@myapihq/cli 2.6.1 → 2.7.0

package/dist/commands/crm/pagination.test.js

@@ -1,73 +1,37 @@
-// Regression cover for the CRM pagination guards.
+// Rendering for CRM result counts.
 //
-// The bug being fenced off: the API accepts `offset`, ignores it, and reports
-// `total` as the page size — so an agent paging a contact list re-read page
-// one forever and had no signal that anything was missing. Verified against
-// production 2026-07-27. These tests assert the CLI never silently accepts
-// that flag again, and never claims a result is complete when it cannot know.
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
-import * as output from '../../output.js';
-describe('rejectOffset', () => {
-    let errSpy;
-    beforeEach(() => {
-        // error() exits the process; make it throw so the test can catch it.
-        errSpy = vi.spyOn(output, 'error').mockImplementation(((msg) => {
-            throw new Error(msg);
-        }));
-    });
-    afterEach(() => errSpy.mockRestore());
-    it('passes through when --offset is absent', () => {
-        expect(() => rejectOffset({}, 'usage')).not.toThrow();
-    });
-    it('rejects --offset 0 — it is as broken as any other value', () => {
-        expect(() => rejectOffset({ offset: 0 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('rejects a non-zero --offset', () => {
-        expect(() => rejectOffset({ offset: 25 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('explains that no cursor exists either, so the user does not go looking', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'usage')).toThrow(/no cursor parameter/);
-    });
-    it('includes the usage line so the error is actionable', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'myapi crm contacts list [--limit N]'))
-            .toThrow(/myapi crm contacts list/);
-    });
-});
-describe('warnIfTruncated', () => {
-    let infoSpy;
-    beforeEach(() => { infoSpy = vi.spyOn(output, 'info').mockImplementation(() => { }); });
-    afterEach(() => infoSpy.mockRestore());
-    it('warns when the page came back exactly full', () => {
-        warnIfTruncated(10, { limit: 10 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet when the page came back short — that answer IS complete', () => {
-        warnIfTruncated(3, { limit: 10 });
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('uses the server default of 50 when no --limit was given', () => {
-        warnIfTruncated(50, {});
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet below the default limit', () => {
-        warnIfTruncated(49, {});
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('says a record, not "1 records"', () => {
-        warnIfTruncated(1, { limit: 1 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('exactly 1 record came back'));
-    });
-});
-describe('countLine', () => {
-    // The point of this helper is what it does NOT print: `N of total`, where
-    // total is the page size, reads as "you have everything".
-    it('pluralizes', () => {
-        expect(countLine(1, 'contact', 'contacts')).toBe('1 contact');
-        expect(countLine(3, 'contact', 'contacts')).toBe('3 contacts');
-        expect(countLine(0, 'company', 'companies')).toBe('0 companies');
-    });
-    it('never mentions a total', () => {
-        expect(countLine(5, 'contact', 'contacts')).not.toMatch(/of/);
+// The line this replaces said "N of <total>" where total was the page size, so
+// it read as a completeness claim on a truncated result. The backend fixed
+// `total` and added `has_more` on 2026-07-28; these tests pin the rendering to
+// the fixed contract and, in particular, to preferring `has_more` over any
+// arithmetic against `total`.
+import { describe, it, expect } from 'vitest';
+import { pageLine } from './pagination.js';
+describe('pageLine', () => {
+    it('states the count alone when the page IS everything', () => {
+        expect(pageLine(3, 3, false, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('shows the true match count when the page is a subset', () => {
+        expect(pageLine(3, 128, false, 'contact', 'contacts')).toBe('3 of 128 contacts');
+    });
+    it('says more is available when has_more is set', () => {
+        expect(pageLine(50, 128, true, 'contact', 'contacts'))
+            .toBe('50 of 128 contacts (more available — raise --limit or pass --offset)');
+    });
+    // has_more is authoritative. Inferring truncation by comparing lengths is
+    // what silently agreed with the old, wrong `total`.
+    it('trusts has_more even when the numbers look complete', () => {
+        expect(pageLine(3, 3, true, 'contact', 'contacts')).toMatch(/more available/);
+    });
+    it('omits the total when the API did not send one', () => {
+        expect(pageLine(3, undefined, undefined, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('pluralizes both nouns', () => {
+        expect(pageLine(1, 1, false, 'contact', 'contacts')).toBe('1 contact');
+        expect(pageLine(1, 9, false, 'company', 'companies')).toBe('1 of 9 companies');
+        expect(pageLine(0, 0, false, 'company', 'companies')).toBe('0 companies');
+    });
+    it('never claims a total it was not given', () => {
+        expect(pageLine(5, undefined, true, 'contact', 'contacts')).not.toMatch(/\bof\b/);
     });
 });

