@myapihq/cli 2.6.2 → 2.7.0

package/dist/commands/container-deploy-safety.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/container-deploy-safety.test.js

@@ -0,0 +1,60 @@
+// The deploy-safety surface: --smoke parsing, and the rules around
+// --no-promote.
+//
+// Context: a user shipped a build whose frontend was a placeholder. It bound
+// its port and answered every request with 200, so the platform called the
+// deploy healthy and sent it 100% of traffic. Fifteen minutes of dead
+// production followed, with no way back.
+//
+// The one assertion that would have caught it is content, not status —
+// "returns 200" was true of the broken build. That is why a smoke check with
+// no `contains` and no `status` is refused rather than accepted as a no-op.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { _parseSmoke } from './container.js';
+import * as output from '../output.js';
+let errSpy;
+beforeEach(() => {
+    errSpy = vi.spyOn(output, 'error').mockImplementation(((m) => { throw new Error(m); }));
+});
+afterEach(() => errSpy.mockRestore());
+describe('_parseSmoke', () => {
+    it('parses the shape the reporting user proposed', () => {
+        expect(_parseSmoke('GET / contains assets/')).toEqual({
+            method: 'GET', path: '/', contains: 'assets/',
+        });
+    });
+    it('parses a status assertion', () => {
+        expect(_parseSmoke('GET /livez status 200')).toEqual({
+            method: 'GET', path: '/livez', status: 200,
+        });
+    });
+    it('parses both assertions together', () => {
+        const s = _parseSmoke('HEAD /health status 204 contains ok');
+        expect(s).toEqual({ method: 'HEAD', path: '/health', status: 204, contains: 'ok' });
+    });
+    it('defaults method and path when only an assertion is given', () => {
+        expect(_parseSmoke('contains assets/')).toEqual({ contains: 'assets/' });
+    });
+    it('strips quotes around the contains value', () => {
+        expect(_parseSmoke("GET / contains 'assets/'").contains).toBe('assets/');
+        expect(_parseSmoke('GET / contains "assets/"').contains).toBe('assets/');
+    });
+    it('keeps spaces inside the contains value', () => {
+        expect(_parseSmoke('GET / contains <div id="app">').contains).toBe('<div id="app">');
+    });
+    // The whole point. A check that asserts nothing passes on the placeholder
+    // page it exists to catch, which is worse than no check because it reads as
+    // verification.
+    it('REFUSES a check that asserts nothing', () => {
+        expect(() => _parseSmoke('GET /')).toThrow(/asserts nothing/);
+        expect(() => _parseSmoke('/')).toThrow(/asserts nothing/);
+        expect(() => _parseSmoke('')).toThrow(/asserts nothing/);
+    });
+    it('explains why, rather than just rejecting', () => {
+        expect(() => _parseSmoke('GET /')).toThrow(/placeholder/);
+    });
+    it('is case-insensitive on the keywords', () => {
+        const s = _parseSmoke('get / CONTAINS assets/');
+        expect(s.contains).toBe('assets/');
+    });
+});

