@myapihq/cli 2.6.2 → 2.7.1

package/dist/commands/crm/pagination.test.js

@@ -1,73 +1,37 @@
-// Regression cover for the CRM pagination guards.
+// Rendering for CRM result counts.
 //
-// The bug being fenced off: the API accepts `offset`, ignores it, and reports
-// `total` as the page size — so an agent paging a contact list re-read page
-// one forever and had no signal that anything was missing. Verified against
-// production 2026-07-27. These tests assert the CLI never silently accepts
-// that flag again, and never claims a result is complete when it cannot know.
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
-import * as output from '../../output.js';
-describe('rejectOffset', () => {
-    let errSpy;
-    beforeEach(() => {
-        // error() exits the process; make it throw so the test can catch it.
-        errSpy = vi.spyOn(output, 'error').mockImplementation(((msg) => {
-            throw new Error(msg);
-        }));
-    });
-    afterEach(() => errSpy.mockRestore());
-    it('passes through when --offset is absent', () => {
-        expect(() => rejectOffset({}, 'usage')).not.toThrow();
-    });
-    it('rejects --offset 0 — it is as broken as any other value', () => {
-        expect(() => rejectOffset({ offset: 0 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('rejects a non-zero --offset', () => {
-        expect(() => rejectOffset({ offset: 25 }, 'usage')).toThrow(/ignores it/);
-    });
-    it('explains that no cursor exists either, so the user does not go looking', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'usage')).toThrow(/no cursor parameter/);
-    });
-    it('includes the usage line so the error is actionable', () => {
-        expect(() => rejectOffset({ offset: 1 }, 'myapi crm contacts list [--limit N]'))
-            .toThrow(/myapi crm contacts list/);
-    });
-});
-describe('warnIfTruncated', () => {
-    let infoSpy;
-    beforeEach(() => { infoSpy = vi.spyOn(output, 'info').mockImplementation(() => { }); });
-    afterEach(() => infoSpy.mockRestore());
-    it('warns when the page came back exactly full', () => {
-        warnIfTruncated(10, { limit: 10 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet when the page came back short — that answer IS complete', () => {
-        warnIfTruncated(3, { limit: 10 });
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('uses the server default of 50 when no --limit was given', () => {
-        warnIfTruncated(50, {});
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
-    });
-    it('stays quiet below the default limit', () => {
-        warnIfTruncated(49, {});
-        expect(infoSpy).not.toHaveBeenCalled();
-    });
-    it('says a record, not "1 records"', () => {
-        warnIfTruncated(1, { limit: 1 });
-        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('exactly 1 record came back'));
-    });
-});
-describe('countLine', () => {
-    // The point of this helper is what it does NOT print: `N of total`, where
-    // total is the page size, reads as "you have everything".
-    it('pluralizes', () => {
-        expect(countLine(1, 'contact', 'contacts')).toBe('1 contact');
-        expect(countLine(3, 'contact', 'contacts')).toBe('3 contacts');
-        expect(countLine(0, 'company', 'companies')).toBe('0 companies');
-    });
-    it('never mentions a total', () => {
-        expect(countLine(5, 'contact', 'contacts')).not.toMatch(/of/);
+// The line this replaces said "N of <total>" where total was the page size, so
+// it read as a completeness claim on a truncated result. The backend fixed
+// `total` and added `has_more` on 2026-07-28; these tests pin the rendering to
+// the fixed contract and, in particular, to preferring `has_more` over any
+// arithmetic against `total`.
+import { describe, it, expect } from 'vitest';
+import { pageLine } from './pagination.js';
+describe('pageLine', () => {
+    it('states the count alone when the page IS everything', () => {
+        expect(pageLine(3, 3, false, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('shows the true match count when the page is a subset', () => {
+        expect(pageLine(3, 128, false, 'contact', 'contacts')).toBe('3 of 128 contacts');
+    });
+    it('says more is available when has_more is set', () => {
+        expect(pageLine(50, 128, true, 'contact', 'contacts'))
+            .toBe('50 of 128 contacts (more available — raise --limit or pass --offset)');
+    });
+    // has_more is authoritative. Inferring truncation by comparing lengths is
+    // what silently agreed with the old, wrong `total`.
+    it('trusts has_more even when the numbers look complete', () => {
+        expect(pageLine(3, 3, true, 'contact', 'contacts')).toMatch(/more available/);
+    });
+    it('omits the total when the API did not send one', () => {
+        expect(pageLine(3, undefined, undefined, 'contact', 'contacts')).toBe('3 contacts');
+    });
+    it('pluralizes both nouns', () => {
+        expect(pageLine(1, 1, false, 'contact', 'contacts')).toBe('1 contact');
+        expect(pageLine(1, 9, false, 'company', 'companies')).toBe('1 of 9 companies');
+        expect(pageLine(0, 0, false, 'company', 'companies')).toBe('0 companies');
+    });
+    it('never claims a total it was not given', () => {
+        expect(pageLine(5, undefined, true, 'contact', 'contacts')).not.toMatch(/\bof\b/);
     });
 });