package/dist/commands/doctor-findings.test.js

@@ -6,7 +6,7 @@
 // OBSERVATION ("it answered 401", "the platform's counter said zero"). Each
 // test below pins the observation and refuses the conclusion.
 import { describe, it, expect } from 'vitest';
-import { classifyReachability, _setupSection } from './doctor.js';
+import { classifyReachability, _setupSection, _rewriteQuietWebhook } from './doctor.js';
 const ENTITY = { slot: 'container', name: 'skout-engine-prod' };
 describe('classifyReachability', () => {
     // The finding: two containers behind an auth boundary were reported as
@@ -98,3 +98,59 @@ describe('setup gaps are confirmed before they become instructions', () => {
         expect(setupMessages(r, { domainCount: 0 })[0].hint).toMatch(/domain register/);
     });
 });
+// ── quiet webhooks ──────────────────────────────────────────────────────────
+const QUIET = {
+    id: 'webhook_quiet/332660b11afb07c8',
+    severity: 'warn',
+    scope: 'webhook/7a56765f164d2db5',
+    entity: { slot: 'webhook', id: '0737f583', name: 'funnel-skout-app' },
+    category: 'activity',
+    message: 'no deliveries in the last 30 days',
+    hint: 'confirm the form/page is reachable and wired to this endpoint',
+};
+describe('quiet-webhook advice is replaced by delivery history', () => {
+    // The reported near-miss: this hint reads as a cleanup instruction, and the
+    // endpoint it fired on was the ingest path for a live marketing site.
+    it('never tells you to go check whether the page is wired up', () => {
+        for (const lifetime of [{ count: 0 }, { count: 3, mostRecent: '2026-07-20T10:00:00Z' }]) {
+            const out = _rewriteQuietWebhook(QUIET, lifetime);
+            expect(out.hint ?? '').not.toMatch(/confirm the form/);
+        }
+    });
+    // "No submissions in 30 days" is the expected state for anything
+    // pre-launch, so it must not imply abandonment.
+    it('reports zero lifetime deliveries as a plain observation, with no hint', () => {
+        const out = _rewriteQuietWebhook(QUIET, { count: 0 });
+        expect(out.message).toBe('no submissions since created');
+        expect(out.hint).toBeUndefined();
+    });
+    it('says quiet-not-unused when deliveries exist', () => {
+        const out = _rewriteQuietWebhook(QUIET, { count: 3, mostRecent: '2026-07-20T10:00:00Z' });
+        expect(out.message).toMatch(/3 received in total, most recent 2026-07-20/);
+        expect(out.hint).toMatch(/quiet, not unused/);
+    });
+    it('omits the date when the API did not supply one', () => {
+        const out = _rewriteQuietWebhook(QUIET, { count: 1 });
+        expect(out.message).toMatch(/1 received in total$/);
+    });
+    // Never invent a cleanup recommendation. The ask was to stop implying
+    // cleanup on a signal that cannot support it — adding a confident orphan
+    // verdict would repeat the mistake in the other direction.
+    it('never suggests deleting anything', () => {
+        for (const lifetime of [{ count: 0 }, { count: 5 }, undefined]) {
+            const out = _rewriteQuietWebhook(QUIET, lifetime);
+            expect(`${out.message} ${out.hint ?? ''}`).not.toMatch(/delet|remov|clean/i);
+        }
+    });
+    // A failed lookup is not evidence, so the backend's finding stands rather
+    // than being softened on no information.
+    it('leaves the finding untouched when the count could not be fetched', () => {
+        expect(_rewriteQuietWebhook(QUIET, undefined)).toEqual(QUIET);
+    });
+    it('preserves id, severity and entity so dedup and rendering still work', () => {
+        const out = _rewriteQuietWebhook(QUIET, { count: 2 });
+        expect(out.id).toBe(QUIET.id);
+        expect(out.severity).toBe('warn');
+        expect(out.entity).toEqual(QUIET.entity);
+    });
+});