package/dist/commands/container.d.ts

@@ -1,3 +1,4 @@
+import { container as sdkContainer } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
@@ -13,6 +14,9 @@ export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function _isTarball(p: string): boolean;
 export declare function deploy(id: string, image: string, flags: Flags): Promise<void>;
+export declare function _parseSmoke(raw: string): sdkContainer.SmokeCheck;
+export declare function revisions(id: string, flags: Flags): Promise<void>;
+export declare function promote(id: string, revision: string | undefined, flags: Flags): Promise<void>;
 export declare function logs(id: string, flags: Flags): Promise<void>;
 export declare function domain(id: string, domainArg: string | undefined, flags: Flags): Promise<void>;
 export declare function buildLogs(id: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -13,6 +13,8 @@ export const EXPOSES = [
     'DELETE /container/orgs/{org_id}/containers/{id}',
     'POST /container/orgs/{org_id}/containers/{id}/deploy',
     'GET /container/orgs/{org_id}/containers/{id}/logs',
+    'GET /container/orgs/{org_id}/containers/{id}/revisions',
+    'POST /container/orgs/{org_id}/containers/{id}/promote',
     'POST /container/orgs/{org_id}/containers/{id}/domain',
     'DELETE /container/orgs/{org_id}/containers/{id}/domain',
 ];
@@ -28,6 +30,9 @@ export const SCHEMA = {
     env: 'string',
     tail: 'number',
     scope: 'string',
+    'no-promote': 'boolean',
+    'health-check': 'string',
+    smoke: 'string',
     remove: 'boolean',
     source: 'string',
     image: 'string',
@@ -106,6 +111,17 @@ export async function create(nameArg, flags) {
         payload.max_instances = flags['max-instances'];
     if (typeof flags.port === 'number')
         payload.port = flags.port;
+    if (typeof flags['health-check'] === 'string') {
+        const hc = flags['health-check'];
+        // The API refuses /healthz, but say so here rather than round-tripping:
+        // the reason is specific and worth stating where the user typed it.
+        if (/^\/?healthz\/?$/i.test(hc)) {
+            error('The runtime intercepts /healthz, so a probe against it never reaches your container —\nit would report healthy no matter what your code does. Use /livez, or any other path.');
+        }
+        if (!hc.startsWith('/'))
+            error(`--health-check must be a path starting with "/" — got "${hc}".`);
+        payload.health_check = hc;
+    }
     if (typeof flags.env === 'string') {
         const env = _parseEnv(flags.env);
         if (typeof env === 'string')
@@ -198,7 +214,7 @@ async function tarDirectory(dir) {
     return res.stdout;
 }
 // deploy ships either a pre-built image (--image / positional ref, synchronous)
-// or a source build context (--source <dir-or-tar>, asynchronous Cloud Build).
+// or a source build context (--source <dir-or-tar>, built server-side, async).
 // The scoped API key is rotated on every (image) deploy and shown once.
 export async function deploy(id, image, flags) {
     const config = requireConfig();
@@ -242,7 +258,7 @@ export async function deploy(id, image, flags) {
         }
         // Async: poll the container until it leaves the building state.
         if (start.status === 'building') {
-            info(`Build started (revision ${start.revision_id}). Building from source via Cloud Build…`);
+            info(`Build started (revision ${start.revision_id}). Building from source — typically ~4 minutes…`);
             const final = await pollJob({
                 label: 'Building & deploying',
                 check: () => sdkContainer.getContainer(config.api_key, orgId, id),
@@ -274,11 +290,30 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
+    const opts = {};
+    if (flags['no-promote'] === true)
+        opts.promote = false;
+    if (typeof flags.smoke === 'string')
+        opts.smoke = _parseSmoke(flags.smoke);
+    if (opts.promote === false && opts.smoke) {
+        error('--smoke already withholds traffic until the check passes, then promotes.\nUse one or the other: --smoke to verify-and-promote, --no-promote to hold the revision back.');
+    }
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, opts);
     if (flags.json) {
         printJson(result);
         return;
     }
+    // An unpromoted revision must NOT read like a completed deploy. A response
+    // that looked the same either way is how an agent concludes it has shipped
+    // when it has not — the original outage in miniature.
+    if (result.promoted === false) {
+        success(`Revision ${result.revision_id} built — NOT serving traffic`);
+        info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
+        info(`Still live:      ${result.url || '(previous revision)'}`);
+        info('');
+        banner(`When it looks right:  myapi container promote ${id} ${result.revision_id}`);
+        return;
+    }
     success(`Deployed container ${id} (revision ${result.revision_id})`);
     info(`Status:          ${result.status}`);
     info(`URL:             ${result.url}`);
@@ -286,6 +321,113 @@ export async function deploy(id, image, flags) {
     info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
 }
+// Parses `--smoke 'GET / contains assets/'` into the API's structured check.
+//
+// The shape is the one the reporting user proposed, because it reads like a
+// sentence under incident pressure. Grammar:
+//
+//   [METHOD] [PATH] [status N] [contains TEXT]
+//
+// Everything is optional except that something must be asserted — a smoke
+// check that asserts nothing would pass on the broken build it exists to
+// catch. Returns the object or calls error().
+export function _parseSmoke(raw) {
+    const out = {};
+    let rest = raw.trim();
+    const m = /^(GET|HEAD)\s+/i.exec(rest);
+    if (m) {
+        out.method = m[1].toUpperCase();
+        rest = rest.slice(m[0].length);
+    }
+    const p = /^(\/\S*)\s*/.exec(rest);
+    if (p) {
+        out.path = p[1];
+        rest = rest.slice(p[0].length);
+    }
+    const st = /\bstatus\s+(\d{3})\b/i.exec(rest);
+    if (st) {
+        out.status = Number(st[1]);
+        rest = rest.replace(st[0], ' ');
+    }
+    const c = /\bcontains\s+(.+)$/i.exec(rest.trim());
+    if (c)
+        out.contains = c[1].trim().replace(/^['"]|['"]$/g, '');
+    if (out.status === undefined && out.contains === undefined) {
+        error(`--smoke "${raw}" asserts nothing.\n\n` +
+            'Add `contains <text>` or `status <code>`. A check that only requests a path\n' +
+            'passes on any response, including the placeholder page this flag exists to catch.\n\n' +
+            "Example: --smoke 'GET / contains assets/'");
+    }
+    return out;
+}
+// revisions lists what the runtime actually has, newest first.
+export async function revisions(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container revisions <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container revisions <id>');
+    const [revs, container] = await Promise.all([
+        sdkContainer.listRevisions(config.api_key, orgId, id),
+        sdkContainer.getContainer(config.api_key, orgId, id).catch(() => undefined),
+    ]);
+    if (flags.json) {
+        printJson(revs);
+        return;
+    }
+    printTable(revs.map(r => ({
+        revision: r.revision,
+        ready: r.ready ? '✓' : '',
+        traffic: `${r.traffic_percent}%`,
+        serving: r.serving ? '✓' : '',
+        created: r.created_at ? formatDate(r.created_at) : '',
+    })), { flags, empty: 'No revisions — this container has never been deployed.' });
+    // Verified 2026-07-28 across every service container in two orgs: the API
+    // reports 0% traffic on every revision while the containers demonstrably
+    // serve. The backend's own note explains it — Traffic was never set on the
+    // service, so the runtime applies an implicit "latest takes 100%" that this
+    // endpoint cannot see. Containers deployed before that fix are all in this
+    // state.
+    //
+    // Say so rather than render a table that reads as "nothing is live".
+    if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
+        info('');
+        info('Note: every revision reports 0% traffic while this container is active and serving.');
+        info('That is a known reporting bug for containers deployed before 2026-07-28, not an outage.');
+        info('Rollback depends on this data, so it is unreliable here until the container is redeployed.');
+    }
+}
+// promote moves all traffic to one revision. Omitting the revision rolls back
+// to the previous ready one — the API models promote and rollback as a single
+// operation with a different target.
+export async function promote(id, revision, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container promote <id> <revision> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container promote <id> <revision>');
+    if (!revision) {
+        error('Missing revision.\nUsage: myapi container promote <id> <revision>\n\n' +
+            'List them with: myapi container revisions ' + id);
+    }
+    const res = await sdkContainer.promoteRevision(config.api_key, orgId, id, revision);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Traffic moved to ${revision}`);
+    if (res.message)
+        info(res.message);
+}
+// Not a command — guidance for a word that is not one. See the dispatch note.
+function rollbackGuidance(id) {
+    const ref = id || '<id>';
+    error('There is no `rollback` subcommand — rolling back is promoting an older revision.\n\n' +
+        `  myapi container revisions ${ref}          # find the last good revision\n` +
+        `  myapi container promote ${ref} <revision> # traffic moves in seconds\n\n` +
+        'Heads up: the platform currently reports 0% traffic on every revision of any\n' +
+        'container deployed before 2026-07-28, and its own roll-back-to-previous path\n' +
+        'returns a gateway error. Promoting a revision BY NAME works and is unaffected —\n' +
+        'use that. Reported upstream.');
+}
 // logs prints the container's recent runtime logs, newest first. By default
 // this is the container's own stdout/stderr; --scope all adds the platform
 // audit records that share the stream.
@@ -389,13 +531,38 @@ Two ways to deploy:
   image    Ship a pre-built image (positional ref or --image). Synchronous;
            the scoped API key is rotated and printed once.
   source   Upload a build context with --source <dir> (tarred locally) or a
-           pre-built --source <archive.tar.gz>. MyAPI builds it via Cloud
-           Build, then deploys. Asynchronous — the CLI polls until it's live.
+           pre-built --source <archive.tar.gz>. The context is
+           built server-side (typically ~4 minutes), then deployed.
+           Asynchronous — the CLI polls until it's live.
+
+Options:
+  --no-promote          Build the revision without giving it traffic. Test it at
+                        the returned URL, then: myapi container promote <id> <rev>
+  --smoke '<assertion>' Deploy, assert against the new revision, and promote it
+                        ONLY if the assertion holds. A failure leaves the
+                        previous revision serving.
+
+                        Grammar: [GET|HEAD] [/path] [status N] [contains TEXT]
+                        Assert on content, not just status — "returns 200" is
+                        true of a placeholder page too.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz`,
+  myapi container deploy <id> --source ./context.tar.gz
+  myapi container deploy <id> <image> --no-promote
+  myapi container deploy <id> <image> --smoke 'GET / contains assets/'`,
+    'revisions': `myapi container revisions <id> [--org <id>] [--json]
+
+Every revision the runtime currently holds, newest first, with the traffic
+each takes. Read from the runtime rather than our records, so a revision
+missing here genuinely no longer exists and cannot be promoted.`,
+    'promote': `myapi container promote <id> <revision> [--org <id>] [--json]
+
+Move all traffic to one revision. A traffic shift only — no build, no new
+revision — so it completes in seconds.
+
+List candidates with: myapi container revisions <id>`,
     'list': 'myapi container list [--org <id>] [--json]',
     'get': 'myapi container get <id> [--org <id>] [--json]',
     'logs': `myapi container logs <id> [--tail <n>] [--scope all] [--org <id>] [--json]
@@ -409,9 +576,9 @@ same stream and share the --tail budget, so raise --tail when you use it.`,
     'domain': `myapi container domain <id> <domain> [--org <id>] [--json]
        myapi container domain <id> --remove [--org <id>]
 
