@myapihq/cli 2.7.0 → 2.7.1

package/dist/commands/container.js

@@ -133,7 +133,7 @@ export async function create(nameArg, flags) {
     info(`Name:            ${result.container.name}`);
     info(`Type:            ${result.container.type}${result.container.cron_schedule ? ` (${result.container.cron_schedule})` : ''}`);
     info(`Resources:       ${result.container.cpu} CPU, ${result.container.memory}, instances ${result.container.min_instances}-${result.container.max_instances}`);
-    // The scoped key is returned ONCE — it's delivered to the running
+    // The scoped API key is returned ONCE — it's delivered to the running
     // container as the MYAPI_KEY env var. Deploy rotates it.
     info('');
     info(`Scoped API key (returned once — save it if you need it):`);
@@ -221,6 +221,36 @@ export async function deploy(id, image, flags) {
     const orgId = requireOrg(flags, config, 'myapi container deploy <id> <image-ref> | --source <dir|tar> [--org <id>]');
     if (!id)
         error('Missing id.\nUsage: myapi container deploy <id> <image-ref>   (or --source <dir|tar>)');
+    // --no-promote and --smoke are REFUSED, not honoured, as of 2026-07-28.
+    //
+    // They shipped in 2.7.0 and do not work on either deploy path. A customer
+    // found it by testing rather than trusting the flags, which is the outcome
+    // this CLI spends most of its error messages trying to prevent:
+    //
+    //   --source: the multipart body accepts only `source`. The flags were
+    //     silently dropped — accepted by our flag parser, never sent. That was
+    //     our bug, and it is the exact failure these flags exist to stop.
+    //
+    //   image ref: the API accepts promote/smoke, then the deploy fails with a
+    //     runtime error setting traffic to the revision it just created. The
+    //     previous revision keeps serving, so it is safe, but it does not work.
+    //
+    // Refusing is strictly better than accepting. A missing guard makes people
+    // write their own; a guard that silently passes makes them stop. Restore
+    // these the moment the upstream fix lands — see
+    // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
+    if (flags['no-promote'] === true || typeof flags.smoke === 'string') {
+        const which = flags['no-promote'] === true ? '--no-promote' : '--smoke';
+        error(`${which} is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was guarded.\n\n` +
+            'It shipped in 2.7.0 and does not work end to end on either deploy path:\n' +
+            '  --source     the API accepts only the tarball on that path; the flag never reaches it\n' +
+            '  <image-ref>  the API accepts the flag, then fails while moving traffic\n\n' +
+            'Until it lands, the safe sequence is:\n' +
+            `  1. deploy to a non-production container first\n` +
+            `  2. check it yourself (curl for a string only a real build emits)\n` +
+            `  3. deploy the same image to production\n\n` +
+            'Reported upstream; this message goes away when the flag works.');
+    }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
     if (!image && typeof flags.image === 'string')
@@ -290,15 +320,10 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    const opts = {};
-    if (flags['no-promote'] === true)
-        opts.promote = false;
-    if (typeof flags.smoke === 'string')
-        opts.smoke = _parseSmoke(flags.smoke);
-    if (opts.promote === false && opts.smoke) {
-        error('--smoke already withholds traffic until the check passes, then promotes.\nUse one or the other: --smoke to verify-and-promote, --no-promote to hold the revision back.');
-    }
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, opts);
+    // No DeployOptions built here: --no-promote and --smoke are refused above
+    // until the upstream fix lands. The SDK still carries them so the wiring is
+    // one commit away, and sdk-container.test.ts keeps them covered.
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
     if (flags.json) {
         printJson(result);
         return;
@@ -306,6 +331,9 @@ export async function deploy(id, image, flags) {
     // An unpromoted revision must NOT read like a completed deploy. A response
     // that looked the same either way is how an agent concludes it has shipped
     // when it has not — the original outage in miniature.
+    // Unreachable while the flags are refused above. Kept because it is the
+    // render we want the moment they are restored, and deleting it would mean
+    // rewriting it from memory later.
     if (result.promoted === false) {
         success(`Revision ${result.revision_id} built — NOT serving traffic`);
         info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
@@ -392,8 +420,10 @@ export async function revisions(id, flags) {
     if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
         info('');
         info('Note: every revision reports 0% traffic while this container is active and serving.');
-        info('That is a known reporting bug for containers deployed before 2026-07-28, not an outage.');
-        info('Rollback depends on this data, so it is unreliable here until the container is redeployed.');
+        info('The traffic column is wrong, not the container. Verified on a container created');
+        info('today, so this is not limited to older ones — an earlier version of this message');
+        info('said redeploying fixes it, which was wrong.');
+        info('promote depends on this data and currently fails. Reported upstream.');
     }
 }
 // promote moves all traffic to one revision. Omitting the revision rolls back
@@ -535,23 +565,19 @@ Two ways to deploy:
            built server-side (typically ~4 minutes), then deployed.
            Asynchronous — the CLI polls until it's live.
 