package/dist/commands/doctor.d.ts

@@ -18,6 +18,10 @@ export interface SetupContext {
     domainCount?: number;
 }
 export declare function _setupSection(report: sdkHq.DoctorReport, ctx?: SetupContext): sdkHq.DoctorSection | null;
+export declare function _rewriteQuietWebhook(issue: sdkHq.DoctorIssue, lifetime: {
+    count: number;
+    mostRecent?: string;
+} | undefined): sdkHq.DoctorIssue;
 export declare function classifyReachability(probe: {
     status: number | null;
     error?: string;

package/dist/commands/doctor.js

@@ -17,7 +17,7 @@
 // interleave with the backend's findings.
 import { promises as dns } from 'node:dns';
 import { createHash } from 'node:crypto';
-import { hq as sdkHq, container as sdkContainer, funnel as sdkFunnel, domain as sdkDomain, email as sdkEmail } from '@myapihq/sdk';
+import { hq as sdkHq, container as sdkContainer, funnel as sdkFunnel, domain as sdkDomain, email as sdkEmail, webhook as sdkWebhook } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { info, error, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
@@ -29,6 +29,8 @@ export const EXPOSES = [
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
     // Best-effort read for the setup-gap mailing_address check (CAN-SPAM).
     'GET /hq/account/mailing-address',
+    // Lifetime delivery counts, to replace the 30-day 'quiet webhook' advice.
+    'GET /webhook/orgs/{org_id}/deliveries',
 ];
 export const SCHEMA = {};
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
@@ -270,7 +272,7 @@ async function fetchStatus(url) {
 async function httpProbeSection(apiKey, orgId) {
     const targets = [];
     // Containers: probe the bound custom domain when set (what customers hit),
-    // else the Cloud Run URL. An undeployed container has neither — skip it.
+    // else the runtime-assigned URL. An undeployed container has neither.
     try {
         const containers = await sdkContainer.listContainers(apiKey, orgId);
         for (const c of containers) {
@@ -336,6 +338,85 @@ async function httpProbeSection(apiKey, orgId) {
         issues,
     };
 }
+// The backend flags a webhook that has had "no deliveries in the last 30 days"
+// and hints "confirm the form/page is reachable and wired to this endpoint".
+//
+// That hint reads as a cleanup instruction, and a user came within one command
+// of deleting the endpoint behind their live marketing site because of it. The
+// 30-day window cannot support the implication: a pre-launch product has no
+// traffic by definition, which is the normal state for most forms on a
+// platform aimed at people building something new. The signal cannot tell
+// "abandoned" from "not launched".
+//
+// It is also not correlated with the thing it implies. In the reported org the
+// endpoint holding three real waitlist signups was NOT flagged, while the one
+// serving the live landing page was.
+//
+// Lifetime deliveries can tell those apart, and we can count them. So the
+// window stays as the observation, and the count replaces the advice:
+//
+//   received > 0  → quiet, not abandoned. Never imply cleanup.
+//   received = 0  → "no submissions since created" — the expected pre-launch
+//                   state. Still no directive.
+//
+// Deliberately absent: any suggestion to DELETE. The ask was to stop implying
+// cleanup on a signal that cannot support it, and inventing a
+// confident-sounding orphan verdict would repeat the mistake in the other
+// direction. State what is true and let the operator decide.
+export function _rewriteQuietWebhook(issue, lifetime) {
+    // No evidence gathered — leave the backend's finding untouched rather than
+    // soften something we did not check.
+    if (!lifetime)
+        return issue;
+    if (lifetime.count > 0) {
+        const when = lifetime.mostRecent ? `, most recent ${lifetime.mostRecent.slice(0, 10)}` : '';
+        return {
+            ...issue,
+            message: `no deliveries in the last 30 days — ${lifetime.count} received in total${when}`,
+            hint: 'quiet, not unused — this endpoint has received real submissions',
+        };
+    }
+    return {
+        ...issue,
+        message: 'no submissions since created',
+        hint: undefined,
+    };
+}
+// Walks the report's `webhook_quiet` findings and replaces the directive with
+// what the delivery history actually shows. Best-effort: any failure leaves
+// the backend's original finding in place.
+async function enrichQuietWebhooks(apiKey, orgId, report) {
+    const quiet = [];
+    for (const s of report.sections) {
+        for (const i of s.issues) {
+            if (i.id?.startsWith('webhook_quiet/') && i.entity?.id)
+                quiet.push(i);
+        }
+    }
+    if (quiet.length === 0)
+        return;
+    const byEndpoint = new Map();
+    await Promise.all([...new Set(quiet.map(i => i.entity.id))].map(async (endpointId) => {
+        try {
+            const page = await sdkWebhook.listDeliveries(apiKey, orgId, { endpointId, limit: 100 });
+            const items = page.deliveries ?? [];
+            byEndpoint.set(endpointId, {
+                // `has_more` means we counted a floor, not a total — which is fine,
+                // because every use of this number only needs "more than zero".
+                count: items.length,
+                mostRecent: items[0]?.received_at,
+            });
+        }
+        catch {
+            byEndpoint.set(endpointId, undefined);
+        }
+    }));
+    for (const s of report.sections) {
+        s.issues = s.issues.map(i => (i.id?.startsWith('webhook_quiet/') && i.entity?.id)
+            ? _rewriteQuietWebhook(i, byEndpoint.get(i.entity.id))
+            : i);
+    }
+}
 // What an HTTP status actually tells you about reachability.
 //
 // This check used to treat any status >= 400 as "unreachable" with the hint
@@ -460,6 +541,7 @@ export async function run(_subcommand, _args, flags) {
     const setup = _setupSection(report, { mailingAddress, mailboxCount, domainCount });
     if (setup)
         report.sections.push(setup);
+    await enrichQuietWebhooks(apiKey, orgId, report);
     const localSection = await dnsProbeSection(report);
     if (localSection)
         report.sections.push(localSection);