-Binds a custom domain to a deployed container, served over HTTPS via
-Cloudflare. The domain's MyAPI-managed parent domain must already be
-registered. --remove unbinds it.
+Binds a custom domain to a deployed container, served over HTTPS. The
+domain's MyAPI-managed parent domain must already be registered.
+--remove unbinds it.
 
 Example:
   myapi container domain <id> app.synthesisdaily.com`,
@@ -428,12 +595,16 @@ dependencies and long execution.
 Subcommands:
   build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
+                       (--health-check /livez to probe with HTTP, not a bare TCP connect)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
+                       (--no-promote to hold it back; --smoke to verify before promoting)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
+  promote <id> <rev>   Move all traffic to a revision (seconds, no rebuild)
+  revisions <id>       List revisions and the traffic each takes
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -453,8 +624,16 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'list': return list(flags);
         case 'get': return get(args[0], flags);
         case 'logs': return logs(args[0], flags);
+        case 'revisions': return revisions(args[0], flags);
+        case 'promote': return promote(args[0], args[1], flags);
         case 'domain': return domain(args[0], args[1], flags);
         case 'delete': return del(args[0], flags);
+        // `rollback` is the word people reach for during an incident, and it is
+        // NOT a verb here — the API models rollback as `promote` with no revision.
+        // A bare "unknown subcommand" would cost minutes at the worst possible
+        // moment, so say what to do instead, and be honest that the underlying
+        // call is currently broken rather than let someone discover that live.
+        case 'rollback': return rollbackGuidance(args[0]);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/crm/companies.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
+import { pageLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
@@ -36,6 +36,7 @@ function buildSearchFilter(flags) {
         domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderCompanies(res, flags) {
@@ -43,8 +44,7 @@ function renderCompanies(res, flags) {
         printJson(res);
         return;
     }
-    // NOT `N of res.total` — total is the page size, not the match count.
-    info(countLine(res.companies.length, 'company', 'companies'));
+    info(pageLine(res.companies.length, res.total, res.has_more, 'company', 'companies'));
     printTable(res.companies.map(c => ({
         id: c.id,
         domain: c.domain ?? '',
@@ -58,22 +58,17 @@ function renderCompanies(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies search [filters...] [--org <id>]');
-    rejectOffset(flags, 'myapi crm companies search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, buildSearchFilter(flags));
     renderCompanies(res, flags);
-    if (!flags.json)
-        warnIfTruncated(res.companies.length, flags);
 }
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies list [--limit N] [--org <id>]');
-    rejectOffset(flags, 'myapi crm companies list [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderCompanies(res, flags);
-    if (!flags.json)
-        warnIfTruncated(res.companies.length, flags);
 }
 async function create(domainArg, flags) {
     const config = requireConfig();
@@ -148,9 +143,9 @@ async function promote(domain, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm companies list [--limit N] [--org <id>] [--json]',
+    list: 'myapi crm companies list [--limit N] [--offset N] [--org <id>] [--json]',
     search: `myapi crm companies search [--stage <csv>] [--source <csv>] [--domain <d>]
-       [--include-deleted] [--limit N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage   cold, warm, qualified, customer, churned
   --source  goldfox, email, pixel, webhook, manual`,

package/dist/commands/crm/contacts.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
+import { pageLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
@@ -42,6 +42,7 @@ function buildSearchFilter(flags) {
         max_last_engagement_days: typeof flags['max-last-engagement-days'] === 'number' ? flags['max-last-engagement-days'] : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderContacts(res, flags) {
@@ -49,8 +50,7 @@ function renderContacts(res, flags) {
         printJson(res);
         return;
     }
-    // NOT `N of res.total` — total is the page size, not the match count.
-    info(countLine(res.contacts.length, 'contact', 'contacts'));
+    info(pageLine(res.contacts.length, res.total, res.has_more, 'contact', 'contacts'));
     printTable(res.contacts.map(c => ({
         id: c.id,
         email: c.email ?? '',
@@ -65,23 +65,18 @@ function renderContacts(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts search [filters...] [--org <id>]');
-    rejectOffset(flags, 'myapi crm contacts search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, buildSearchFilter(flags));
     renderContacts(res, flags);
-    if (!flags.json)
-        warnIfTruncated(res.contacts.length, flags);
 }
 // `list` is `search` with no filters — separate verb for discoverability.
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts list [--limit N] [--org <id>]');
-    rejectOffset(flags, 'myapi crm contacts list [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderContacts(res, flags);
-    if (!flags.json)
-        warnIfTruncated(res.contacts.length, flags);
 }
 async function create(emailArg, flags) {
     const config = requireConfig();
@@ -183,10 +178,10 @@ async function events(id, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm contacts list [--limit N] [--org <id>] [--json]',
+    list: 'myapi crm contacts list [--limit N] [--offset N] [--org <id>] [--json]',
     search: `myapi crm contacts search [--stage <csv>] [--source <csv>] [--email <e>]
        [--company-id <id>] [--min-last-engagement-days N] [--max-last-engagement-days N]
-       [--include-deleted] [--limit N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage     cold, warm, qualified, customer, churned
   --source    goldfox, email, pixel, webhook, manual