package/dist/commands/database.js

@@ -106,8 +106,8 @@ async function nsDelete(name, flags) {
 // ── Keys ─────────────────────────────────────────────────────────────────
 async function keysList(flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
-    const ns = requireNs(flags, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values]');
+    const orgId = requireOrg(flags, config, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
+    const ns = requireNs(flags, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values]');
     const opts = {};
     if (typeof flags.prefix === 'string')
         opts.prefix = flags.prefix;
@@ -197,12 +197,16 @@ const SUBCOMMAND_USAGE = {
     'create': 'myapi database create <name> [--org <id>]',
     'delete-namespace': `myapi database delete-namespace <name> [--org <id>]
 
-Deletes the namespace AND all keys in it. Irreversible.`,
-    'keys': `myapi database keys --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
+Deletes the namespace AND all entries in it. Irreversible.`,
+    'entries': `myapi database entries --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
 
-Default render is one key per line. --values inlines each value alongside
-its key + etag. --cursor takes the next_cursor printed at the end of a
-previous page.`,
+Default render is one entry key per line. --values inlines each value
+alongside its key + etag. --cursor takes the next_cursor printed at the end
+of a previous page.
+
+(\`myapi database keys\` still works. It was renamed because "key" also means
+an API credential everywhere else on the platform, and an agent reading
+"list keys" could not tell which was meant.)`,
     'get': `myapi database get <key> --ns <namespace> [--org <id>] [--json]
 
 Prints the value as compact JSON on stdout; etag + updated_at go to
@@ -226,17 +230,17 @@ export async function run(subcommand, args, flags) {
 
 Namespaces:
   create <name>                 Create a namespace
-  delete-namespace <name>       Delete a namespace AND all its keys (irreversible)
+  delete-namespace <name>       Delete a namespace AND all its entries (irreversible)
   namespaces                    List namespaces in the org
 
-Keys (require --ns <namespace>):
-  keys                          List keys in a namespace
-  get <key>                     Get a key's value + etag
-  set <key> <value-json>        Set a key. Value is JSON; CAS via --if-match
-  del <key>                     Delete a key (CAS via --if-match)
+Entries (require --ns <namespace>):
+  entries                       List entries in a namespace
+  get <key>                     Get an entry's value + etag
+  set <key> <value-json>        Set an entry. Value is JSON; CAS via --if-match
+  del <key>                     Delete an entry (CAS via --if-match)
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).
-Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
+Values are JSON; per-entry size cap is 256 KB. Use myapi storage for binary.`);
         return;
     }
     if (flags.help) {
@@ -251,6 +255,9 @@ Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
         case 'namespaces': return nsList(flags);
         case 'create': return nsCreate(args[0], flags);
         case 'delete-namespace': return nsDelete(args[0], flags);
+        // `keys` kept as an undocumented alias: renaming a verb people have in
+        // scripts should not break them. Dropped no earlier than the next minor.
+        case 'entries':
         case 'keys': return keysList(flags);
         case 'get': return keyGet(args[0], flags);
         case 'set': return keySet(args[0], args[1], flags);

package/dist/commands/doctor.js

@@ -272,7 +272,7 @@ async function fetchStatus(url) {
 async function httpProbeSection(apiKey, orgId) {
     const targets = [];
     // Containers: probe the bound custom domain when set (what customers hit),
-    // else the Cloud Run URL. An undeployed container has neither — skip it.
+    // else the runtime-assigned URL. An undeployed container has neither.
     try {
         const containers = await sdkContainer.listContainers(apiKey, orgId);
         for (const c of containers) {