package/dist/commands/domain.js

@@ -315,7 +315,7 @@ function renderStatus(res) {
         info(`Email:   ${res.email_infra}${where}`);
     }
     if (res.status === 'pending_ns_change') {
-        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks Cloudflare.');
+        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks the DNS provider.');
     }
     if (res.status === 'infra_error' && res.error_detail) {
         info(`  Failed step:  ${res.error_detail.failed_step}`);
@@ -524,7 +524,7 @@ Name normalization:
   --name=""                      Apex (empty == @)
 
 Notes:
-  --ttl defaults to 1 (Cloudflare "automatic"). Explicit range: [60, 86400].
+  --ttl defaults to 1 ("automatic"). Explicit range: [60, 86400].
   --priority is required for MX (typical: 10).
   --proxied (CF "orange-cloud") applies to A/AAAA/CNAME only.
 
@@ -596,17 +596,17 @@ DNS propagation takes a few minutes — track it with: myapi domain status <doma
     'import': `myapi domain import <domain> [--org <id>] [--json]
 
 Bring your own domain (BYOD). Snapshots existing DNS records via a best-effort
-public probe and creates a Cloudflare zone for the domain. Returns the
+public probe and creates a DNS zone for the domain. Returns the
 nameservers you need to set at your current registrar.
 
 No registrar credentials needed — works with any registrar (Namecheap, GoDaddy,
-Cloudflare Registrar, etc.).
+the registrar of record, etc.).
 
