@myapihq/sdk 2.4.0 → 2.4.2

package/src/auth.ts

@@ -1,161 +0,0 @@
-import { request } from './client';
-import { AUTH_BASE as BASE_URL } from './config';
-import type { Exposes } from './exposes';
-
-// The end-user auth product (my-auth-api): a managed multi-tenant OIDC
-// Identity Provider for the END USERS of apps built on MyAPI. Distinct from
-// operator/account auth (hq/account/*). Each org gets one auth tenant; OIDC
-// clients (apps) register against it. End users sign in with managed Google,
-// email/password, or magic links (per the tenant's `connections`). Tokens are
-// RS256, verified via the tenant's JWKS.
-//
-// The browser/app-facing OIDC + sign-in flows — discovery, jwks, authorize,
-// token, userinfo, password/magic/google login, verify-email, password reset,
-// the hosted login page — are machine/end-user surfaces consumed by apps, the
-// JS SDK, and browsers, NOT management calls; they are not CLI/SDK verbs. This
-// module covers only the org-scoped MANAGEMENT surface: tenant, clients, MAU
-// usage, and the custom auth domain.
-export const EXPOSES: Exposes = [
-  'POST /auth/orgs/{org_id}/tenant',
-  'GET /auth/orgs/{org_id}/tenant',
-  'POST /auth/orgs/{org_id}/clients',
-  'GET /auth/orgs/{org_id}/clients',
-  'DELETE /auth/orgs/{org_id}/clients/{client_id}',
-  'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
-  'GET /auth/orgs/{org_id}/usage',
-  'POST /auth/orgs/{org_id}/domain',
-  'GET /auth/orgs/{org_id}/domain',
-  'POST /auth/orgs/{org_id}/domain/verify',
-  'DELETE /auth/orgs/{org_id}/domain',
-];
-
-// Sign-in methods a tenant offers on its hosted login page.
-export type AuthConnection = 'google' | 'password' | 'magic';
-
-export interface Tenant {
-  tenant_id: string;
-  issuer: string;     // OIDC issuer: <base>/<tenant_id>
-  login_url: string;  // hosted authorize endpoint
-  connections?: AuthConnection[];
-}
-
-export interface CreateTenantInput {
-  // Sign-in methods to enable. Defaults to ['google'] when omitted.
-  connections?: AuthConnection[];
-  // Opaque JSON for the hosted login page (branding).
-  theme?: unknown;
-}
-
-export interface AuthClient {
-  client_id: string;
-  name?: string;
-  type: 'spa' | 'web';
-  redirect_uris: string[];
-  issuer?: string;
-  // Returned exactly ONCE, on create, for confidential ('web') clients.
-  // SPA clients are public and have no secret.
-  client_secret?: string;
-  created_at?: string;
-}
-
-export interface ListClientsResponse {
-  clients: AuthClient[];
-}
-
-export interface CreateClientInput {
-  name: string;
-  type: 'spa' | 'web';
-  redirect_uris: string[];
-}
-
-// Monthly-active-user metering for the tenant (auth is billed per MAU).
-export interface AuthUsage {
-  period: string;            // 'YYYY-MM'
-  active_users: number;
-  price_cents_each: number;
-  as_of?: string;            // RFC3339 freshness marker — MAU is aggregated, not real-time
-}
-
-// A custom auth domain (e.g. auth.acme.com) for the tenant's hosted login +
-// issuer. Lifecycle: awaiting_verification (publish the TXT challenge, then
-// `verify`) → pending (publish the A record, TLS provisions) → active.
-export interface AuthDomain {
-  domain: string;
-  status: 'awaiting_verification' | 'pending' | 'active';
-  // Present while `awaiting_verification` — the ownership-challenge TXT record
-  // to publish, then call verifyDomain().
-  verification?: { type: string; name: string; value: string };
-  // Present once `pending`/`active` — the A record to publish (withheld until
-  // ownership is verified).
-  dns?: { type: string; name: string; value: string };
-  next?: string;
-  issuer?: string;     // present once active
-  login_url?: string;  // present once active
-}
-
-// Create (or update) the org's auth tenant. Idempotent. `connections` selects
-// the sign-in methods (subset of google/password/magic; defaults to google);
-// `theme` is opaque JSON for the hosted login page.
