bindings — destination (webhook/workflow), fields, honeypot, rate
+    // limit. See docs/cross-repo-prompts/cli-funnel-form-canonical-followup-2026-06-04.md.
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}/forms/{slug}',
 ];
 async function createFunnel(apiKey, orgId, opts) {
     // v2: accept optional name for N-funnels-per-org. Backend rejects names
@@ -27,7 +36,14 @@ async function createFunnel(apiKey, orgId, opts) {
     return (0, client_1.request)('POST', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, opts?.name ? { name: opts.name } : {});
 }
 async function getFunnel(apiKey, orgId, funnelId) {
-    return (0, client_1.request)('GET', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`, apiKey);
+    // Backend has wrapped GET responses since 2026-04 (`{funnel, subdomain_url, domain_url}`).
+    // Older builds returned a flat Funnel — normalize to the envelope so
+    // callers can rely on the typed shape.
+    const raw = await (0, client_1.request)('GET', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`, apiKey);
+    if (raw && typeof raw === 'object' && 'funnel' in raw && raw.funnel) {
+        return raw;
+    }
+    return { funnel: raw };
 }
 async function listFunnels(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey);
@@ -80,3 +96,17 @@ async function publishFiles(apiKey, orgId, funnelId, files, opts = {}) {
     }
     return result.data;
 }
+// ── Form bindings (canonical funnel-form proxy) ────────────────────────────
+function formsBase(orgId, funnelId) {
+    return `${config_1.FUNNEL_BASE}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/forms`;
+}
+async function createFormBinding(apiKey, orgId, funnelId, binding) {
+    return (0, client_1.request)('POST', formsBase(orgId, funnelId), apiKey, binding);
+}
+async function listFormBindings(apiKey, orgId, funnelId) {
+    const res = await (0, client_1.request)('GET', formsBase(orgId, funnelId), apiKey);
+    return Array.isArray(res) ? res : (res?.forms ?? []);
+}
+async function deleteFormBinding(apiKey, orgId, funnelId, slug) {
+    return (0, client_1.request)('DELETE', `${formsBase(orgId, funnelId)}/${encodeURIComponent(slug)}`, apiKey);
+}

package/dist/hq.d.ts

@@ -74,6 +74,12 @@ export type FreeTierEntry = {
 };
 export declare function getFreeTier(apiKey: string): Promise<FreeTierEntry[] | null>;
 export declare function getAccount(apiKey: string): Promise<AccountInfo>;
+export declare function getMailingAddress(apiKey: string): Promise<{
+    mailing_address: string | null;
+}>;
+export declare function setMailingAddress(apiKey: string, mailingAddress: string): Promise<{
+    mailing_address: string;
+}>;
 export interface CreateApiKeyOptions {
     grants?: Grants;
     orgId?: string;

package/dist/hq.js

@@ -7,6 +7,8 @@ exports.verifyCode = verifyCode;
 exports.upgradeAccount = upgradeAccount;
 exports.getFreeTier = getFreeTier;
 exports.getAccount = getAccount;
+exports.getMailingAddress = getMailingAddress;
+exports.setMailingAddress = setMailingAddress;
 exports.createApiKey = createApiKey;
 exports.listApiKeys = listApiKeys;
 exports.revokeApiKey = revokeApiKey;
@@ -40,6 +42,11 @@ exports.EXPOSES = [
     'POST /hq/account/keys/revoke-all',
     'DELETE /hq/account/delete/key/{key_id}',
     'PATCH /hq/account/spend-cap',
+    // Backend (2026-06-06): account-scoped mailing address — required for
+    // transactional email per CAN-SPAM. PATCH sets, GET reads (null when
+    // unset). Hard-gates POST /email/send with MAILING_ADDRESS_REQUIRED.
+    'PATCH /hq/account/mailing-address',
+    'GET /hq/account/mailing-address',
     'POST /hq/orgs',
     'GET /hq/orgs',
     'GET /hq/orgs/{org_id}',
@@ -80,6 +87,14 @@ async function getFreeTier(apiKey) {
 async function getAccount(apiKey) {
     return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/me`, apiKey);
 }
+// Mailing address — required for transactional `email send` (CAN-SPAM).
+// `getMailingAddress` returns `null` for `mailing_address` when unset.
+async function getMailingAddress(apiKey) {
+    return (0, client_1.request)('GET', `${config_1.HQ_BASE}/hq/account/mailing-address`, apiKey);
+}
+async function setMailingAddress(apiKey, mailingAddress) {
+    return (0, client_1.request)('PATCH', `${config_1.HQ_BASE}/hq/account/mailing-address`, apiKey, { mailing_address: mailingAddress });
+}
 // Mints a manual API key. The requested (grants, org, spend cap) must be a
 // subset of the calling key's authority — the backend rejects escalation
 // with 403 SCOPE_FORBIDDEN. The full `api_key` is in the response ONCE.