 After running:
   1. Verify the preserved-records table covers your MX/SPF/DKIM/DMARC etc.
   2. At your current registrar, change the nameservers to the values returned.
   3. Wait for propagation. Use "myapi domain status <domain> --watch" to track
-     activation — the backend live-checks Cloudflare each time you poll.`,
+     activation — the backend live-checks the DNS provider each poll.`,
     'renew': `myapi domain renew <domain> [--yes] [--org <id>]
 
 Renews a registered domain for one more registration period (typically 1 year).
@@ -634,7 +634,7 @@ binding with: myapi domain list --filter all`,
 
   --watch   Poll until the domain reaches a terminal state (active / failed /
             expired). Backoff: 10s × 30 then 30s × 60 (~35 min budget). Useful
-            after "myapi domain import" — each poll also live-checks Cloudflare,
+            after "myapi domain import" — each poll also live-checks DNS,
             so polling drives the flip from pending_ns_change → provisioning.`,
     'settings': `myapi domain settings <domain> [--org <id>]
 

package/dist/commands/fn.js

@@ -23,7 +23,7 @@ export const SCHEMA = {
     set: 'string',
 };
 // Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
-// JS bundle to Cloudflare Workers, list runs, set env secrets).
+// JS bundle to the edge runtime, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
 // runs the same regex as defence in depth.
@@ -142,7 +142,7 @@ export async function del(id, flags) {
     success(`Deleted function ${id} (org ${orgId})`);
 }
 // deploy uploads a single-file JS bundle. The backend wraps it with the
-// MYAPI shim and ships it to Cloudflare Workers. The scoped API key is
+// MYAPI shim and ships it to the edge runtime. The scoped API key is
 // rotated on every deploy — the fresh value is shown once here.
 export async function deploy(id, bundlePath, flags) {
     const config = requireConfig();
@@ -226,7 +226,7 @@ export function _parseSetPairs(raw) {
     }
     return env;
 }
-// env sets Worker Secret(s) (Stripe key, etc.) on a deployed function.
+// env sets encrypted secret(s) (Stripe key, etc.) on a deployed function.
 // Single form:  myapi fn env <id> <name> <value>
 // Bulk form:    myapi fn env <id> --set K=V[,K2=V2 ...]
 export async function setEnv(id, name, value, flags) {
@@ -243,7 +243,7 @@ export async function setEnv(id, name, value, flags) {
             error('No secrets given. Usage: myapi fn env <id> --set KEY=VALUE');
         const result = await sdkFn.setFunctionEnvBulk(config.api_key, orgId, id, env);
         success(`Set ${result.set} secret${result.set === 1 ? '' : 's'} on function ${id}`);
-        info('Values are encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+        info('Values are encrypted at rest and never stored or echoed by MyAPI.');
         return;
     }
     // Single-secret path (original form).
@@ -253,7 +253,7 @@ export async function setEnv(id, name, value, flags) {
         error('Missing secret value.\nUsage: myapi fn env <id> <name> <value>');
     await sdkFn.setFunctionEnv(config.api_key, orgId, id, name, value);
     success(`Set ${name} on function ${id}`);
-    info('The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+    info('The value is encrypted at rest and never stored or echoed by MyAPI.');
 }
 // runs lists recent invocation records, most recent first.
 export async function runs(id, flags) {
@@ -304,7 +304,7 @@ other MyAPI slots with its own permissions (scopes=slot_call; rejected at
     'deploy': `myapi fn deploy <id> <bundle.js> [--org <id>] [--json]
 
 Uploads a single-file JavaScript bundle (≤4MB) to the edge runtime. The
-backend wraps it with the MYAPI shim and ships it to Cloudflare Workers.
+backend wraps it with the MYAPI shim and ships it to the edge runtime.
 
 The scoped API key is rotated on every deploy — the fresh value is printed
 once. After deploy the function has a live invocation URL.
@@ -314,7 +314,7 @@ Example:
     'env': `myapi fn env <id> <name> <value> [--org <id>]
        myapi fn env <id> --set KEY=VALUE[,KEY2=VALUE2 ...] [--org <id>]
 
-Sets one or more secrets (Stripe key, API token, ...) as Cloudflare Worker
+Sets one or more secrets (Stripe key, API token, ...) as encrypted edge
 Secrets on a deployed function. Values are encrypted at rest and never stored
 in MyAPI or echoed back. The function must already be deployed.
 