-export async function createTenant(apiKey: string, orgId: string, input: CreateTenantInput = {}): Promise<Tenant> {
-  const body: Record<string, unknown> = {};
-  if (input.connections !== undefined) body.connections = input.connections;
-  if (input.theme !== undefined) body.theme = input.theme;
-  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey, body);
-}
-
-// Fetch the org's auth tenant. Rejects with TENANT_NOT_FOUND if not created.
-export async function getTenant(apiKey: string, orgId: string): Promise<Tenant> {
-  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/tenant`, apiKey);
-}
-
-// Register an OIDC client (an app) under the org's tenant. Auto-provisions the
-// tenant if absent. For type 'web' the response carries `client_secret` once.
-export async function createClient(apiKey: string, orgId: string, input: CreateClientInput): Promise<AuthClient> {
-  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey, input);
-}
-
-export async function listClients(apiKey: string, orgId: string): Promise<ListClientsResponse> {
-  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey);
-}
-
-// Delete (revoke) an OIDC client. Irreversible — the client_id stops
-// authenticating immediately.
-export async function deleteClient(apiKey: string, orgId: string, clientId: string): Promise<{ client_id: string; deleted: boolean }> {
-  return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}`, apiKey);
-}
-
-// Rotate a confidential ('web') client's secret. Returns the NEW secret exactly
-// once; the previous secret stops working immediately. (SPA clients have no
-// secret — rotating one is rejected by the backend.)
-export async function rotateClient(apiKey: string, orgId: string, clientId: string): Promise<AuthClient> {
-  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}/rotate`, apiKey);
-}
-
-// Monthly-active-user usage for the current period (auth is billed per MAU).
-export async function getUsage(apiKey: string, orgId: string): Promise<AuthUsage> {
-  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/usage`, apiKey);
-}
-
-// Set a custom auth domain (e.g. auth.acme.com). Returns the DNS record to
-// create; TLS provisions automatically and the domain becomes the issuer once
-// active. One custom domain per org.
-export async function registerDomain(apiKey: string, orgId: string, domain: string): Promise<AuthDomain> {
-  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
-}
-
-// Fetch the org's custom auth domain. Rejects with NO_DOMAIN if none set.
-export async function getDomain(apiKey: string, orgId: string): Promise<AuthDomain> {
-  return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey);
-}
-
-// Verify ownership of the org's custom auth domain by checking the published
-// TXT challenge. On success the domain advances awaiting_verification → pending
-// (and the response carries the A record). Rejects with 422 DOMAIN_NOT_VERIFIED
-// if the TXT record isn't found yet. Idempotent once already pending/active.
-export async function verifyDomain(apiKey: string, orgId: string): Promise<AuthDomain> {
-  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain/verify`, apiKey);
-}
-
-export async function deleteDomain(apiKey: string, orgId: string, domain: string): Promise<{ domain: string; status: string }> {
-  return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
-}

package/src/client.ts

@@ -1,121 +0,0 @@
-import { ApiResponse } from './types';
-
-export class MyApiError extends Error {
-  // `body` is the full error object as returned by the backend — preserved so
-  // callers can read service-specific fields the SDK doesn't otherwise model
-  // (e.g. CF_API_ERROR carries `cf_message` / `cf_status`).
-  constructor(public code: string, public status: number, public detail?: string, public body?: Record<string, unknown>) {
-    // Surface the detail in the message so console.error / err.message
-    // shows useful info without callers having to look at err.detail.
-    super(detail ? `${code} (${status}): ${detail}` : code);
-    this.name = 'MyApiError';
-  }
-}
-
-async function requestFull<T>(
-  method: string,
-  url: string,
-  apiKey?: string,
-  body?: unknown,
-  extraHeaders?: Record<string, string>,
-): Promise<ApiResponse<T>> {
-  const headers: Record<string, string> = {};
-
-  if (apiKey) {
-    headers['Authorization'] = `Bearer ${apiKey}`;
-  }
-
-  if (body !== undefined) {
-    headers['Content-Type'] = 'application/json';
-  }
-
-  // Caller-supplied headers (e.g. CAS via If-Match) win over the defaults
-  // above. Keep this near the top so route logic later doesn't accidentally
-  // overwrite something the caller passed in.