package/dist/commands/crm/pagination.d.ts

@@ -1,6 +1,3 @@
-import { type Flags } from '../../helpers.js';
 import type { Exposes } from '../../exposes.js';
 export declare const EXPOSES: Exposes;
-export declare function rejectOffset(flags: Flags, usage: string): void;
-export declare function warnIfTruncated(returned: number, flags: Flags): void;
-export declare function countLine(returned: number, singular: string, plural: string): string;
+export declare function pageLine(returned: number, total: number | undefined, hasMore: boolean | undefined, singular: string, plural: string): string;

package/dist/commands/crm/pagination.js

@@ -1,60 +1,32 @@
-// CRM search/list pagination — what the API actually does, verified against
-// production on 2026-07-27 (build c8b30009).
+// CRM search/list pagination.
 //
-// Two facts, both discovered by lint-request-fields.js flagging that the SDK
-// sends an `offset` the OpenAPI schema does not declare:
+// HISTORY, because it is short and the lesson outlived the bug. For one day
+// this file did the opposite of what it does now: it REFUSED `--offset`,
+// because the API accepted the parameter and silently ignored it, and `total`
+// was `len(rows)` rather than the match count. An agent asking for 100 of 500
+// contacts received 100 records and a `total` of 100 — a complete-looking
+// answer that was short by 400, with nothing in the response to say so.
 //
-//   1. `offset` is ACCEPTED AND IGNORED. Against an org with three contacts,
-//      {limit:1, offset:0}, {limit:1, offset:1} and {limit:1, offset:2} all
-//      return the same first contact. This holds for contacts and companies,
-//      on both the POST /search and GET /contacts paths. There is no cursor
-//      parameter either.
+// Fixed backend-side on 2026-07-28 and re-verified here against an org with
+// three contacts: offsets 0/1/2 at limit 1 return three different records,
+// `total` reads 3 throughout, and `has_more` goes true, true, false.
 //
-//   2. `total` is the SIZE OF THE PAGE, not the number of matches. With three
-//      contacts in the org: limit=1 → total=1, limit=2 → total=2, limit=3 →
-//      total=3, limit=10 → total=3.
-//
-// Together those make the result set silently lossy. An agent with 500
-// contacts running `--limit 100` receives 100 records and a `total` of 100,
-// and has no signal that 400 more exist. This is the worst shape a data bug
-// can take for an unattended caller: it looks like a complete answer.
-//
-// Filed upstream. Until it is fixed the CLI refuses `--offset` rather than
-// sending a parameter that does nothing, and never prints `total` as though
-// it were a match count.
-import { error, info } from '../../output.js';
+// So the guard is gone and this file is now just honest rendering. Prefer
+// `has_more` over arithmetic against `total`: it stays correct even if the
+// meaning of `total` moves again, which is exactly what went wrong before.
 // A helper, not a command: it calls nothing. Declared empty rather than
 // exempted, so the coverage gate's "every module states its surface" rule
 // stays absolute.
 export const EXPOSES = [];
-// Server-side default page size when no --limit is given. The API applies
-// this; we only need it to know whether a result may have been truncated.
-const DEFAULT_LIMIT = 50;
-// Rejects --offset outright. Silently dropping it would reproduce the bug we
-// are protecting against, and passing it through means duplicate pages.
-export function rejectOffset(flags, usage) {
-    if (flags.offset === undefined)
-        return;
-    error('The CRM API accepts --offset and ignores it, so every page would return the same records.\n' +
-        'Verified against production: with --limit 1, offsets 0, 1 and 2 all return the first match.\n\n' +
-        'There is no cursor parameter either, so the CRM has no working pagination today.\n' +
-        'Raise --limit to fetch more in one call, and narrow the result set with filters\n' +
-        '(--stage, --source, --company-id, --email) rather than paging through it.\n\n' +
-        `Usage: ${usage}`);
-}
-// A page that came back exactly full is indistinguishable from a truncated
-// one, and `total` cannot tell them apart. Say so, rather than letting the
-// caller assume the answer is complete.
-export function warnIfTruncated(returned, flags) {
-    const limit = typeof flags.limit === 'number' ? flags.limit : DEFAULT_LIMIT;
-    if (returned < limit)
-        return;
-    info(`Note: exactly ${returned} record${returned === 1 ? '' : 's'} came back, which is the page limit. ` +
-        'There may be more, and the API reports no match count and offers no way to fetch the next page. ' +
-        'Raise --limit or add filters.');
-}
-// The API returns `total`, but it equals the page size, so rendering "N of
-// total" states something false. Callers use this instead.
-export function countLine(returned, singular, plural) {
-    return `${returned} ${returned === 1 ? singular : plural}`;
+// "3 contacts" · "3 of 128 contacts" · "3 of 128 contacts (more available)".
+//
+// `total` is only rendered when the API supplied it, and the more-available
+// note comes from `has_more` rather than from comparing lengths — a comparison
+// is what silently agreed with a wrong `total` before.
+export function pageLine(returned, total, hasMore, singular, plural) {
+    const noun = returned === 1 ? singular : plural;
+    const head = (typeof total === 'number' && total !== returned)
+        ? `${returned} of ${total} ${total === 1 ? singular : plural}`
+        : `${returned} ${noun}`;
+    return hasMore ? `${head} (more available — raise --limit or pass --offset)` : head;
 }