@@ -337,7 +337,7 @@ Subcommands:
   create               Register a function and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <file>   Upload a JS bundle and go live
-  env <id> <k> <v>     Set a Worker Secret (or --set K=V for bulk) on a deployed function
+  env <id> <k> <v>     Set an encrypted secret (or --set K=V for bulk) on a deployed function
   get <id>             Inspect a function
   list                 List functions in your org
   runs <id>            List recent invocation records

package/dist/commands/funnel.js

@@ -173,6 +173,39 @@ export async function del(id, flags) {
     await sdkFunnel.deleteFunnel(config.api_key, orgId, id);
     success(`Funnel ${id} deleted (org ${orgId})`);
 }
+// Returns the funnel's own URL when it answers with a non-empty body, else
+// null. Used only to contradict an empty page inventory, so every failure
+// mode — no URL, network error, timeout, 404, empty body — resolves to null
+// and lets the normal "no pages" message stand. A probe that cannot reach the
+// funnel is not evidence that the funnel is serving.
+async function probeFunnelOrigin(apiKey, orgId, funnelId) {
+    let url;
+    try {
+        const funnels = await sdkFunnel.listFunnels(apiKey, orgId);
+        const f = funnels.find(x => x.id === funnelId);
+        url = f?.domain_url || f?.subdomain_url;
+    }
+    catch {
+        return null;
+    }
+    if (!url)
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 8000);
+    try {
+        const res = await fetch(url, { signal: controller.signal, redirect: 'follow' });
+        if (!res.ok)
+            return null;
+        const body = await res.text();
+        return body.trim().length > 0 ? url : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 // List the pages currently published to a funnel. Resolves the funnel id
 // from positional arg, --funnel flag, or the user's default funnel.
 export async function pages(funnelArg, flags) {
@@ -182,6 +215,31 @@ export async function pages(funnelArg, flags) {
     if (!funnelId)
         error('Missing funnel id. Pass it as a positional arg, --funnel <id>, or set: myapi config set-funnel <id>');
     const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    // An empty inventory is not proof the funnel is empty. Verified 2026-07-28:
+    // a funnel answering 200 with real content on both its subdomain and a bound
+    // custom domain reported `{"pages":[]}`. Someone auditing what is deployed
+    // reads "No pages published" as "safe to remove", and that is how a live
+    // site gets deleted by a person being careful.
+    //
+    // So when the list is empty, ask the funnel itself before agreeing it is
+    // empty. Only on the empty path — the common case costs nothing extra.
+    //
+    // This runs BEFORE the --json branch on purpose. An agent is more likely to
+    // use --json than a human is, and handing it `[]` with exit 0 is precisely
+    // the silent wrong answer. The JSON shape stays an array so existing parsers
+    // keep working; the contradiction goes to stderr and the exit code turns
+    // non-zero, so anything checking either one is protected.
+    const serving = list.length === 0
+        ? await probeFunnelOrigin(config.api_key, orgId, funnelId)
+        : null;
+    if (serving) {
+        if (flags.json)
+            printJson(list);
+        error(`Inventory reports no pages, but ${serving} is serving content right now.\n\n` +
+            'This is a reporting bug, not an empty funnel. Do NOT delete this funnel on the\n' +
+            'strength of an empty page list — confirm with curl first.');
+        return;
+    }
     if (flags.json) {
         printJson(list);
         return;