package/dist/llm.d.ts

@@ -12,15 +12,16 @@ export interface CompleteRequest {
     temperature?: number;
     stop?: string[];
 }
+export interface RawUsage {
+    input_tokens: number;
+    output_tokens?: number;
+    cost_cents: number;
+}
 export interface CompleteResponse {
     model: string;
     content: string;
     finish_reason: string;
-    usage: {
-        input_tokens: number;
-        output_tokens: number;
-        cost_usd: number;
-    };
+    usage: RawUsage;
 }
 export interface EmbedRequest {
     model: string;
@@ -29,18 +30,15 @@ export interface EmbedRequest {
 export interface EmbedResponse {
     model: string;
     embeddings: number[][];
-    usage: {
-        input_tokens: number;
-        cost_usd: number;
-    };
+    usage: RawUsage;
 }
 export interface Model {
     id: string;
     kind: 'chat' | 'embed';
-    context?: number;
+    context_window?: number;
     dimensions?: number;
-    input_per_1m: number;
-    output_per_1m?: number;
+    input_cost_per_1m_cents: number;
+    output_cost_per_1m_cents?: number;
 }
 export interface ModelsResponse {
     models: Model[];
@@ -48,3 +46,77 @@ export interface ModelsResponse {
 export declare function complete(apiKey: string, orgId: string, req: CompleteRequest): Promise<CompleteResponse>;
 export declare function embed(apiKey: string, orgId: string, req: EmbedRequest): Promise<EmbedResponse>;
 export declare function listModels(apiKey: string, orgId: string): Promise<ModelsResponse>;
+export type Verb = 'classify' | 'extract' | 'summarize' | 'draft';
+/** Routing hint; opaque — the server picks the model. With one served
+ *  model today every tier resolves to it. `tier_used` echoes back what was
+ *  actually selected. */
+export type Tier = 'fast' | 'reasoning' | 'cheap';
+export interface VerbUsage {
+    tier_used: Tier;
+    tokens_in: number;
+    tokens_out: number;
+    cost_cents: number;
+}
+interface VerbBase {
+    /** Routing hint. Defaults to 'fast'. */
+    tier?: Tier;
+}
+export interface ClassifyRequest extends VerbBase {
+    input: string;
+    /** Candidate labels — pick from this set. */
+    labels: string[];
+    /** When true, multiple labels may apply; response carries `labels[]`. */
+    multi?: boolean;
+}
+export interface ClassifyResponse {
+    data: {
+        label?: string;
+        labels?: string[];
+    };
+    usage: VerbUsage;
+}
+export interface ExtractRequest extends VerbBase {
+    input: string;
+    /** A JSON Schema (object) the extracted data must conform to. */
+    schema: Record<string, unknown>;
+}
+export interface ExtractResponse {
+    data: {
+        data: Record<string, unknown>;
+    };
+    usage: VerbUsage;
+}
+export interface SummarizeRequest extends VerbBase {
+    input: string;
+    /** `brief` (1-2 sentences), `exec` (3-4 decision-maker sentences), or
+     *  `bullet` (short bulleted list). Default `brief`. */
+    style?: 'brief' | 'exec' | 'bullet';
+}
+export interface SummarizeResponse {
+    data: {
+        summary: string;
+    };
+    usage: VerbUsage;
+}
+export interface DraftRequest extends VerbBase {
+    /** Optional source content — may be empty when `context`/`prompt` carry
+     *  the brief. */
+    input?: string;
+    /** What to write — `email`, `message`, `reply`, etc. */
+    kind: string;
+    /** Free-form structured context (recipient, tone, facts). */
+    context?: Record<string, unknown>;
+    /** Free-text instructions to the writer. */
+    prompt?: string;
+}
+export interface DraftResponse {
+    data: {
+        text: string;
+    };
+    usage: VerbUsage;
+}
+export declare function classify(apiKey: string, orgId: string, req: ClassifyRequest): Promise<ClassifyResponse>;
+export declare function extract(apiKey: string, orgId: string, req: ExtractRequest): Promise<ExtractResponse>;
+export declare function summarize(apiKey: string, orgId: string, req: SummarizeRequest): Promise<SummarizeResponse>;
+export declare function draft(apiKey: string, orgId: string, req: DraftRequest): Promise<DraftResponse>;
+export {};