package/dist/commands/crm/pagination.test.js

@@ -1,73 +1,37 @@
-// Regression cover for the CRM pagination guards.
+// Rendering for CRM result counts.
 //
-// The bug being fenced off: the API accepts `offset`, ignores it, and reports
-// `total` as the page size — so an agent paging a contact list re-read page
-// one forever and had no signal that anything was missing. Verified against
-// production 2026-07-27. These tests assert the CLI never silently accepts
-// that flag again, and never claims a result is complete when it cannot know.
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
-import * as output from '../../output.js';
-describe('rejectOffset', () => {
-    let errSpy;
-    beforeEach(() => {
-        // error() exits the process; make it throw so the test can catch it.
-        errSpy = vi.spyOn(output, 'error').mockImplementation(((msg) => {
-            throw new Error(msg);
-        }));
-    });
-    afterEach(() => errSpy.mockRestore());
-    it('passes through when --offset is absent', () => {
-        expect(() => rejectOffset({}, 'usage')).not.toThrow();
-    });
-    it('rejects --offset 0 — it is as broken as any other value', () => {
-        expect(() => rejectOffset({ offset: 0 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('rejects a non-zero --offset', () => {
-        expect(() => rejectOffset({ offset: 25 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('explains that no cursor exists either, so the user does not go looking', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'usage')).toThrow(/no cursor parameter/);
-    });
-    it('includes the usage line so the error is actionable', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'myapi crm contacts list [--limit N]'))
-            .toThrow(/myapi crm contacts list/);
-    });
-});
-describe('warnIfTruncated', () => {
-    let infoSpy;
-    beforeEach(() => { infoSpy = vi.spyOn(output, 'info').mockImplementation(() => { }); });
-    afterEach(() => infoSpy.mockRestore());
-    it('warns when the page came back exactly full', () => {
-        warnIfTruncated(10, { limit: 10 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet when the page came back short — that answer IS complete', () => {
-        warnIfTruncated(3, { limit: 10 });
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('uses the server default of 50 when no --limit was given', () => {
-        warnIfTruncated(50, {});
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet below the default limit', () => {
-        warnIfTruncated(49, {});
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('says a record, not "1 records"', () => {
-        warnIfTruncated(1, { limit: 1 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('exactly 1 record came back'));
-    });
-});
-describe('countLine', () => {
-    // The point of this helper is what it does NOT print: `N of total`, where
-    // total is the page size, reads as "you have everything".
-    it('pluralizes', () => {
-        expect(countLine(1, 'contact', 'contacts')).toBe('1 contact');
-        expect(countLine(3, 'contact', 'contacts')).toBe('3 contacts');
-        expect(countLine(0, 'company', 'companies')).toBe('0 companies');
-    });
-    it('never mentions a total', () => {
-        expect(countLine(5, 'contact', 'contacts')).not.toMatch(/of/);
+// The line this replaces said "N of <total>" where total was the page size, so
+// it read as a completeness claim on a truncated result. The backend fixed
+// `total` and added `has_more` on 2026-07-28; these tests pin the rendering to
+// the fixed contract and, in particular, to preferring `has_more` over any
+// arithmetic against `total`.
+import { describe, it, expect } from 'vitest';
+import { pageLine } from './pagination.js';
+describe('pageLine', () => {
+    it('states the count alone when the page IS everything', () => {
+        expect(pageLine(3, 3, false, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('shows the true match count when the page is a subset', () => {
+        expect(pageLine(3, 128, false, 'contact', 'contacts')).toBe('3 of 128 contacts');
+    });
+    it('says more is available when has_more is set', () => {
+        expect(pageLine(50, 128, true, 'contact', 'contacts'))
+            .toBe('50 of 128 contacts (more available — raise --limit or pass --offset)');
+    });
+    // has_more is authoritative. Inferring truncation by comparing lengths is
+    // what silently agreed with the old, wrong `total`.
+    it('trusts has_more even when the numbers look complete', () => {
+        expect(pageLine(3, 3, true, 'contact', 'contacts')).toMatch(/more available/);
+    });
+    it('omits the total when the API did not send one', () => {
+        expect(pageLine(3, undefined, undefined, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('pluralizes both nouns', () => {
+        expect(pageLine(1, 1, false, 'contact', 'contacts')).toBe('1 contact');
+        expect(pageLine(1, 9, false, 'company', 'companies')).toBe('1 of 9 companies');
+        expect(pageLine(0, 0, false, 'company', 'companies')).toBe('0 companies');
+    });
+    it('never claims a total it was not given', () => {
+        expect(pageLine(5, undefined, true, 'contact', 'contacts')).not.toMatch(/\bof\b/);
     });
 });

package/dist/commands/doctor.js

@@ -272,7 +272,7 @@ async function fetchStatus(url) {
 async function httpProbeSection(apiKey, orgId) {
     const targets = [];
     // Containers: probe the bound custom domain when set (what customers hit),
-    // else the Cloud Run URL. An undeployed container has neither — skip it.
+    // else the runtime-assigned URL. An undeployed container has neither.
     try {
         const containers = await sdkContainer.listContainers(apiKey, orgId);
         for (const c of containers) {

package/dist/commands/domain.js

@@ -315,7 +315,7 @@ function renderStatus(res) {
         info(`Email:   ${res.email_infra}${where}`);
     }
     if (res.status === 'pending_ns_change') {
-        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks Cloudflare.');
+        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks the DNS provider.');
     }
     if (res.status === 'infra_error' && res.error_detail) {
         info(`  Failed step:  ${res.error_detail.failed_step}`);
@@ -524,7 +524,7 @@ Name normalization:
   --name=""                      Apex (empty == @)
 
 Notes:
-  --ttl defaults to 1 (Cloudflare "automatic"). Explicit range: [60, 86400].
+  --ttl defaults to 1 ("automatic"). Explicit range: [60, 86400].
   --priority is required for MX (typical: 10).
   --proxied (CF "orange-cloud") applies to A/AAAA/CNAME only.
 
@@ -596,17 +596,17 @@ DNS propagation takes a few minutes — track it with: myapi domain status <doma
     'import': `myapi domain import <domain> [--org <id>] [--json]
 
 Bring your own domain (BYOD). Snapshots existing DNS records via a best-effort
-public probe and creates a Cloudflare zone for the domain. Returns the
+public probe and creates a DNS zone for the domain. Returns the
 nameservers you need to set at your current registrar.
 
 No registrar credentials needed — works with any registrar (Namecheap, GoDaddy,
-Cloudflare Registrar, etc.).
+the registrar of record, etc.).
 
 After running:
   1. Verify the preserved-records table covers your MX/SPF/DKIM/DMARC etc.
   2. At your current registrar, change the nameservers to the values returned.
   3. Wait for propagation. Use "myapi domain status <domain> --watch" to track
-     activation — the backend live-checks Cloudflare each time you poll.`,
+     activation — the backend live-checks the DNS provider each poll.`,
     'renew': `myapi domain renew <domain> [--yes] [--org <id>]
 
 Renews a registered domain for one more registration period (typically 1 year).
@@ -634,7 +634,7 @@ binding with: myapi domain list --filter all`,
 
