@myapihq/cli 2.28.0 → 2.28.2

package/dist/commands/container.js

@@ -39,6 +39,8 @@ export const SCHEMA = {
     'no-promote': 'boolean',
     'health-check': 'string',
     clear: 'boolean',
+    // `container get --reveal` — print env VALUES, not just their names.
+    reveal: 'boolean',
     smoke: 'string',
     remove: 'boolean',
     source: 'string',
@@ -170,6 +172,16 @@ export async function create(nameArg, flags) {
         payload.env = merged;
     }
     const result = await sdkContainer.createContainer(config.api_key, orgId, payload);
+    // `create` is the verb whose RESULT a caller needs — the id to deploy to and
+    // the scoped key, which is returned exactly once. It printed prose and
+    // ignored --json, so anything automating this had to scrape an id out of a
+    // sentence and a secret out of an indented line. Same defect as
+    // `storage upload --json`, found the same way: a probe asked for machine
+    // output and got none.
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
     success(`Container created: ${result.container.id}`);
     info(`Name:            ${result.container.name}`);
     info(`Type:            ${result.container.type}${result.container.cron_schedule ? ` (${result.container.cron_schedule})` : ''}`);
@@ -202,7 +214,10 @@ export async function get(id, flags) {
     const orgId = requireOrg(flags, config, 'myapi container get <id> [--org <id>]');
     if (!id)
         error('Missing id.\nUsage: myapi container get <id>');
-    const c = await sdkContainer.getContainer(config.api_key, orgId, id);
+    // --reveal is opt-in for the same reason the API makes it opt-in: the values
+    // are secrets, and a plain read should not put them on a terminal (or in a
+    // screenshot, or a pasted bug report) unless that was the point.
+    const c = await sdkContainer.getContainer(config.api_key, orgId, id, flags.reveal ? { reveal: true } : undefined);
     if (flags.json) {
         printJson(c);
         return;
@@ -216,6 +231,12 @@ export async function get(id, flags) {
         info(`Port:            ${c.port}`);
     info(`URL:             ${c.url || '(not deployed)'}`);
     info(`Startup probe:   ${c.health_check || '(none)'}`);
+    const envNames = Object.keys(c.env ?? {});
+    if (envNames.length) {
+        info(`Env:             ${envNames.length} variable(s): ${envNames.sort().join(', ')}`);
+        if (!flags.reveal)
+            info('                 values hidden — add --reveal to print them');
+    }
     if (c.egress)
         info(`Egress:          ${c.egress}`);
     if (c.custom_domain)
@@ -740,7 +761,11 @@ revision — so it completes in seconds.
 
 List candidates with: myapi container revisions <id>`,
     'list': 'myapi container list [--org <id>] [--json]',
-    'get': 'myapi container get <id> [--org <id>] [--json]',
+    'get': `myapi container get <id> [--reveal] [--org <id>] [--json]
+
+Environment VALUES are hidden by default and shown with --reveal; the names are
+always listed. They are secrets, and a plain read should not put them on a
+terminal unless that was the point.`,
     'logs': `myapi container logs <id> [--tail <n>] [--scope all] [--org <id>] [--json]
 
 Recent runtime logs, newest first. --tail caps the count (default 100,

package/dist/commands/email/mailbox.js

@@ -1,6 +1,6 @@
 import { email as sdkEmail } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
-import { success, error, printTable, info } from '../../output.js';
+import { success, error, printTable, info, printJson } from '../../output.js';
 export const EXPOSES = [
     'POST /email/mailboxes/create',
     'GET /email/mailboxes',
@@ -36,6 +36,13 @@ async function create(addressArg, flags) {
     // instead of reported. Kept the fallback anyway: the address is derivable
     // from the inputs, and a create that succeeded should still print what it
     // made if the field ever moves again.
+    // Same class as `container create` and `storage upload`: the create verb
+    // returns the thing a caller needs and printed only prose. `list` was always
+    // fine because printTable honours --json for it.
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Mailbox created: ${res.mailbox || `${username}@${domain}`}`);
     // A warning on a 2xx means something is configured but incomplete — here, a
     // missing CAN-SPAM mailing address, which refuses every send LATER rather

package/dist/skills/my-container-api/SKILL.md

@@ -1,25 +1,24 @@
 ---
 name: my-container-api
-version: 1.1.2
+version: 1.1.3
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-0e1702e51e8d501edf48bdc4da92728d52e79c4273f534ba5ed41511b4803271
+checksum: sha256-14cb4bc8d0d968425e121f728e86f8e7057efb56572c2fbb4d18d65d75a146b5
 ---
 
 # MyContainerAPI
 
-A container runs a pre-built image on managed cloud infrastructure. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on process), or a **job** (runs to completion — the only type that takes a cron schedule).
+A container runs a pre-built image on managed cloud infra. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on), or a **job** (runs to completion — the only type taking a cron schedule).
 
 ## Capabilities
 <!-- llm:start -->
 The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 
-- `create` registers the container and issues a **scoped API key**, returned once. The container gets it as `MYAPI_KEY`, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
+- `create` registers the container and issues a **scoped API key**, returned once (rotated on deploy). The container gets it as `MYAPI_KEY`, so your code calls other slots with no token handling.
 - `deploy` takes **either** a pre-built image reference **or** a source
-  directory. `--source ./dir` tars the directory, builds it server-side
-  (typically ~4 minutes) and deploys the result — **no Docker on your machine,
-  no registry account, no image to push**.
+  directory. `--source ./dir` tars it, builds server-side (~4 min) and deploys —
+  **no Docker locally, no registry account, no image to push**.
 - `domain` puts the container on a **custom domain** — a dynamic app at `app.yourbrand.com`.
 
 ### Deploying safely
@@ -49,11 +48,13 @@ revision in seconds, no rebuild.
 `--health-check /livez` makes the startup probe an HTTP request, not a bare TCP
 connect — at create, or later with `myapi container health-check <id> /livez`
 (`--clear` removes it), which rolls a new revision on the same image.
-`/healthz` is refused: the runtime answers it before your container does.
+`/healthz` is refused: the runtime answers it before your container does, and a
+path yours does not SERVE leaves the revision unready. `container get` lists env names;
+`--reveal` prints values.
 
 ### Custom domains (dynamic apps)
 
-`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, over HTTPS automatically. The path for a dynamic backend on a real domain — unlike `my-funnel-api`, which serves static sites.
+`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container over HTTPS — a dynamic backend on a real domain, unlike `my-funnel-api`'s static sites.
 
 - **Deploy first.** Binding a domain to a container that has never deployed fails (422) — there is nothing running to route to.
 - **Register the parent domain first** via `my-domain-api`. Binding `app.synthesisdaily.com` requires `synthesisdaily.com` registered in MyAPI; otherwise 422.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.28.0",
+  "version": "2.28.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.28.0"
+    "@myapihq/sdk": "^2.28.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",