package/dist/llm.js

@@ -9,12 +9,17 @@ exports.EXPOSES = void 0;
 exports.complete = complete;
 exports.embed = embed;
 exports.listModels = listModels;
+exports.classify = classify;
+exports.extract = extract;
+exports.summarize = summarize;
+exports.draft = draft;
 const client_1 = require("./client");
 const config_1 = require("./config");
 exports.EXPOSES = [
     'POST /llm/orgs/{org_id}/complete',
     'POST /llm/orgs/{org_id}/embed',
     'GET /llm/orgs/{org_id}/models',
+    'POST /llm/orgs/{org_id}/tasks/{verb}',
 ];
 async function complete(apiKey, orgId, req) {
     return (0, client_1.request)('POST', `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/complete`, apiKey, req);
@@ -25,3 +30,18 @@ async function embed(apiKey, orgId, req) {
 async function listModels(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/models`, apiKey);
 }
+function verbUrl(orgId, verb) {
+    return `${config_1.LLM_BASE}/llm/orgs/${encodeURIComponent(orgId)}/tasks/${verb}`;
+}
+async function classify(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'classify'), apiKey, req);
+}
+async function extract(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'extract'), apiKey, req);
+}
+async function summarize(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'summarize'), apiKey, req);
+}
+async function draft(apiKey, orgId, req) {
+    return (0, client_1.request)('POST', verbUrl(orgId, 'draft'), apiKey, req);
+}

package/dist/workflow.js

@@ -23,7 +23,33 @@ exports.EXPOSES = [
     'GET /workflow/orgs/{org_id}/workflows/{workflow_id}/runs',
     'GET /workflow/orgs/{org_id}/runs/{run_id}',
 ];
+// Local URL-shape check on http_request steps. Same shape as the SSRF
+// audit's scheme allowlist on webhook.forward_url and queue.consumer_url —
+// this is *UX defense*, not security: the backend MUST also validate
+// (which it does, via the same middleware) — see
+// docs/cross-repo-prompts/backend-workflow-step-validation.md.
+// Catches javascript:, file:, gopher:, data:, and whitespace/null-byte
+// hosts at agent typo-fix latency instead of at "why didn't my workflow
+// fire" investigation latency.
+function validateSteps(steps) {
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i];
+        if (s.type === 'http_request' || s.type === 'http') {
+            let parsed;
+            try {
+                parsed = new URL(s.url);
+            }
+            catch {
+                throw new Error(`step ${i} (${s.type}): "url" is not a valid URL — got ${JSON.stringify(s.url)}.`);
+            }
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                throw new Error(`step ${i} (${s.type}): "url" must use http:// or https:// scheme — got "${parsed.protocol}" in ${JSON.stringify(s.url)}.`);
+            }
+        }
+    }
+}
 async function createWorkflow(apiKey, orgId, payload) {
+    validateSteps(payload.steps);
     return (0, client_1.request)('POST', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows`, apiKey, payload);
 }
 async function listWorkflows(apiKey, orgId) {
@@ -33,6 +59,8 @@ async function getWorkflow(apiKey, orgId, workflowId) {
     return (0, client_1.request)('GET', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey);
 }
 async function updateWorkflow(apiKey, orgId, workflowId, payload) {
+    if (payload.steps)
+        validateSteps(payload.steps);
     return (0, client_1.request)('PATCH', `${config_1.WORKFLOW_BASE}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey, payload);
 }
 async function enableWorkflow(apiKey, orgId, workflowId) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "1.3.6",
+  "version": "1.3.11",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/email.ts