   --watch   Poll until the domain reaches a terminal state (active / failed /
             expired). Backoff: 10s × 30 then 30s × 60 (~35 min budget). Useful
-            after "myapi domain import" — each poll also live-checks Cloudflare,
+            after "myapi domain import" — each poll also live-checks DNS,
             so polling drives the flip from pending_ns_change → provisioning.`,
     'settings': `myapi domain settings <domain> [--org <id>]
 

package/dist/commands/fn.js

@@ -23,7 +23,7 @@ export const SCHEMA = {
     set: 'string',
 };
 // Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
-// JS bundle to Cloudflare Workers, list runs, set env secrets).
+// JS bundle to the edge runtime, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
 // runs the same regex as defence in depth.
@@ -142,7 +142,7 @@ export async function del(id, flags) {
     success(`Deleted function ${id} (org ${orgId})`);
 }
 // deploy uploads a single-file JS bundle. The backend wraps it with the
-// MYAPI shim and ships it to Cloudflare Workers. The scoped API key is
+// MYAPI shim and ships it to the edge runtime. The scoped API key is
 // rotated on every deploy — the fresh value is shown once here.
 export async function deploy(id, bundlePath, flags) {
     const config = requireConfig();
@@ -226,7 +226,7 @@ export function _parseSetPairs(raw) {
     }
     return env;
 }
-// env sets Worker Secret(s) (Stripe key, etc.) on a deployed function.
+// env sets encrypted secret(s) (Stripe key, etc.) on a deployed function.
 // Single form:  myapi fn env <id> <name> <value>
 // Bulk form:    myapi fn env <id> --set K=V[,K2=V2 ...]
 export async function setEnv(id, name, value, flags) {
@@ -243,7 +243,7 @@ export async function setEnv(id, name, value, flags) {
             error('No secrets given. Usage: myapi fn env <id> --set KEY=VALUE');
         const result = await sdkFn.setFunctionEnvBulk(config.api_key, orgId, id, env);
         success(`Set ${result.set} secret${result.set === 1 ? '' : 's'} on function ${id}`);
-        info('Values are encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+        info('Values are encrypted at rest and never stored or echoed by MyAPI.');
         return;
     }
     // Single-secret path (original form).
@@ -253,7 +253,7 @@ export async function setEnv(id, name, value, flags) {
         error('Missing secret value.\nUsage: myapi fn env <id> <name> <value>');
     await sdkFn.setFunctionEnv(config.api_key, orgId, id, name, value);
     success(`Set ${name} on function ${id}`);
-    info('The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+    info('The value is encrypted at rest and never stored or echoed by MyAPI.');
 }
 // runs lists recent invocation records, most recent first.
 export async function runs(id, flags) {
@@ -304,7 +304,7 @@ other MyAPI slots with its own permissions (scopes=slot_call; rejected at
     'deploy': `myapi fn deploy <id> <bundle.js> [--org <id>] [--json]
 
 Uploads a single-file JavaScript bundle (≤4MB) to the edge runtime. The
-backend wraps it with the MYAPI shim and ships it to Cloudflare Workers.
+backend wraps it with the MYAPI shim and ships it to the edge runtime.
 
 The scoped API key is rotated on every deploy — the fresh value is printed
 once. After deploy the function has a live invocation URL.
@@ -314,7 +314,7 @@ Example:
     'env': `myapi fn env <id> <name> <value> [--org <id>]
        myapi fn env <id> --set KEY=VALUE[,KEY2=VALUE2 ...] [--org <id>]
 
-Sets one or more secrets (Stripe key, API token, ...) as Cloudflare Worker
+Sets one or more secrets (Stripe key, API token, ...) as encrypted edge
 Secrets on a deployed function. Values are encrypted at rest and never stored
 in MyAPI or echoed back. The function must already be deployed.
 
@@ -337,7 +337,7 @@ Subcommands:
   create               Register a function and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <file>   Upload a JS bundle and go live
-  env <id> <k> <v>     Set a Worker Secret (or --set K=V for bulk) on a deployed function
+  env <id> <k> <v>     Set an encrypted secret (or --set K=V for bulk) on a deployed function
   get <id>             Inspect a function
   list                 List functions in your org
   runs <id>            List recent invocation records

package/dist/errors.js

@@ -39,8 +39,23 @@ export const ERROR_MESSAGES = {
     MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
     INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
     INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
-    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
-    CF_API_ERROR: 'Cloudflare API error.',
+    RECORD_LIMIT_EXCEEDED: 'Per-zone DNS record limit reached.',
+    // The DNS provider's codes were renamed on 2026-07-28 (CF_* → DNS_*/EDGE_*)
+    // because they named the vendor. Both spellings are handled: the rename ships
+    // on a backend deploy we do not control the timing of, and a CLI that only
+    // knows the new names would print a bare code for anyone on the old build.
+    // The old five can go once that deploy is everywhere.
+    DNS_UNAVAILABLE: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    DNS_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    DNS_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    EDGE_SUBDOMAIN_UNAVAILABLE: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_OUR_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
+    // Superseded spellings, kept so an older backend still gets a readable message.
+    CF_API_ERROR: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    CF_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    CF_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    CF_WORKERS_SUBDOMAIN: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_CF_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
@@ -54,9 +69,10 @@ export const ERROR_MESSAGES = {
 };
 export function friendlyError(err) {
     const body = err.body ?? {};
-    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
-    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
-    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
+    // The provider's own message is already self-describing, so use it verbatim
+    // (with its status if present) instead of doubling up. Matches both the old
+    // and new code spellings for the duration of the rename.
+    if ((err.code === 'DNS_UNAVAILABLE' || err.code === 'CF_API_ERROR') && typeof body.cf_message === 'string') {
         return typeof body.cf_status === 'number'
             ? `${body.cf_message} (HTTP ${body.cf_status})`
             : body.cf_message;