package/dist/commands/domain.js

@@ -315,7 +315,7 @@ function renderStatus(res) {
         info(`Email:   ${res.email_infra}${where}`);
     }
     if (res.status === 'pending_ns_change') {
-        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks Cloudflare.');
+        info('Waiting for you to change nameservers at your current registrar. Each poll re-checks the DNS provider.');
     }
     if (res.status === 'infra_error' && res.error_detail) {
         info(`  Failed step:  ${res.error_detail.failed_step}`);
@@ -524,7 +524,7 @@ Name normalization:
   --name=""                      Apex (empty == @)
 
 Notes:
-  --ttl defaults to 1 (Cloudflare "automatic"). Explicit range: [60, 86400].
+  --ttl defaults to 1 ("automatic"). Explicit range: [60, 86400].
   --priority is required for MX (typical: 10).
   --proxied (CF "orange-cloud") applies to A/AAAA/CNAME only.
 
@@ -596,17 +596,17 @@ DNS propagation takes a few minutes — track it with: myapi domain status <doma
     'import': `myapi domain import <domain> [--org <id>] [--json]
 
 Bring your own domain (BYOD). Snapshots existing DNS records via a best-effort
-public probe and creates a Cloudflare zone for the domain. Returns the
+public probe and creates a DNS zone for the domain. Returns the
 nameservers you need to set at your current registrar.
 
 No registrar credentials needed — works with any registrar (Namecheap, GoDaddy,
-Cloudflare Registrar, etc.).
+the registrar of record, etc.).
 
 After running:
   1. Verify the preserved-records table covers your MX/SPF/DKIM/DMARC etc.
   2. At your current registrar, change the nameservers to the values returned.
   3. Wait for propagation. Use "myapi domain status <domain> --watch" to track
-     activation — the backend live-checks Cloudflare each time you poll.`,
+     activation — the backend live-checks the DNS provider each poll.`,
     'renew': `myapi domain renew <domain> [--yes] [--org <id>]
 
 Renews a registered domain for one more registration period (typically 1 year).
@@ -634,7 +634,7 @@ binding with: myapi domain list --filter all`,
 
   --watch   Poll until the domain reaches a terminal state (active / failed /
             expired). Backoff: 10s × 30 then 30s × 60 (~35 min budget). Useful
-            after "myapi domain import" — each poll also live-checks Cloudflare,
+            after "myapi domain import" — each poll also live-checks DNS,
             so polling drives the flip from pending_ns_change → provisioning.`,
     'settings': `myapi domain settings <domain> [--org <id>]
 