@@ -137,6 +137,22 @@ export async function createMailbox(apiKey: string, domain: string, username: st
   return request('POST', `${BASE_URL}/email/mailboxes/create`, apiKey, { domain, username, display_name: displayName });
 }
 
+// Backend (2026-06-06): idempotent — 204 whether the mailbox existed or not.
+// Returns 409 MAILBOX_IN_USE when an active/paused campaign still sends from
+// this address; pause/delete the campaign first.
+export async function deleteMailbox(apiKey: string, address: string): Promise<void> {
+  return request('DELETE', `${BASE_URL}/email/mailboxes/${encodeURIComponent(address)}`, apiKey);
+}
+
+// Backend (2026-06-06): re-run Stalwart provisioning for a domain. Use when
+// mailbox-create on a domain returns DOMAIN_NOT_MAIL_READY /
+// MAILBOX_PROVISION_FAILED, or when the inbox endpoint returns
+// "mail server error" on a domain whose `email_infra_ready` flag is stale.
+// Idempotent.
+export async function mailServerResync(apiKey: string, orgId: string, domain: string): Promise<{ ok: boolean } & Record<string, unknown>> {
+  return request('POST', `${BASE_URL}/email/orgs/${encodeURIComponent(orgId)}/domains/${encodeURIComponent(domain)}/mail-server-resync`, apiKey);
+}
+
 export async function listMailboxes(apiKey: string, options?: { domain?: string; filter?: 'unassigned' }): Promise<{ address: string; created_at: string }[]> {
   const query = new URLSearchParams();
   if (options?.domain) query.append('domain', options.domain);

package/src/funnel.ts

@@ -12,6 +12,12 @@ export const EXPOSES: Exposes = [
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
   'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
   'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
+  // Backend (2026-06-03): canonical funnel-form proxy lands per-slug
+  // bindings — destination (webhook/workflow), fields, honeypot, rate
+  // limit. See docs/cross-repo-prompts/cli-funnel-form-canonical-followup-2026-06-04.md.
+  'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+  'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+  'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}/forms/{slug}',
 ];
 