package/dist/sdk-container.test.js

@@ -144,13 +144,18 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 9 container endpoints', () => {
+    it('covers the 11 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers/{id}',
             'DELETE /container/orgs/{org_id}/containers/{id}',
             'POST /container/orgs/{org_id}/containers/{id}/deploy',
+            // Added 2026-07-28. Promote and rollback are ONE endpoint: naming a
+            // revision promotes it, omitting one rolls back to the previous ready
+            // revision. Modelled as a single operation so the two cannot drift.
+            'GET /container/orgs/{org_id}/containers/{id}/revisions',
+            'POST /container/orgs/{org_id}/containers/{id}/promote',
             'GET /container/orgs/{org_id}/containers/{id}/logs',
             'POST /container/orgs/{org_id}/containers/{id}/domain',
             'DELETE /container/orgs/{org_id}/containers/{id}/domain',
@@ -193,3 +198,55 @@ describe('container custom domain', () => {
         expect(init.method).toBe('DELETE');
     });
 });
+describe('container deploy safety — promote and revisions', () => {
+    // `promote` defaults to true server-side, so the historical call must stay
+    // byte-identical. Sending promote:true explicitly would be a behaviour
+    // change dressed as a no-op.
+    it('sends no promote field when promoting normally', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1');
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1' });
+    });
+    it('sends promote:false only when explicitly withheld', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k', promoted: false }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { promote: false });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1', promote: false });
+    });
+    it('passes a smoke check through unchanged', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { smoke: { path: '/', contains: 'assets/' } });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).smoke).toEqual({ path: '/', contains: 'assets/' });
+    });
+    it('unwraps the revisions envelope', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revisions: [
+                { revision: 'r2', ready: true, serving: true, traffic_percent: 100, created_at: 't2' },
+                { revision: 'r1', ready: true, serving: false, traffic_percent: 0, created_at: 't1' },
+            ] }));
+        const revs = await container.listRevisions(API_KEY, ORG_ID, C_ID);
+        expect(revs).toHaveLength(2);
+        expect(revs[0].traffic_percent).toBe(100);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+    });
+    it('returns an empty list rather than undefined when there are no revisions', async () => {
+        fetchMock.mockResolvedValueOnce(ok({}));
+        expect(await container.listRevisions(API_KEY, ORG_ID, C_ID)).toEqual([]);
+    });
+    it('names the revision when promoting', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r2' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r2');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/containers/${C_ID}/promote`);
+        expect(JSON.parse(init.body)).toEqual({ revision: 'r2' });
+    });
+    // Omitting the revision is the rollback path — same endpoint, empty body.
+    it('sends an empty body to roll back', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r1' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('surfaces REVISION_NOT_READY without implying traffic moved', async () => {
+        fetchMock.mockResolvedValueOnce(fail('REVISION_NOT_READY', 'traffic was NOT moved', 409));
+        await expect(container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r9'))
+            .rejects.toMatchObject({ code: 'REVISION_NOT_READY' });
+    });
+});

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-d25fff35df7bf67bebabb6cc228f322b108d8472035cbda70756d720b8db502d
+checksum: sha256-4847ab675fa971bbd0fdd83f0039d9110ba4c38e406860fe9265dd540b7f299e
 ---
 
 # MyContainerAPI
@@ -19,6 +19,23 @@ The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 - `deploy` ships a pre-built image reference to the runtime and makes the container live at a generated URL.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
+### Deploying safely
+
+A deploy takes 100% of traffic the moment it lands, so a broken build is live
+before you can look at it. Two ways to avoid that:
+
+- `--smoke 'GET / contains assets/'` — the platform deploys the revision with
+  NO traffic, runs the assertion, and promotes only if it holds. A failure
+  leaves the previous revision serving. **Assert on content, not status**:
+  "returns 200" is true of a placeholder page too.
+- `--no-promote` — build the revision and hold it back. You get a URL to
+  exercise it, then `myapi container promote <id> <revision>`.
+
+`--health-check /livez` at create time makes the startup probe an HTTP request
+instead of a bare TCP connect. `/healthz` is refused: the runtime intercepts
+it, so the probe would never reach your container and would report success
+regardless.
+
 ### Custom domains (dynamic apps)
 