package/dist/commands/fn.js

@@ -22,8 +22,8 @@ export const SCHEMA = {
     scope: 'list',
     set: 'string',
 };
-// Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
-// JS bundle to Cloudflare Workers, list runs, set env secrets).
+// Backend: Story 1 (function CRUD + scoped API key) and Story 2/4/5 (deploy a
+// JS bundle to the edge runtime, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
 // runs the same regex as defence in depth.
@@ -89,7 +89,7 @@ export async function create(nameArg, flags) {
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
-    // The scoped key is returned ONCE — surface it prominently. It's used by
+    // The scoped API key is returned ONCE — surface it prominently. It's used by
     // the function runtime shim to call other slot endpoints without a
     // baked-in auth token. Deploy rotates this key.
     info('');
@@ -142,7 +142,7 @@ export async function del(id, flags) {
     success(`Deleted function ${id} (org ${orgId})`);
 }
 // deploy uploads a single-file JS bundle. The backend wraps it with the
-// MYAPI shim and ships it to Cloudflare Workers. The scoped API key is
+// MYAPI shim and ships it to the edge runtime. The scoped API key is
 // rotated on every deploy — the fresh value is shown once here.
 export async function deploy(id, bundlePath, flags) {
     const config = requireConfig();
@@ -205,7 +205,7 @@ async function waitForLive(url, budgetMs = 75_000) {
     clearLine();
     info(`Status:          not serving yet after ${Math.round(budgetMs / 1000)}s.`);
     info(`                 The deploy itself succeeded — give it another minute.`);
-    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped key again.`);
+    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped API key again.`);
 }
 // _parseSetPairs parses `--set K=V` entries into a map. Accepts a single
 // string (comma-joined: K=V,K2=V2) or an array of strings (when the flag is
@@ -226,7 +226,7 @@ export function _parseSetPairs(raw) {
     }
     return env;
 }
-// env sets Worker Secret(s) (Stripe key, etc.) on a deployed function.
+// env sets encrypted secret(s) (Stripe key, etc.) on a deployed function.
 // Single form:  myapi fn env <id> <name> <value>
 // Bulk form:    myapi fn env <id> --set K=V[,K2=V2 ...]
 export async function setEnv(id, name, value, flags) {
@@ -243,7 +243,7 @@ export async function setEnv(id, name, value, flags) {
             error('No secrets given. Usage: myapi fn env <id> --set KEY=VALUE');
         const result = await sdkFn.setFunctionEnvBulk(config.api_key, orgId, id, env);
         success(`Set ${result.set} secret${result.set === 1 ? '' : 's'} on function ${id}`);
-        info('Values are encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+        info('Values are encrypted at rest and never stored or echoed by MyAPI.');
         return;
     }
     // Single-secret path (original form).
@@ -253,7 +253,7 @@ export async function setEnv(id, name, value, flags) {
         error('Missing secret value.\nUsage: myapi fn env <id> <name> <value>');
     await sdkFn.setFunctionEnv(config.api_key, orgId, id, name, value);
     success(`Set ${name} on function ${id}`);
-    info('The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+    info('The value is encrypted at rest and never stored or echoed by MyAPI.');
 }
 // runs lists recent invocation records, most recent first.
 export async function runs(id, flags) {
@@ -304,7 +304,7 @@ other MyAPI slots with its own permissions (scopes=slot_call; rejected at
     'deploy': `myapi fn deploy <id> <bundle.js> [--org <id>] [--json]
 
 Uploads a single-file JavaScript bundle (≤4MB) to the edge runtime. The
-backend wraps it with the MYAPI shim and ships it to Cloudflare Workers.
+backend wraps it with the MYAPI shim and ships it to the edge runtime.
 
 The scoped API key is rotated on every deploy — the fresh value is printed
 once. After deploy the function has a live invocation URL.
@@ -314,7 +314,7 @@ Example:
     'env': `myapi fn env <id> <name> <value> [--org <id>]
        myapi fn env <id> --set KEY=VALUE[,KEY2=VALUE2 ...] [--org <id>]
 
-Sets one or more secrets (Stripe key, API token, ...) as Cloudflare Worker
+Sets one or more secrets (Stripe key, API token, ...) as encrypted edge
 Secrets on a deployed function. Values are encrypted at rest and never stored
 in MyAPI or echoed back. The function must already be deployed.
 
@@ -337,7 +337,7 @@ Subcommands:
   create               Register a function and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <file>   Upload a JS bundle and go live
-  env <id> <k> <v>     Set a Worker Secret (or --set K=V for bulk) on a deployed function
+  env <id> <k> <v>     Set an encrypted secret (or --set K=V for bulk) on a deployed function
   get <id>             Inspect a function
   list                 List functions in your org
   runs <id>            List recent invocation records