-  if (extraHeaders) {
-    for (const [k, v] of Object.entries(extraHeaders)) headers[k] = v;
-  }
-
-  const options: RequestInit = {
-    method,
-    headers,
-  };
-
-  if (body !== undefined) {
-    options.body = JSON.stringify(body);
-  }
-
-  const response = await fetch(url, options);
-
-  if (response.status === 204) {
-    return { success: true, data: null, error: null, meta: {} as ApiResponse<T>['meta'] };
-  }
-
-  // Read the body as text first so we can include a snippet in errors when
-  // it isn't valid JSON (HTML error pages from edge proxies, plaintext
-  // 5xx, etc.). One read; we re-parse manually below.
-  const raw = await response.text();
-
-  let result: any;
-  try {
-    result = raw ? JSON.parse(raw) : {};
-  } catch {
-    const snippet = raw.slice(0, 200).replace(/\s+/g, ' ').trim();
-    throw new MyApiError(
-      'invalid_json_response',
-      response.status,
-      `${method} ${url} returned non-JSON (status ${response.status}): ${snippet}`,
-    );
-  }
-
-  if (!response.ok) {
-    const err = result?.error;
-    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
-    const detail = typeof err === 'object' ? (err?.message || undefined) : undefined;
-    const errBody = typeof err === 'object' ? err : undefined;
-    throw new MyApiError(code, response.status, detail, errBody);
-  }
-
-  const apiResponse = result as ApiResponse<T>;
-  if (!apiResponse.success) {
-    const err = apiResponse.error as any;
-    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
-    const detail = typeof err === 'object' ? (err?.message || undefined) : undefined;
-    const errBody = typeof err === 'object' ? err : undefined;
-    throw new MyApiError(code, response.status, detail, errBody);
-  }
-
-  return apiResponse;
-}
-
-// Returns the unwrapped `data` payload — the common case.
-export async function request<T>(
-  method: string,
-  url: string,
-  apiKey?: string,
-  body?: unknown,
-  extraHeaders?: Record<string, string>,
-): Promise<T> {
-  return (await requestFull<T>(method, url, apiKey, body, extraHeaders)).data as T;
-}
-
-export interface Page<T> {
-  data: T[];
-  next_cursor?: string;
-  has_more?: boolean;
-}
-
-// For keyset-paginated endpoints (backend `envelope.WrapPage`): `data` is a
-// bare array and the cursor/has_more live under `meta`. `request` would drop
-// the cursor, so list endpoints with pagination must use this.
-export async function requestPage<T>(
-  method: string,
-  url: string,
-  apiKey?: string,
-  body?: unknown,
-  extraHeaders?: Record<string, string>,
-): Promise<Page<T>> {
-  const r = await requestFull<T[]>(method, url, apiKey, body, extraHeaders);
-  const meta = (r.meta ?? {}) as { next_cursor?: string; has_more?: boolean };
-  return { data: (r.data ?? []) as T[], next_cursor: meta.next_cursor, has_more: meta.has_more };
-}

package/src/company.ts

@@ -1,48 +0,0 @@
-// Scaffolded from schema by scripts/scaffold-sdk.js — DO NOT remove the
-// EXPOSES array (the coverage tool verifies it against the live schema).
-// Types and function names ARE editable; re-running the scaffolder against
-// a service whose config has been changed will diff vs. existing file
-// (use --dry-run to inspect).
-
-import { request } from './client';
-import { COMPANY_BASE as BASE_URL } from './config';
-import type { Exposes } from './exposes';
-
-import type { SearchFilter } from './audience';
-import type { Person } from './people';
-
-export const EXPOSES: Exposes = [
-  'POST /company/orgs/{org_id}/search',
-  'GET /company/orgs/{org_id}/{company_id}',
-];
-
-import type { Location, PersonCompany } from './people';
-
-// Company is the same shape as PersonCompany (a person's embedded company)
-// with an optional embedded people array when include_people=N is passed.