 export interface Funnel {
@@ -21,10 +27,37 @@ export interface Funnel {
   // to the org's preview_subdomain for back-compat. Get / list responses
   // include it when set.
   name?: string;
+  // Backend (2026-06-03): every funnel auto-provisions a webhook_endpoints
+  // row at create. Submissions to `/submit/{slug}` without a per-slug
+  // binding fall through to this webhook. Optional only because legacy
+  // funnels migrated by the boot job may be briefly null.
+  org_webhook_id?: string;
   created_at: string;
   updated_at: string;
 }
+
+// Per-slug binding from `POST /funnel/.../forms`. Backend resolves a
+// submission's destination at submit time: per-slug binding wins, then
+// `Funnel.org_webhook_id`, else `NO_DESTINATION`.
+export interface FormFieldSpec {
+  name: string;
+  required?: boolean;
+  oneof?: string[];
+  max_length?: number;
+  regex?: string;
+}
+export interface FormBinding {
+  slug: string;
+  // "<kind>:<uuid>" — kind is "webhook" or "workflow".
+  destination: string;
+  fields?: FormFieldSpec[];
+  honeypot_field?: string;
+  rate_limit?: { per_minute: number };
+}
 export interface CreateFunnelResponse { funnel: Funnel; subdomain_url?: string; domain_url?: string }
+// Same envelope shape on read — kept as its own name so call sites read
+// honestly. Wire shape is `{funnel: {...}, subdomain_url?, domain_url?}`.
+export interface GetFunnelResponse { funnel: Funnel; subdomain_url?: string; domain_url?: string }
 export interface VerifyResult {
   pages?: Array<{ slug: string; tests: VerifyTest[] }>;
   tests?: VerifyTest[];
@@ -36,8 +69,19 @@ export async function createFunnel(apiKey: string, orgId: string, opts?: { name?
   // matching the reserved-suffix rules; agent should pre-validate.
   return request('POST', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey, opts?.name ? { name: opts.name } : {});
 }
-export async function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<Funnel> {
-  return request('GET', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`, apiKey);
+export async function getFunnel(apiKey: string, orgId: string, funnelId: string): Promise<GetFunnelResponse> {
+  // Backend has wrapped GET responses since 2026-04 (`{funnel, subdomain_url, domain_url}`).
+  // Older builds returned a flat Funnel — normalize to the envelope so
+  // callers can rely on the typed shape.
+  const raw = await request<GetFunnelResponse | Funnel>(
+    'GET',
+    `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}`,
+    apiKey,
+  );
+  if (raw && typeof raw === 'object' && 'funnel' in raw && (raw as GetFunnelResponse).funnel) {
+    return raw as GetFunnelResponse;
+  }
+  return { funnel: raw as Funnel };
 }
 export async function listFunnels(apiKey: string, orgId: string): Promise<Funnel[]> {
   return request('GET', `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels`, apiKey);
@@ -138,3 +182,22 @@ export async function publishFiles(
   }
   return (result as ApiResponse<PublishResult>).data as PublishResult;
 }
+
+// ── Form bindings (canonical funnel-form proxy) ────────────────────────────
+
+function formsBase(orgId: string, funnelId: string): string {
+  return `${BASE_URL}/funnel/orgs/${encodeURIComponent(orgId)}/funnels/${encodeURIComponent(funnelId)}/forms`;
+}
+
+export async function createFormBinding(apiKey: string, orgId: string, funnelId: string, binding: FormBinding): Promise<FormBinding> {
+  return request('POST', formsBase(orgId, funnelId), apiKey, binding);
+}
+
+export async function listFormBindings(apiKey: string, orgId: string, funnelId: string): Promise<FormBinding[]> {
+  const res = await request<FormBinding[] | { forms?: FormBinding[] }>('GET', formsBase(orgId, funnelId), apiKey);
+  return Array.isArray(res) ? res : (res?.forms ?? []);
+}
+
+export async function deleteFormBinding(apiKey: string, orgId: string, funnelId: string, slug: string): Promise<void> {
+  return request('DELETE', `${formsBase(orgId, funnelId)}/${encodeURIComponent(slug)}`, apiKey);
+}

package/src/hq.ts

@@ -14,6 +14,11 @@ export const EXPOSES: Exposes = [
   'POST /hq/account/keys/revoke-all',
   'DELETE /hq/account/delete/key/{key_id}',
   'PATCH /hq/account/spend-cap',
+  // Backend (2026-06-06): account-scoped mailing address — required for
+  // transactional email per CAN-SPAM. PATCH sets, GET reads (null when
+  // unset). Hard-gates POST /email/send with MAILING_ADDRESS_REQUIRED.
+  'PATCH /hq/account/mailing-address',
+  'GET /hq/account/mailing-address',
   'POST /hq/orgs',
   'GET /hq/orgs',
   'GET /hq/orgs/{org_id}',
@@ -148,6 +153,16 @@ export async function getAccount(apiKey: string): Promise<AccountInfo> {
   return request('GET', `${BASE_URL}/hq/account/me`, apiKey);
 }
 
+// Mailing address — required for transactional `email send` (CAN-SPAM).
+// `getMailingAddress` returns `null` for `mailing_address` when unset.
+export async function getMailingAddress(apiKey: string): Promise<{ mailing_address: string | null }> {
+  return request('GET', `${BASE_URL}/hq/account/mailing-address`, apiKey);
+}
+
+export async function setMailingAddress(apiKey: string, mailingAddress: string): Promise<{ mailing_address: string }> {
+  return request('PATCH', `${BASE_URL}/hq/account/mailing-address`, apiKey, { mailing_address: mailingAddress });
+}
+
 export interface CreateApiKeyOptions {
   // Slot grants. Omitted → backend defaults to unrestricted ({"*":"write"}).
   grants?: Grants;

package/src/llm.ts

@@ -12,8 +12,15 @@ export const EXPOSES: Exposes = [
   'POST /llm/orgs/{org_id}/complete',
   'POST /llm/orgs/{org_id}/embed',
   'GET /llm/orgs/{org_id}/models',
+  'POST /llm/orgs/{org_id}/tasks/{verb}',
 ];
 