package/dist/errors.js

@@ -39,8 +39,23 @@ export const ERROR_MESSAGES = {
     MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
     INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
     INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
-    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
-    CF_API_ERROR: 'Cloudflare API error.',
+    RECORD_LIMIT_EXCEEDED: 'Per-zone DNS record limit reached.',
+    // The DNS provider's codes were renamed on 2026-07-28 (CF_* → DNS_*/EDGE_*)
+    // because they named the vendor. Both spellings are handled: the rename ships
+    // on a backend deploy we do not control the timing of, and a CLI that only
+    // knows the new names would print a bare code for anyone on the old build.
+    // The old five can go once that deploy is everywhere.
+    DNS_UNAVAILABLE: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    DNS_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    DNS_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    EDGE_SUBDOMAIN_UNAVAILABLE: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_OUR_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
+    // Superseded spellings, kept so an older backend still gets a readable message.
+    CF_API_ERROR: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
+    CF_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
+    CF_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
+    CF_WORKERS_SUBDOMAIN: 'The edge subdomain could not be provisioned. Platform-side — retry, and report it if it persists.',
+    NOT_ON_CF_DNS: 'This domain is not on MyAPI DNS, so records here cannot be managed. Move its nameservers or import it: myapi domain import <domain>.',
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
@@ -54,9 +69,10 @@ export const ERROR_MESSAGES = {
 };
 export function friendlyError(err) {
     const body = err.body ?? {};
-    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
-    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
-    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
+    // The provider's own message is already self-describing, so use it verbatim
+    // (with its status if present) instead of doubling up. Matches both the old
+    // and new code spellings for the duration of the rename.
+    if ((err.code === 'DNS_UNAVAILABLE' || err.code === 'CF_API_ERROR') && typeof body.cf_message === 'string') {
         return typeof body.cf_status === 'number'
             ? `${body.cf_message} (HTTP ${body.cf_status})`
             : body.cf_message;

package/dist/sdk-container.test.js

@@ -144,13 +144,18 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 9 container endpoints', () => {
+    it('covers the 11 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers/{id}',
             'DELETE /container/orgs/{org_id}/containers/{id}',
             'POST /container/orgs/{org_id}/containers/{id}/deploy',
+            // Added 2026-07-28. Promote and rollback are ONE endpoint: naming a
+            // revision promotes it, omitting one rolls back to the previous ready
+            // revision. Modelled as a single operation so the two cannot drift.
+            'GET /container/orgs/{org_id}/containers/{id}/revisions',
+            'POST /container/orgs/{org_id}/containers/{id}/promote',
             'GET /container/orgs/{org_id}/containers/{id}/logs',
             'POST /container/orgs/{org_id}/containers/{id}/domain',
             'DELETE /container/orgs/{org_id}/containers/{id}/domain',
@@ -193,3 +198,55 @@ describe('container custom domain', () => {
         expect(init.method).toBe('DELETE');
     });
 });
+describe('container deploy safety — promote and revisions', () => {
+    // `promote` defaults to true server-side, so the historical call must stay
+    // byte-identical. Sending promote:true explicitly would be a behaviour
+    // change dressed as a no-op.
+    it('sends no promote field when promoting normally', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1');
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1' });
+    });
+    it('sends promote:false only when explicitly withheld', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k', promoted: false }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { promote: false });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ image: 'img:v1', promote: false });
+    });
+    it('passes a smoke check through unchanged', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container_id: C_ID, revision_id: 'r1', url: 'u', status: 'active', scoped_api_key: 'k' }));
+        await container.deployContainer(API_KEY, ORG_ID, C_ID, 'img:v1', { smoke: { path: '/', contains: 'assets/' } });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).smoke).toEqual({ path: '/', contains: 'assets/' });
+    });
+    it('unwraps the revisions envelope', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revisions: [
+                { revision: 'r2', ready: true, serving: true, traffic_percent: 100, created_at: 't2' },
+                { revision: 'r1', ready: true, serving: false, traffic_percent: 0, created_at: 't1' },
+            ] }));
+        const revs = await container.listRevisions(API_KEY, ORG_ID, C_ID);
+        expect(revs).toHaveLength(2);
+        expect(revs[0].traffic_percent).toBe(100);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+    });
+    it('returns an empty list rather than undefined when there are no revisions', async () => {
+        fetchMock.mockResolvedValueOnce(ok({}));
+        expect(await container.listRevisions(API_KEY, ORG_ID, C_ID)).toEqual([]);
+    });
+    it('names the revision when promoting', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r2' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r2');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/containers/${C_ID}/promote`);
+        expect(JSON.parse(init.body)).toEqual({ revision: 'r2' });
+    });
+    // Omitting the revision is the rollback path — same endpoint, empty body.
+    it('sends an empty body to roll back', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ serving: 'r1' }));
+        await container.promoteRevision(API_KEY, ORG_ID, C_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('surfaces REVISION_NOT_READY without implying traffic moved', async () => {
+        fetchMock.mockResolvedValueOnce(fail('REVISION_NOT_READY', 'traffic was NOT moved', 409));
+        await expect(container.promoteRevision(API_KEY, ORG_ID, C_ID, 'r9'))
+            .rejects.toMatchObject({ code: 'REVISION_NOT_READY' });
+    });
+});