-export interface Company extends PersonCompany {
-  people?: Person[]; // present when include_people=N is passed
-}
-
-export interface CompanySearchResult {
-  companies: Company[];
-  total: number;
-  limit: number;
-  offset: number;
-  has_more: boolean;
-}
-
-export interface CompanySearchOptions extends SearchFilter {
-  include_people?: number; // 0..10; embed up to N people per company
-}
-
-export async function searchCompanies(apiKey: string, orgId: string, options: CompanySearchOptions): Promise<CompanySearchResult> {
-  return request('POST', `${BASE_URL}/company/orgs/${encodeURIComponent(orgId)}/search`, apiKey, options);
-}
-
-export async function getCompany(apiKey: string, orgId: string, companyId: string, include_people?: number): Promise<Company> {
-  const _url = include_people != null
-    ? `${BASE_URL}/company/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(companyId)}?include_people=${encodeURIComponent(String(include_people))}`
-    : `${BASE_URL}/company/orgs/${encodeURIComponent(orgId)}/${encodeURIComponent(companyId)}`;
-  return request('GET', _url, apiKey);
-}

package/src/config.ts

@@ -1,39 +0,0 @@
-// Service base URLs. Today's reality: all primitives are served from the
-// single `api.myapihq.com` gateway; per-service brand hosts
-// (e.g. api.myllmapi.com) are aspirational and only some are wired in DNS
-// + routed correctly. We default to the working hosts where they exist,
-// and to the gateway where they don't (LLM, DATABASE, CRM, PEOPLE,
-// COMPANY, AUDIENCE). The MYAPI_*_URL env vars stay as overrides for
-// local dev — `source scripts/local-env.sh` still points everything at
-// localhost:8080 regardless of the prod default.
-
-const GATEWAY = 'https://api.myapihq.com';
-
-export const HQ_BASE     = process.env.MYAPI_HQ_URL     ?? process.env.MYAPI_API_BASE ?? GATEWAY;
-export const DOMAIN_BASE  = process.env.MYAPI_DOMAIN_URL  ?? 'https://api.mydomainapi.com';
-export const FUNNEL_BASE  = process.env.MYAPI_FUNNEL_URL  ?? 'https://api.myfunnelapi.com';
-// New slots — routed via the gateway until brand hosts are DNS-wired
-// (mirrors the LLM/DATABASE/CRM pattern below).
-export const FUNCTION_BASE= process.env.MYAPI_FUNCTION_URL?? GATEWAY;
-export const PAYMENTS_BASE= process.env.MYAPI_PAYMENTS_URL?? GATEWAY;
-export const CONTAINER_BASE=process.env.MYAPI_CONTAINER_URL?? GATEWAY;
-export const GIT_BASE     = process.env.MYAPI_GIT_URL     ?? GATEWAY;
-export const QUEUE_BASE   = process.env.MYAPI_QUEUE_URL   ?? GATEWAY;
-export const TASK_BASE    = process.env.MYAPI_TASK_URL    ?? GATEWAY;
-export const IMAGE_BASE   = process.env.MYAPI_IMAGE_URL   ?? 'https://api.myimageapi.com';
-export const WEBHOOK_BASE = process.env.MYAPI_WEBHOOK_URL ?? 'https://api.mywebhookapi.com';
-export const WORKFLOW_BASE= process.env.MYAPI_WORKFLOW_URL?? 'https://api.myworkflowapi.com';
-export const EMAIL_BASE   = process.env.MYAPI_EMAIL_URL   ?? 'https://api.myemailapi.com';
-export const STORAGE_BASE = process.env.MYAPI_STORAGE_URL ?? 'https://api.mystorageapi.com';
-export const URL_BASE     = process.env.MYAPI_URL_URL     ?? 'https://api.myurlto.com';
-export const PIXEL_BASE   = process.env.MYAPI_PIXEL_URL   ?? 'https://api.mypixelapi.com';
-// Per-service hosts below either don't resolve in DNS or 404 the routes;
-// served via the gateway until backend wires the brand routing. Flip back
-// to per-service hosts when DNS is sound and routes verified there.