+// ── Raw surface ──────────────────────────────────────────────────────────
+// Backed *exclusively* by self-hosted open-source models (Qwen on our TPU).
+// The customer picks the model id from the catalog. Proprietary models are
+// not callable here — that rule is what keeps the LLM slot off the
+// reseller framing.
+
 export type Role = 'system' | 'user' | 'assistant';
 
 export interface Message {
@@ -29,15 +36,17 @@ export interface CompleteRequest {
   stop?: string[];
 }
 
+export interface RawUsage {
+  input_tokens: number;
+  output_tokens?: number;
+  cost_cents: number;
+}
+
 export interface CompleteResponse {
   model: string;
   content: string;
-  finish_reason: string; // 'stop' | 'length' | 'safety' | ...
-  usage: {
-    input_tokens: number;
-    output_tokens: number;
-    cost_usd: number;
-  };
+  finish_reason: string; // 'stop' | 'length' | 'filter'
+  usage: RawUsage;
 }
 
 export interface EmbedRequest {
@@ -47,26 +56,22 @@ export interface EmbedRequest {
 
 // Always returned as an array — even for a single-string input you get a
 // one-element array. Each element is the dense vector as a flat number[].
-// Embed-only usage has no output_tokens.
 export interface EmbedResponse {
   model: string;
   embeddings: number[][];
-  usage: {
-    input_tokens: number;
-    cost_usd: number;
-  };
+  usage: RawUsage;
 }
 
-// Catalog row. 'chat' models have context + output_per_1m; 'embed' models
-// have dimensions instead. Pricing is per 1M tokens at upstream rates
-// (we resell at-cost while building our own inference).
+// Catalog row. `chat` models have context_window + output_cost_per_1m_cents;
+// `embed` models have dimensions instead. Pricing is in cents per 1M tokens
+// (the platform's native unit — cost_cents everywhere).
 export interface Model {
   id: string;
   kind: 'chat' | 'embed';
-  context?: number;
+  context_window?: number;
   dimensions?: number;
-  input_per_1m: number;
-  output_per_1m?: number;
+  input_cost_per_1m_cents: number;
+  output_cost_per_1m_cents?: number;
 }
 