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-d25fff35df7bf67bebabb6cc228f322b108d8472035cbda70756d720b8db502d
+checksum: sha256-3864bbb98fab89ba9e937c38bed072e22f33663ec7cbc23a43f24192275bcffd
 ---
 
 # MyContainerAPI
@@ -19,6 +19,27 @@ The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 - `deploy` ships a pre-built image reference to the runtime and makes the container live at a generated URL.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
+### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
+
+A deploy takes 100% of traffic the moment it lands. There is no dry run, no
+definition of correct beyond "something is listening on the port", and no way
+back. Plan for that.
+
+`--no-promote` and `--smoke` exist as flags and **the CLI refuses them**: they
+shipped before the platform could honour them, and a guard that silently
+passes is worse than no guard. `--health-check` is accepted at create but does
+not appear on the container afterwards, so do not rely on it either.
+
+Until they work, the only safe sequence is:
+
+1. deploy to a **non-production** container
+2. verify it yourself — `curl` for a string only a real build emits, not just
+   a 200, because a broken build returns 200 too
+3. deploy the same image to production
+
+`myapi container promote <id> <revision>` currently fails, so a bad deploy
+must be fixed by deploying forward. Keep a known-good image reference to hand.
+
 ### Custom domains (dynamic apps)
 
 `myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, served over HTTPS automatically. This is the path for a dynamic backend on a real domain — distinct from `my-funnel-api`, which serves static sites.
@@ -36,7 +57,9 @@ Get it right:
 | Command | What it does |
 |---|---|
 | `myapi container create --name <name> [--type service\|worker\|job] [--cron <expr>] [--cpu <n>] [--memory <size>] [--port <n>] [--env K=V,...]` | Register a container, get its scoped API key (once) |
-| `myapi container deploy <id> <image-ref>` | Ship a pre-built image and go live (rotates the scoped key) |
+| `myapi container deploy <id> <image-ref> [--no-promote] [--smoke '<assertion>']` | Ship a pre-built image (rotates the scoped API key) |
+| `myapi container revisions <id>` | List revisions and the traffic each takes |
+| `myapi container promote <id> <revision>` | Move all traffic to a revision (seconds, no rebuild) |
 | `myapi container list` | List containers in your org |
 | `myapi container get <id>` | Inspect a container (status, URL, custom domain) |
 | `myapi container logs <id> [--tail <n>] [--scope all]` | Recent runtime logs, newest first (`--scope all` adds platform audit records) |
@@ -51,9 +74,14 @@ Get it right:
 myapi container create --name api --type service --port 8080
 # → prints a scoped API key ONCE — save it if your code needs it
 
-# 2. Deploy a pre-built image
+# 2. Deploy. This takes 100% of traffic immediately — there is no staging
+#    step, so verify on a non-production container FIRST.
 myapi container deploy <id> registry.example.com/my-app:v1
 
+# 3. Check what you actually shipped. Assert on content: a build whose
+#    frontend never bundled still binds its port and returns 200.
+curl -s https://<your-domain>/ | grep -q 'assets/' || echo "BROKEN BUILD"
+
 # 3. Serve it on a custom domain. The parent domain must already be
 #    registered: myapi domain register synthesisdaily.com
 myapi container domain <id> app.synthesisdaily.com

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-085cb990a292ba815d7c59a58fb25816d52bf33ad5019a7d90abf4123383a67c
+checksum: sha256-50cbdd28ed2a901b7a75f1a6c1df1c225d256a8d281ad86cf1e3b42511edc2fe
 ---
 
 # MyCRMAPI
@@ -91,7 +91,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 ### Contacts
 | Command | What it does |
 |---|---|
-| `myapi crm contacts list [--limit N]` | List all contacts (newest engagement first) |
+| `myapi crm contacts list [--limit N] [--offset N]` | List all contacts (newest engagement first) |
 | `myapi crm contacts search [--stage ...] [--source ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
 | `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
 | `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
@@ -158,11 +158,10 @@ myapi crm contacts events <id> --kind webhook_received
 