package/dist/errors.js

@@ -39,8 +39,23 @@ export const ERROR_MESSAGES = {
     MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
     INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
     INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
-    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
-    CF_API_ERROR: 'Cloudflare API error.',
+    RECORD_LIMIT_EXCEEDED: 'Per-zone DNS record limit reached.',
+    // The DNS provider's codes were renamed on 2026-07-28 (CF_* → DNS_*/EDGE_*)
+    // because they named the vendor. Both spellings are handled: the rename ships
+    // on a backend deploy we do not control the timing of, and a CLI that only
+    // knows the new names would print a bare code for anyone on the old build.
+    // The old five can go once that deploy is everywhere.
+    DNS_UNAVAILABLE: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    DNS_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    DNS_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    EDGE_SUBDOMAIN_UNAVAILABLE: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_OUR_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
+    // Superseded spellings, kept so an older backend still gets a readable message.
+    CF_API_ERROR: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    CF_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    CF_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    CF_WORKERS_SUBDOMAIN: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_CF_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
@@ -54,9 +69,10 @@ export const ERROR_MESSAGES = {
 };
 export function friendlyError(err) {
     const body = err.body ?? {};
-    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
-    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
-    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
+    // The provider's own message is already self-describing, so use it verbatim
+    // (with its status if present) instead of doubling up. Matches both the old
+    // and new code spellings for the duration of the rename.
+    if ((err.code === 'DNS_UNAVAILABLE' || err.code === 'CF_API_ERROR') && typeof body.cf_message === 'string') {
         return typeof body.cf_status === 'number'
             ? `${body.cf_message} (HTTP ${body.cf_status})`
             : body.cf_message;

package/dist/sdk-container.test.js

@@ -144,13 +144,18 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 9 container endpoints', () => {
+    it('covers the 11 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers/{id}',
             'DELETE /container/orgs/{org_id}/containers/{id}',
             'POST /container/orgs/{org_id}/containers/{id}/deploy',
+            // Added 2026-07-28. Promote and rollback are ONE endpoint: naming a
+            // revision promotes it, omitting one rolls back to the previous ready
+            // revision. Modelled as a single operation so the two cannot drift.
+            'GET /container/orgs/{org_id}/containers/{id}/revisions',
+            'POST /container/orgs/{org_id}/containers/{id}/promote',
             'GET /container/orgs/{org_id}/containers/{id}/logs',
             'POST /container/orgs/{org_id}/containers/{id}/domain',
             'DELETE /container/orgs/{org_id}/containers/{id}/domain',
@@ -193,3 +198,55 @@ describe('container custom domain', () => {
         expect(init.method).toBe('DELETE');
     });
 });
+describe('container deploy safety — promote and revisions', () => {
+    // `promote` defaults to true server-side, so the historical call must stay
+    // byte-identical. Sending promote:true explicitly would be a behaviour
+    // change dressed as a no-op.
+    it('sends no promote field when promoting normally', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1');
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1' });
+    });
+    it('sends promote:false only when explicitly withheld', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k', promoted: false }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { promote: false });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1', promote: false });
+    });
+    it('passes a smoke check through unchanged', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { smoke: { path: '/', contains: 'assets/' } });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).smoke).toEqual({ path: '/', contains: 'assets/' });
+    });
+    it('unwraps the revisions envelope', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revisions: [
+                { revision: 'r2', ready: true, serving: true, traffic_percent: 100, created_at: 't2' },
+                { revision: 'r1', ready: true, serving: false, traffic_percent: 0, created_at: 't1' },
+            ] }));
+        const revs = await container.listRevisions(API_KEY, ORG_ID, C_ID);
+        expect(revs).toHaveLength(2);
+        expect(revs[0].traffic_percent).toBe(100);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+    });
+    it('returns an empty list rather than undefined when there are no revisions', async () => {
+        fetchMock.mockResolvedValueOnce(ok({}));
+        expect(await container.listRevisions(API_KEY, ORG_ID, C_ID)).toEqual([]);
+    });
+    it('names the revision when promoting', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r2' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r2');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/containers/${C_ID}/promote`);
+        expect(JSON.parse(init.body)).toEqual({ revision: 'r2' });
+    });
+    // Omitting the revision is the rollback path — same endpoint, empty body.
+    it('sends an empty body to roll back', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r1' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('surfaces REVISION_NOT_READY without implying traffic moved', async () => {
+        fetchMock.mockResolvedValueOnce(fail('REVISION_NOT_READY', 'traffic was NOT moved', 409));
+        await expect(container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r9'))
+            .rejects.toMatchObject({ code: 'REVISION_NOT_READY' });
+    });
+});