-Options:
-  --no-promote          Build the revision without giving it traffic. Test it at
-                        the returned URL, then: myapi container promote <id> <rev>
-  --smoke '<assertion>' Deploy, assert against the new revision, and promote it
-                        ONLY if the assertion holds. A failure leaves the
-                        previous revision serving.
+TEMPORARILY REFUSED: --no-promote and --smoke
+
+  Both shipped in 2.7.0 and do not work end to end. Rather than accept a flag
+  and deploy anyway, the CLI now refuses them and explains what to do instead.
+  A guard that silently passes is worse than no guard.
 
-                        Grammar: [GET|HEAD] [/path] [status N] [contains TEXT]
-                        Assert on content, not just status — "returns 200" is
-                        true of a placeholder page too.
+  Until they land: deploy to a non-production container, verify it yourself,
+  then deploy the same image to production.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz
-  myapi container deploy <id> <image> --no-promote
-  myapi container deploy <id> <image> --smoke 'GET / contains assets/'`,
+  myapi container deploy <id> --source ./context.tar.gz`,
     'revisions': `myapi container revisions <id> [--org <id>] [--json]
 
 Every revision the runtime currently holds, newest first, with the traffic
@@ -595,10 +621,8 @@ dependencies and long execution.
 Subcommands:
   build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
-                       (--health-check /livez to probe with HTTP, not a bare TCP connect)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
-                       (--no-promote to hold it back; --smoke to verify before promoting)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org

package/dist/commands/database.js

@@ -106,8 +106,8 @@ async function nsDelete(name, flags) {
 // ── Keys ─────────────────────────────────────────────────────────────────
 async function keysList(flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
-    const ns = requireNs(flags, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values]');
+    const orgId = requireOrg(flags, config, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
+    const ns = requireNs(flags, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values]');
     const opts = {};
     if (typeof flags.prefix === 'string')
         opts.prefix = flags.prefix;
@@ -197,12 +197,16 @@ const SUBCOMMAND_USAGE = {
     'create': 'myapi database create <name> [--org <id>]',
     'delete-namespace': `myapi database delete-namespace <name> [--org <id>]
 
-Deletes the namespace AND all keys in it. Irreversible.`,
-    'keys': `myapi database keys --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
+Deletes the namespace AND all entries in it. Irreversible.`,
+    'entries': `myapi database entries --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
 
-Default render is one key per line. --values inlines each value alongside
-its key + etag. --cursor takes the next_cursor printed at the end of a
-previous page.`,
+Default render is one entry key per line. --values inlines each value
+alongside its key + etag. --cursor takes the next_cursor printed at the end
+of a previous page.
+
+(\`myapi database keys\` still works. It was renamed because "key" also means
+an API credential everywhere else on the platform, and an agent reading
+"list keys" could not tell which was meant.)`,
     'get': `myapi database get <key> --ns <namespace> [--org <id>] [--json]
 
 Prints the value as compact JSON on stdout; etag + updated_at go to
@@ -226,17 +230,17 @@ export async function run(subcommand, args, flags) {
 
 Namespaces:
   create <name>                 Create a namespace
-  delete-namespace <name>       Delete a namespace AND all its keys (irreversible)
+  delete-namespace <name>       Delete a namespace AND all its entries (irreversible)
   namespaces                    List namespaces in the org
 