-export const PEOPLE_BASE  = process.env.MYAPI_PEOPLE_URL  ?? GATEWAY;
-export const COMPANY_BASE = process.env.MYAPI_COMPANY_URL ?? GATEWAY;
-export const AUDIENCE_BASE= process.env.MYAPI_AUDIENCE_URL?? GATEWAY;
-export const LLM_BASE     = process.env.MYAPI_LLM_URL     ?? GATEWAY;
-export const DATABASE_BASE= process.env.MYAPI_DATABASE_URL?? GATEWAY;
-export const CRM_BASE     = process.env.MYAPI_CRM_URL     ?? GATEWAY;
-export const AUTH_BASE    = process.env.MYAPI_AUTH_URL    ?? GATEWAY;

package/src/container.ts

@@ -1,187 +0,0 @@
-import { request, MyApiError } from './client';
-import { ApiResponse } from './types';
-import { CONTAINER_BASE as BASE_URL } from './config';
-import type { Exposes } from './exposes';
-
-// Backend: my-container-api per myapi-hq/internal/routes/container/. Phase 1
-// is metadata + scoped API key issuance; the Cloud Run build/deploy pipeline
-// is Phase 2 — `deployContainer` returns RUNTIME_UNAVAILABLE until it lands.
-export const EXPOSES: Exposes = [
-  'POST /container/orgs/{org_id}/containers',
-  'GET /container/orgs/{org_id}/containers',
-  'GET /container/orgs/{org_id}/containers/{id}',
-  'DELETE /container/orgs/{org_id}/containers/{id}',
-  'POST /container/orgs/{org_id}/containers/{id}/deploy',
-  'GET /container/orgs/{org_id}/containers/{id}/logs',
-  'POST /container/orgs/{org_id}/containers/{id}/domain',
-  'DELETE /container/orgs/{org_id}/containers/{id}/domain',
-];
-
-// service = HTTP server, worker = always-on background process, job = runs
-// to completion (the only type that accepts a cron_schedule).
-export type ContainerType = 'service' | 'worker' | 'job';
-
-// Mirrors the backend's `Container` struct in crud.go. `url` is empty until
-// the container is deployed.
-export interface Container {
-  id: string;
-  org_id: string;
-  name: string;
-  type: ContainerType;
-  cron_schedule?: string;
-  env: Record<string, unknown>;
-  cpu: string;
-  memory: string;
-  min_instances: number;
-  max_instances: number;
-  port: number;
-  url?: string;
-  // Custom domain bound to this container, if any. Served via a Cloudflare
-  // Origin Rule that rewrites Host + SNI to the Cloud Run hostname.
-  custom_domain?: string;
-  status: string;
-  // Egress mode for the container's outbound traffic (backend returns it on
-  // every row, container/crud.go). Static-IP vs. default depending on config.
-  egress: string;
-  created_at: string;
-  updated_at: string;
-}
-
-export interface CreatePayload {
-  name: string;                  // required; ^[a-z0-9][a-z0-9-]{0,49}$
-  type?: ContainerType;          // defaults to 'service' server-side
-  cron_schedule?: string;        // only valid when type is 'job'
-  env?: Record<string, unknown>;
-  cpu?: string;                  // defaults to '1'
-  memory?: string;               // defaults to '512Mi'
-  min_instances?: number;        // defaults to 0 ('worker' is forced to >= 1)
-  max_instances?: number;        // defaults to 3
-  port?: number;
-}
-
-// POST response — the scoped API key is returned ONCE. It is delivered to
-// the running container as the MYAPI_KEY environment variable.
-export interface CreateResponse {
-  container: Container;
-  scoped_api_key: string;
-  scoped_api_key_id: string;
-}
-
-// deployContainer response. The scoped key is ROTATED on every deploy — the
-// value here is fresh and the only time it is knowable.
-export interface DeployResponse {
-  container_id: string;
-  revision_id: string;
-  url: string;
-  status: string;
-  scoped_api_key: string;
-}
-
-export async function createContainer(apiKey: string, orgId: string, payload: CreatePayload): Promise<CreateResponse> {
-  return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers`, apiKey, payload);
-}
-
-export async function listContainers(apiKey: string, orgId: string): Promise<Container[]> {
-  return request('GET', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers`, apiKey);
-}
-
-export async function getContainer(apiKey: string, orgId: string, containerId: string): Promise<Container> {
-  return request('GET', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
-}
-
-export async function deleteContainer(apiKey: string, orgId: string, containerId: string): Promise<void> {
-  return request('DELETE', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}`, apiKey);
-}
-
-// deployContainer ships a revision from a pre-built image ref to Cloud Run.