 export interface ModelsResponse {
@@ -84,3 +89,101 @@ export async function embed(apiKey: string, orgId: string, req: EmbedRequest): P
 export async function listModels(apiKey: string, orgId: string): Promise<ModelsResponse> {
   return request('GET', `${BASE_URL}/llm/orgs/${encodeURIComponent(orgId)}/models`, apiKey);
 }
+
+// ── Verb surface — objective-based completion ────────────────────────────
+// The customer asks for a task done (classify / extract / summarize /
+// draft); the model is implementation detail and is never named in the
+// response. This is where any future proprietary model lives — wrapped, not
+// resold.
+
+export type Verb = 'classify' | 'extract' | 'summarize' | 'draft';
+
+/** Routing hint; opaque — the server picks the model. With one served
+ *  model today every tier resolves to it. `tier_used` echoes back what was
+ *  actually selected. */
+export type Tier = 'fast' | 'reasoning' | 'cheap';
+
+export interface VerbUsage {
+  tier_used: Tier;
+  tokens_in: number;
+  tokens_out: number;
+  cost_cents: number;
+}
+
+interface VerbBase {
+  /** Routing hint. Defaults to 'fast'. */
+  tier?: Tier;
+}
+
+export interface ClassifyRequest extends VerbBase {
+  input: string;
+  /** Candidate labels — pick from this set. */
+  labels: string[];
+  /** When true, multiple labels may apply; response carries `labels[]`. */
+  multi?: boolean;
+}
+
+export interface ClassifyResponse {
+  data: { label?: string; labels?: string[] };
+  usage: VerbUsage;
+}
+
+export interface ExtractRequest extends VerbBase {
+  input: string;
+  /** A JSON Schema (object) the extracted data must conform to. */
+  schema: Record<string, unknown>;
+}
+
+export interface ExtractResponse {
+  data: { data: Record<string, unknown> };
+  usage: VerbUsage;
+}
+
+export interface SummarizeRequest extends VerbBase {
+  input: string;
+  /** `brief` (1-2 sentences), `exec` (3-4 decision-maker sentences), or
+   *  `bullet` (short bulleted list). Default `brief`. */
+  style?: 'brief' | 'exec' | 'bullet';
+}
+
+export interface SummarizeResponse {
+  data: { summary: string };
+  usage: VerbUsage;
+}
+
+export interface DraftRequest extends VerbBase {
+  /** Optional source content — may be empty when `context`/`prompt` carry
+   *  the brief. */
+  input?: string;
+  /** What to write — `email`, `message`, `reply`, etc. */
+  kind: string;
+  /** Free-form structured context (recipient, tone, facts). */
+  context?: Record<string, unknown>;
+  /** Free-text instructions to the writer. */
+  prompt?: string;
+}
+
+export interface DraftResponse {
+  data: { text: string };
+  usage: VerbUsage;
+}
+
+function verbUrl(orgId: string, verb: Verb): string {
+  return `${BASE_URL}/llm/orgs/${encodeURIComponent(orgId)}/tasks/${verb}`;
+}
+
+export async function classify(apiKey: string, orgId: string, req: ClassifyRequest): Promise<ClassifyResponse> {
+  return request('POST', verbUrl(orgId, 'classify'), apiKey, req);
+}
+
+export async function extract(apiKey: string, orgId: string, req: ExtractRequest): Promise<ExtractResponse> {
+  return request('POST', verbUrl(orgId, 'extract'), apiKey, req);
+}
+
+export async function summarize(apiKey: string, orgId: string, req: SummarizeRequest): Promise<SummarizeResponse> {
+  return request('POST', verbUrl(orgId, 'summarize'), apiKey, req);
+}
+
+export async function draft(apiKey: string, orgId: string, req: DraftRequest): Promise<DraftResponse> {
+  return request('POST', verbUrl(orgId, 'draft'), apiKey, req);
+}

package/src/workflow.ts

@@ -64,11 +64,36 @@ export interface WorkflowRun {
   created_at: string;
 }
 
+// Local URL-shape check on http_request steps. Same shape as the SSRF
+// audit's scheme allowlist on webhook.forward_url and queue.consumer_url —
+// this is *UX defense*, not security: the backend MUST also validate
+// (which it does, via the same middleware) — see
+// docs/cross-repo-prompts/backend-workflow-step-validation.md.
+// Catches javascript:, file:, gopher:, data:, and whitespace/null-byte
+// hosts at agent typo-fix latency instead of at "why didn't my workflow
+// fire" investigation latency.
+function validateSteps(steps: WorkflowStep[]): void {
+  for (let i = 0; i < steps.length; i++) {
+    const s = steps[i];
+    if (s.type === 'http_request' || s.type === 'http') {
+      let parsed: URL;
+      try { parsed = new URL(s.url); }
+      catch {
+        throw new Error(`step ${i} (${s.type}): "url" is not a valid URL — got ${JSON.stringify(s.url)}.`);
+      }
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`step ${i} (${s.type}): "url" must use http:// or https:// scheme — got "${parsed.protocol}" in ${JSON.stringify(s.url)}.`);
+      }
+    }
+  }
+}
+
 export async function createWorkflow(apiKey: string, orgId: string, payload: {
   name: string;
   trigger_config: { endpoint_id: string };
   steps: WorkflowStep[];
 }): Promise<Workflow> {
+  validateSteps(payload.steps);
   return request('POST', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows`, apiKey, payload);
 }
 
@@ -81,6 +106,7 @@ export async function getWorkflow(apiKey: string, orgId: string, workflowId: str
 }
 
 export async function updateWorkflow(apiKey: string, orgId: string, workflowId: string, payload: { name?: string; trigger_config?: { endpoint_id: string }; steps?: WorkflowStep[] }): Promise<Workflow> {
+  if (payload.steps) validateSteps(payload.steps);
   return request('PATCH', `${BASE_URL}/workflow/orgs/${encodeURIComponent(orgId)}/workflows/${encodeURIComponent(workflowId)}`, apiKey, payload);
 }