-Keys (require --ns <namespace>):
-  keys                          List keys in a namespace
-  get <key>                     Get a key's value + etag
-  set <key> <value-json>        Set a key. Value is JSON; CAS via --if-match
-  del <key>                     Delete a key (CAS via --if-match)
+Entries (require --ns <namespace>):
+  entries                       List entries in a namespace
+  get <key>                     Get an entry's value + etag
+  set <key> <value-json>        Set an entry. Value is JSON; CAS via --if-match
+  del <key>                     Delete an entry (CAS via --if-match)
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).
-Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
+Values are JSON; per-entry size cap is 256 KB. Use myapi storage for binary.`);
         return;
     }
     if (flags.help) {
@@ -251,6 +255,9 @@ Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
         case 'namespaces': return nsList(flags);
         case 'create': return nsCreate(args[0], flags);
         case 'delete-namespace': return nsDelete(args[0], flags);
+        // `keys` kept as an undocumented alias: renaming a verb people have in
+        // scripts should not break them. Dropped no earlier than the next minor.
+        case 'entries':
         case 'keys': return keysList(flags);
         case 'get': return keyGet(args[0], flags);
         case 'set': return keySet(args[0], args[1], flags);

package/dist/commands/fn.js

@@ -22,7 +22,7 @@ export const SCHEMA = {
     scope: 'list',
     set: 'string',
 };
-// Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
+// Backend: Story 1 (function CRUD + scoped API key) and Story 2/4/5 (deploy a
 // JS bundle to the edge runtime, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
@@ -89,7 +89,7 @@ export async function create(nameArg, flags) {
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
-    // The scoped key is returned ONCE — surface it prominently. It's used by
+    // The scoped API key is returned ONCE — surface it prominently. It's used by
     // the function runtime shim to call other slot endpoints without a
     // baked-in auth token. Deploy rotates this key.
     info('');
@@ -205,7 +205,7 @@ async function waitForLive(url, budgetMs = 75_000) {
     clearLine();
     info(`Status:          not serving yet after ${Math.round(budgetMs / 1000)}s.`);
     info(`                 The deploy itself succeeded — give it another minute.`);
-    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped key again.`);
+    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped API key again.`);
 }
 // _parseSetPairs parses `--set K=V` entries into a map. Accepts a single
 // string (comma-joined: K=V,K2=V2) or an array of strings (when the flag is

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-4847ab675fa971bbd0fdd83f0039d9110ba4c38e406860fe9265dd540b7f299e
+checksum: sha256-3864bbb98fab89ba9e937c38bed072e22f33663ec7cbc23a43f24192275bcffd
 ---
 
 # MyContainerAPI
@@ -19,22 +19,26 @@ The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 - `deploy` ships a pre-built image reference to the runtime and makes the container live at a generated URL.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
-### Deploying safely
+### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
 
-A deploy takes 100% of traffic the moment it lands, so a broken build is live
-before you can look at it. Two ways to avoid that:
+A deploy takes 100% of traffic the moment it lands. There is no dry run, no
+definition of correct beyond "something is listening on the port", and no way
+back. Plan for that.
 
-- `--smoke 'GET / contains assets/'` — the platform deploys the revision with
-  NO traffic, runs the assertion, and promotes only if it holds. A failure
-  leaves the previous revision serving. **Assert on content, not status**:
-  "returns 200" is true of a placeholder page too.
-- `--no-promote` — build the revision and hold it back. You get a URL to
-  exercise it, then `myapi container promote <id> <revision>`.
+`--no-promote` and `--smoke` exist as flags and **the CLI refuses them**: they
+shipped before the platform could honour them, and a guard that silently
+passes is worse than no guard. `--health-check` is accepted at create but does
+not appear on the container afterwards, so do not rely on it either.
 
-`--health-check /livez` at create time makes the startup probe an HTTP request
-instead of a bare TCP connect. `/healthz` is refused: the runtime intercepts
-it, so the probe would never reach your container and would report success
-regardless.
+Until they work, the only safe sequence is:
+
+1. deploy to a **non-production** container
+2. verify it yourself — `curl` for a string only a real build emits, not just
+   a 200, because a broken build returns 200 too
+3. deploy the same image to production
+
+`myapi container promote <id> <revision>` currently fails, so a bad deploy
+must be fixed by deploying forward. Keep a known-good image reference to hand.
 