-// Synchronous — returns status='active' with a rotated scoped key.
-export async function deployContainer(apiKey: string, orgId: string, containerId: string, image: string): Promise<DeployResponse> {
-  return request('POST', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`, apiKey, { image });
-}
-
-// BuildDeployResponse — the async source-build path. The backend records a
-// `building` revision, kicks off Cloud Build on a background goroutine, and
-// returns immediately. The scoped key is minted later (once the image
-// exists), so it is NOT in this response. Poll getContainer until
-// status='active' (or 'build_error'/'deploy_error').
-export interface BuildDeployResponse {
-  container_id: string;
-  revision_id: string;
-  status: string;       // 'building'
-  message?: string;
-}
-
-// deployContainerSource uploads a build-context tarball via multipart `source`
-// (backend deploy.go builds it via Cloud Build → Artifact Registry, then
-// deploys). Asynchronous: returns status='building' to poll. The tarball is
-// capped at 100MB server-side. Mirrors the multipart upload in storage.ts.
-export async function deployContainerSource(
-  apiKey: string,
-  orgId: string,
-  containerId: string,
-  tarball: Blob | Buffer,
-  filename = 'source.tar.gz',
-): Promise<BuildDeployResponse> {
-  const formData = new FormData();
-  formData.append('source', new Blob([tarball as any], { type: 'application/gzip' }), filename);
-
-  const response = await fetch(
-    `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/deploy`,
-    { method: 'POST', headers: { Authorization: `Bearer ${apiKey}` }, body: formData as any },
-  );
-
-  let result: any;
-  try {
-    result = await response.json();
-  } catch {
-    throw new MyApiError('invalid_json_response', response.status);
-  }
-  if (!response.ok || !result?.success) {
-    const err = result?.error;
-    const code = typeof err === 'object' ? (err?.code || 'unknown_error') : (err || 'unknown_error');
-    const detail = typeof err === 'object' ? err?.message : undefined;
-    throw new MyApiError(code, response.status, detail, typeof err === 'object' ? err : undefined);
-  }
-  return (result as ApiResponse<BuildDeployResponse>).data as BuildDeployResponse;
-}
-
-// One runtime log line from the container's Cloud Run resource.
-export interface LogEntry {
-  timestamp: string;
-  severity: string;
-  text: string;
-}
-
-// getContainerLogs returns recent runtime log entries, newest first.
-// `tail` caps the count (default 100, max 1000 server-side). An
-// undeployed container returns an empty array.
-export async function getContainerLogs(apiKey: string, orgId: string, containerId: string, tail?: number): Promise<LogEntry[]> {
-  const query = tail ? `?tail=${encodeURIComponent(String(tail))}` : '';
-  return request('GET', `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/logs${query}`, apiKey);
-}
-
-// bindDomain response. `origin` is the Cloud Run hostname the custom domain
-// is fronted onto via a Cloudflare Origin Rule (Host + SNI rewrite).
-export interface DomainBinding {
-  container_id: string;
-  custom_domain: string;
-  origin: string;
-  status: string;
-}
-
-// bindDomain points a custom domain at a deployed container. The parent
-// domain must be MyAPI-managed. Errors: 422 (container not deployed, or no
-// MyAPI-managed parent domain), 409 (container already has a domain, or the
-// hostname is taken).
-function domainUrl(orgId: string, containerId: string): string {
-  return `${BASE_URL}/container/orgs/${encodeURIComponent(orgId)}/containers/${encodeURIComponent(containerId)}/domain`;
-}
-
-export async function bindDomain(apiKey: string, orgId: string, containerId: string, domain: string): Promise<DomainBinding> {
-  return request('POST', domainUrl(orgId, containerId), apiKey, { domain });
-}
-
-// unbindDomain removes the custom domain from a container.
-export async function unbindDomain(apiKey: string, orgId: string, containerId: string): Promise<void> {
-  return request('DELETE', domainUrl(orgId, containerId), apiKey);
-}