 ## Notes
 
-- **No pagination. Do not build a paging loop.** The API ignores `offset`
-  (every page repeats page one), there is no cursor, and `total` is the page
-  size, not the match count. The CLI rejects `--offset` rather than lie. If
-  exactly `--limit` rows come back, assume more exist: raise `--limit` or
-  narrow with filters.
+- **Paginate with `--limit` + `--offset`.** `total` is the true match count
+  and the response carries `has_more`; branch on `has_more` rather than doing
+  arithmetic against `total`. (Both were broken until 2026-07-28. Cached
+  guidance saying the CRM cannot paginate is stale.)
 - **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
 - **`external_id` on an event payload** is the backend's idempotency key — a duplicate of the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead; legacy `message_id` rows hold the same value.
 - **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.

package/dist/skills/my-database-api/README.md

@@ -15,7 +15,7 @@ Per-org KV store with namespaces. JSON values up to 256 KB per key. Compare-and-
 myapi database create my-app
 myapi database set users '{"alice":{"plan":"pro"}}' --ns my-app
 myapi database get users --ns my-app
-myapi database keys --ns my-app --values
+myapi database entries --ns my-app --values
 ```
 
 ## Authentication

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-b66f7ebdff5bce05eaab90c6812ffc0f9ec729f6df1dc4a8bca90368406b4c21
+checksum: sha256-f098cb574a1773135b09cbe79bb75eb33e34b1dc90737aa80da2452bb53e972e
 ---
 
 # MyDatabaseAPI
@@ -51,7 +51,7 @@ Pass `--if-match <etag>` from a previous `get` to make `set` or `del` conditiona
 | `myapi database namespaces [--json]` | List namespaces in the org |
 | `myapi database create <name>` | Create a namespace |
 | `myapi database delete-namespace <name>` | Delete namespace AND all its keys (irreversible) |
-| `myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>]` | List keys, optionally with inline values |
+| `myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>]` | List keys, optionally with inline values |
 | `myapi database get <key> --ns <ns>` | Get value + etag (etag printed to stderr) |
 | `myapi database set <key> <value-json> --ns <ns> [--if-match <etag>] [--file <path>]` | Set key. CAS via --if-match |
 | `myapi database del <key> --ns <ns> [--if-match <etag>]` | Delete key. CAS via --if-match |
@@ -62,7 +62,7 @@ Pass `-` as `<value-json>` to read the value from stdin, or `--file <path>` to r
 ## Examples
 <!-- llm:start -->
 ```bash
-# Create a namespace, set a key, read it back
+# Create a namespace, set an entry, read it back
 myapi database create my-app
 myapi database set user:alice '{"plan":"pro","trial_ends":"2026-06-01"}' --ns my-app
 myapi database get user:alice --ns my-app
@@ -70,7 +70,7 @@ myapi database get user:alice --ns my-app
 # stderr: — etag=A1B2C3 · updated=2026-05-12T17:00:00Z
 
 # List keys with a prefix
-myapi database keys --ns my-app --prefix user: --values
+myapi database entries --ns my-app --prefix user: --values
 
 # Compare-and-swap update
 ETAG=$(myapi database get user:alice --ns my-app --json | jq -r .etag)

package/dist/skills/my-domain-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Register new domains and manage edge settings. Required before a funnel can go live on a custom URL.
 triggers: [domain, register domain, dns, custom domain, edge, cdn, security level, browser check, renew, namecheap]
-checksum: sha256-067ab2cc412c1f1f34aaeeec5890f9eb77f680f5b2d1c847e376336702cd8344
+checksum: sha256-8f96d19c11c3591af71e9d73b2cea6d83f40abbfa1c58c5674dbe15db02efa3c
 ---
 
 # MyDomainAPI
@@ -88,7 +88,7 @@ myapi domain update-settings example.com \
 myapi domain import example.com
 # → Returns nameservers; set them at your current registrar.
 myapi domain status example.com --watch
-# → Polls until active. Backend live-checks Cloudflare each poll.
+# → Polls until active. Backend live-checks the DNS provider each poll.
 
 # Fix a record after import (e.g. clean up SPF)
 myapi domain records list example.com --type TXT