 ### Custom domains (dynamic apps)
 
@@ -53,7 +57,7 @@ Get it right:
 | Command | What it does |
 |---|---|
 | `myapi container create --name <name> [--type service\|worker\|job] [--cron <expr>] [--cpu <n>] [--memory <size>] [--port <n>] [--env K=V,...]` | Register a container, get its scoped API key (once) |
-| `myapi container deploy <id> <image-ref> [--no-promote] [--smoke '<assertion>']` | Ship a pre-built image (rotates the scoped key) |
+| `myapi container deploy <id> <image-ref> [--no-promote] [--smoke '<assertion>']` | Ship a pre-built image (rotates the scoped API key) |
 | `myapi container revisions <id>` | List revisions and the traffic each takes |
 | `myapi container promote <id> <revision>` | Move all traffic to a revision (seconds, no rebuild) |
 | `myapi container list` | List containers in your org |
@@ -66,25 +70,17 @@ Get it right:
 ## Examples
 <!-- llm:start -->
 ```bash
-# 1. Register a service container. --health-check makes the startup probe an
-#    HTTP request instead of a bare TCP connect.
-myapi container create --name api --type service --port 8080 --health-check /livez
+# 1. Register a service container
+myapi container create --name api --type service --port 8080
 # → prints a scoped API key ONCE — save it if your code needs it
 
-# 2a. Deploy. Plain form takes 100% of traffic immediately.
+# 2. Deploy. This takes 100% of traffic immediately — there is no staging
+#    step, so verify on a non-production container FIRST.
 myapi container deploy <id> registry.example.com/my-app:v1
 
-# 2b. SAFER: assert before any traffic moves. The revision is deployed with no
-#     traffic, checked, and promoted only if the check holds. Assert on
-#     CONTENT — a broken build still returns 200.
-myapi container deploy <id> registry.example.com/my-app:v1 \
-  --smoke 'GET / contains assets/'
-
-# 2c. Or hold it back and look yourself.
-myapi container deploy <id> registry.example.com/my-app:v1 --no-promote
-# → prints a revision URL serving 0% of traffic
-myapi container revisions <id>
-myapi container promote <id> <revision>
+# 3. Check what you actually shipped. Assert on content: a build whose
+#    frontend never bundled still binds its port and returns 200.
+curl -s https://<your-domain>/ | grep -q 'assets/' || echo "BROKEN BUILD"
 
 # 3. Serve it on a custom domain. The parent domain must already be
 #    registered: myapi domain register synthesisdaily.com

package/dist/skills/my-database-api/README.md

@@ -15,7 +15,7 @@ Per-org KV store with namespaces. JSON values up to 256 KB per key. Compare-and-
 myapi database create my-app
 myapi database set users '{"alice":{"plan":"pro"}}' --ns my-app
 myapi database get users --ns my-app
-myapi database keys --ns my-app --values
+myapi database entries --ns my-app --values
 ```
 
 ## Authentication

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-b66f7ebdff5bce05eaab90c6812ffc0f9ec729f6df1dc4a8bca90368406b4c21
+checksum: sha256-f098cb574a1773135b09cbe79bb75eb33e34b1dc90737aa80da2452bb53e972e
 ---
 