 `myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, served over HTTPS automatically. This is the path for a dynamic backend on a real domain — distinct from `my-funnel-api`, which serves static sites.
@@ -36,7 +53,9 @@ Get it right:
 | Command | What it does |
 |---|---|
 | `myapi container create --name <name> [--type service\|worker\|job] [--cron <expr>] [--cpu <n>] [--memory <size>] [--port <n>] [--env K=V,...]` | Register a container, get its scoped API key (once) |
-| `myapi container deploy <id> <image-ref>` | Ship a pre-built image and go live (rotates the scoped key) |
+| `myapi container deploy <id> <image-ref> [--no-promote] [--smoke '<assertion>']` | Ship a pre-built image (rotates the scoped key) |
+| `myapi container revisions <id>` | List revisions and the traffic each takes |
+| `myapi container promote <id> <revision>` | Move all traffic to a revision (seconds, no rebuild) |
 | `myapi container list` | List containers in your org |
 | `myapi container get <id>` | Inspect a container (status, URL, custom domain) |
 | `myapi container logs <id> [--tail <n>] [--scope all]` | Recent runtime logs, newest first (`--scope all` adds platform audit records) |
@@ -47,13 +66,26 @@ Get it right:
 ## Examples
 <!-- llm:start -->
 ```bash
-# 1. Register a service container
-myapi container create --name api --type service --port 8080
+# 1. Register a service container. --health-check makes the startup probe an
+#    HTTP request instead of a bare TCP connect.
+myapi container create --name api --type service --port 8080 --health-check /livez
 # → prints a scoped API key ONCE — save it if your code needs it
 
-# 2. Deploy a pre-built image
+# 2a. Deploy. Plain form takes 100% of traffic immediately.
 myapi container deploy <id> registry.example.com/my-app:v1
 
+# 2b. SAFER: assert before any traffic moves. The revision is deployed with no
+#     traffic, checked, and promoted only if the check holds. Assert on
+#     CONTENT — a broken build still returns 200.
+myapi container deploy <id> registry.example.com/my-app:v1 \
+  --smoke 'GET / contains assets/'
+
+# 2c. Or hold it back and look yourself.
+myapi container deploy <id> registry.example.com/my-app:v1 --no-promote
+# → prints a revision URL serving 0% of traffic
+myapi container revisions <id>
+myapi container promote <id> <revision>
+
 # 3. Serve it on a custom domain. The parent domain must already be
 #    registered: myapi domain register synthesisdaily.com
 myapi container domain <id> app.synthesisdaily.com

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-085cb990a292ba815d7c59a58fb25816d52bf33ad5019a7d90abf4123383a67c
+checksum: sha256-50cbdd28ed2a901b7a75f1a6c1df1c225d256a8d281ad86cf1e3b42511edc2fe
 ---
 
 # MyCRMAPI
@@ -91,7 +91,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 ### Contacts
 | Command | What it does |
 |---|---|
-| `myapi crm contacts list [--limit N]` | List all contacts (newest engagement first) |
+| `myapi crm contacts list [--limit N] [--offset N]` | List all contacts (newest engagement first) |
 | `myapi crm contacts search [--stage ...] [--source ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
 | `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
 | `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
@@ -158,11 +158,10 @@ myapi crm contacts events <id> --kind webhook_received
 
 ## Notes
 
-- **No pagination. Do not build a paging loop.** The API ignores `offset`
-  (every page repeats page one), there is no cursor, and `total` is the page
-  size, not the match count. The CLI rejects `--offset` rather than lie. If
-  exactly `--limit` rows come back, assume more exist: raise `--limit` or
-  narrow with filters.
+- **Paginate with `--limit` + `--offset`.** `total` is the true match count
+  and the response carries `has_more`; branch on `has_more` rather than doing
+  arithmetic against `total`. (Both were broken until 2026-07-28. Cached
+  guidance saying the CRM cannot paginate is stale.)
 - **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
 - **`external_id` on an event payload** is the backend's idempotency key — a duplicate of the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead; legacy `message_id` rows hold the same value.
 - **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.

package/dist/skills/my-domain-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Register new domains and manage edge settings. Required before a funnel can go live on a custom URL.
 triggers: [domain, register domain, dns, custom domain, edge, cdn, security level, browser check, renew, namecheap]
-checksum: sha256-067ab2cc412c1f1f34aaeeec5890f9eb77f680f5b2d1c847e376336702cd8344
+checksum: sha256-8f96d19c11c3591af71e9d73b2cea6d83f40abbfa1c58c5674dbe15db02efa3c
 ---
 
 # MyDomainAPI
@@ -88,7 +88,7 @@ myapi domain update-settings example.com \
 myapi domain import example.com
 # → Returns nameservers; set them at your current registrar.
 myapi domain status example.com --watch
-# → Polls until active. Backend live-checks Cloudflare each poll.
+# → Polls until active. Backend live-checks the DNS provider each poll.
 
 # Fix a record after import (e.g. clean up SPF)
 myapi domain records list example.com --type TXT

package/dist/skills/my-function-api/SKILL.md

@@ -2,26 +2,26 @@
 name: my-function-api
 version: 1.0.0
 description: >
-  Deploy JavaScript functions to the MyAPI edge runtime (Cloudflare Workers). Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
+  Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-ada0a52fdd9c0ba14ca86496e1c5c42e8b018155c3e8c83edba071fa6bd0b7e9
+checksum: sha256-610e16c931e44d43ee6ac94a32e6d852bb900cdf6f5eea61aaeae7bb95a0814e
 ---
 
 # MyFunctionAPI
 
-Deploy backend code without running a server. Register a function, upload a single-file JS bundle, and it goes live on the MyAPI edge runtime (Cloudflare Workers) with a public invocation URL — or runs on a cron schedule. Each function carries a scoped capability key so it can call other MyAPI slots with its own authority.
+Deploy backend code without running a server. Register a function, upload a single-file JS bundle, and it goes live on the MyAPI edge runtime with a public invocation URL — or runs on a cron schedule. Each function carries a scoped capability key so it can call other MyAPI slots with its own authority.
 
 The full loop is live: **create → deploy → invoke → inspect runs → set secrets**.
 
 ## Capabilities
 <!-- llm:start -->
-**Two-step lifecycle: register, then deploy.** `myapi fn create --name <slug>` persists the function record and mints a `scoped_api_key`, returned **exactly once** (save it if you need it). `myapi fn deploy <id> <bundle.js>` uploads a single-file JavaScript bundle (≤4MB); the backend wraps it with the MYAPI shim and ships it to Cloudflare Workers. After deploy the function has a live `invocation_url`.
+**Two-step lifecycle: register, then deploy.** `myapi fn create --name <slug>` persists the function record and mints a `scoped_api_key`, returned **exactly once** (save it if you need it). `myapi fn deploy <id> <bundle.js>` uploads a single-file JavaScript bundle (≤4MB); the backend wraps it with the MYAPI shim and ships it to the edge runtime. Propagation is typically 4-45s, so poll the invocation URL rather than redeploying. After deploy the function has a live `invocation_url`.
 
 **Scoped key = capability key.** It is **org-locked**. By default it inherits the deployer's slot grants; narrow it at create time with `--scope <slot>[,<slot>...]` (comma-separated, e.g. `--scope email,storage`) — the primary way to deploy a deliberately narrow function. Grants can never exceed the caller's, so a function never out-reaches the credential that created it. It is rejected with `403 SCOPE_FORBIDDEN` at `/hq/*`, `/admin/*`, `/internal/*`. **Deploy rotates this key** — the fresh value is printed once on every deploy. (Minting a narrow account key first — `myapi keys create --grant ...` — is only needed when the *deploy credential itself* must be constrained, e.g. handing deploy rights to another system.)
 
 **HTTP or cron triggers.** Default is `http` — the function gets a public invocation URL once deployed. Pass `--cron "<expr>"` at create time to run on a schedule (e.g. `"0 8 * * *"`) instead.
 
-**Secrets via Worker Secrets.** `myapi fn env <id> <name> <value>` sets a secret (Stripe key, API token, …) as a Cloudflare Worker Secret on a deployed function. The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI. The function must already be deployed.
+**Secrets are encrypted at rest.** `myapi fn env <id> <name> <value>` sets a secret (Stripe key, API token, …) on a deployed function. The value is encrypted at rest by the edge runtime and never stored or echoed by MyAPI. The function must already be deployed.
 
 **Inspect invocations.** `myapi fn runs <id>` lists recent invocation records (most recent first, up to 100) with status, duration, and any error message.
 
@@ -36,7 +36,7 @@ Name rules (validated client- and server-side, kept identical):
 |---|---|
 | `myapi fn create --name <name> [--cron <expr>] [--scope <slot>[,<slot>...]]` | Register a function record + receive scoped API key (returned once). `--scope` narrows the key's slot grants |
 | `myapi fn deploy <id> <bundle.js>` | Upload a single-file JS bundle (≤4MB) and go live; rotates the scoped key |
-| `myapi fn env <id> <name> <value>` | Set a Worker Secret on a deployed function |
+| `myapi fn env <id> <name> <value>` | Set an encrypted secret on a deployed function |
 | `myapi fn runs <id>` | List recent invocation records (status, duration, errors) |
 | `myapi fn list` | List functions in your org |
 | `myapi fn get <id>` | Inspect a function (name, trigger, invocation URL) |
@@ -58,7 +58,7 @@ myapi fn deploy fn_abc123 ./dist/bundle.js
 #   Invocation URL:  https://fn-abc123.<...>.workers.dev
 #   Scoped API key was rotated. New value (returned once): hq_live_...
 
-# Set a secret (encrypted at rest by Cloudflare; never echoed)
+# Set a secret (encrypted at rest; never echoed)
 myapi fn env fn_abc123 STRIPE_KEY sk_live_...
 
 # Inspect recent invocations

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.6.2",
+  "version": "2.7.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -35,12 +35,13 @@
     "lint:help-order": "node scripts/lint-help-order.js",
     "lint:exposes": "node scripts/lint-exposes.js",
     "lint:request-fields": "node scripts/lint-request-fields.js",
+    "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.6.2"
+    "@myapihq/sdk": "^2.7.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",