 # MyDatabaseAPI
@@ -51,7 +51,7 @@ Pass `--if-match <etag>` from a previous `get` to make `set` or `del` conditiona
 | `myapi database namespaces [--json]` | List namespaces in the org |
 | `myapi database create <name>` | Create a namespace |
 | `myapi database delete-namespace <name>` | Delete namespace AND all its keys (irreversible) |
-| `myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>]` | List keys, optionally with inline values |
+| `myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>]` | List keys, optionally with inline values |
 | `myapi database get <key> --ns <ns>` | Get value + etag (etag printed to stderr) |
 | `myapi database set <key> <value-json> --ns <ns> [--if-match <etag>] [--file <path>]` | Set key. CAS via --if-match |
 | `myapi database del <key> --ns <ns> [--if-match <etag>]` | Delete key. CAS via --if-match |
@@ -62,7 +62,7 @@ Pass `-` as `<value-json>` to read the value from stdin, or `--file <path>` to r
 ## Examples
 <!-- llm:start -->
 ```bash
-# Create a namespace, set a key, read it back
+# Create a namespace, set an entry, read it back
 myapi database create my-app
 myapi database set user:alice '{"plan":"pro","trial_ends":"2026-06-01"}' --ns my-app
 myapi database get user:alice --ns my-app
@@ -70,7 +70,7 @@ myapi database get user:alice --ns my-app
 # stderr: — etag=A1B2C3 · updated=2026-05-12T17:00:00Z
 
 # List keys with a prefix
-myapi database keys --ns my-app --prefix user: --values
+myapi database entries --ns my-app --prefix user: --values
 
 # Compare-and-swap update
 ETAG=$(myapi database get user:alice --ns my-app --json | jq -r .etag)

package/dist/skills/my-function-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-610e16c931e44d43ee6ac94a32e6d852bb900cdf6f5eea61aaeae7bb95a0814e
+checksum: sha256-08524ea08e91dcb6c8b68b64a7b4034d24a98a18968acd4ba80e45dbd6f85d09
 ---
 
 # MyFunctionAPI
@@ -35,12 +35,12 @@ Name rules (validated client- and server-side, kept identical):
 | Command | What it does |
 |---|---|
 | `myapi fn create --name <name> [--cron <expr>] [--scope <slot>[,<slot>...]]` | Register a function record + receive scoped API key (returned once). `--scope` narrows the key's slot grants |
-| `myapi fn deploy <id> <bundle.js>` | Upload a single-file JS bundle (≤4MB) and go live; rotates the scoped key |
+| `myapi fn deploy <id> <bundle.js>` | Upload a single-file JS bundle (≤4MB) and go live; rotates the scoped API key |
 | `myapi fn env <id> <name> <value>` | Set an encrypted secret on a deployed function |
 | `myapi fn runs <id>` | List recent invocation records (status, duration, errors) |
 | `myapi fn list` | List functions in your org |
 | `myapi fn get <id>` | Inspect a function (name, trigger, invocation URL) |
-| `myapi fn delete <id>` | Soft-delete the record + revoke the scoped key |
+| `myapi fn delete <id>` | Soft-delete the record + revoke the scoped API key |
 <!-- generated:end -->
 
 ## Examples
@@ -50,9 +50,9 @@ Name rules (validated client- and server-side, kept identical):
 myapi fn create --name my-app-api
 # → Function created: fn_abc123
 #   Scoped API key (returned once — save it if you need it):
-#     hq_live_...   (scoped keys are not visually distinct from account keys)
+#     hq_live_...   (scoped API keys are not visually distinct from account keys)
 
-# Deploy a single-file JS bundle → goes live, scoped key is rotated
+# Deploy a single-file JS bundle → goes live, scoped API key is rotated
 myapi fn deploy fn_abc123 ./dist/bundle.js
 # → Deployed function fn_abc123
 #   Invocation URL:  https://fn-abc123.<...>.workers.dev
@@ -74,17 +74,17 @@ myapi fn create --name mailer --scope email,storage
 myapi fn list
 myapi fn get fn_abc123
 
-# Delete (revokes the scoped key — future calls with it return 401)
+# Delete (revokes the scoped API key — future calls with it return 401)
 myapi fn delete fn_abc123
 ```
 
-### Using the scoped key
+### Using the scoped API key
 
 ```bash
-# Save the key returned at create/deploy time
+# Save the API key returned at create/deploy time
 SCOPED_KEY="hq_live_..."
 
-# Call slots the key was granted — works (within its org + grants)
+# Call slots the API key was granted — works (within its org + grants)
 curl -H "Authorization: Bearer $SCOPED_KEY" \
   https://api.myapihq.com/database/orgs/$ORG_ID/namespaces
 
@@ -99,6 +99,6 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 
 - The bundle is a **single JavaScript file** (≤4MB). Bundle your dependencies before deploy (esbuild/rollup/etc.).
 - `--cron` is set at create time; the trigger type is fixed for the function's lifetime.
-- Deploy rotates the scoped key on every call — re-capture the printed value if other systems use it.
+- Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
 
 Run `myapi fn --help` or `myapi fn <subcommand> --help` for full flag reference.

package/dist/skills/my-git-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Hosted git repositories over HTTP. Create repos, read history (log/show/tree/blob/diff), and write atomically (commit/branch/tag/merge) — no clone needed. Real `git clone`/`push` also work over HTTPS with your API key as the password.
 triggers: [git, repo, repository, clone, push, commit, branch, tag, merge, diff, version control, source control, vcs]
-checksum: sha256-a059c8f2b59205a1d66ecf70556b60fa3a3606044aaa54e242344ea652efb5e9
+checksum: sha256-921cedea836edac33fefabfb46102e241d2618529db2e307cc73f4d910e7fee3
 ---
 
 # MyGitAPI
@@ -90,7 +90,7 @@ myapi git delete-branch my-app feature
 ### Clone & push with real git
 Hosted repos speak the real git smart-HTTP protocol. Clone, fetch, and push
 over HTTPS with **HTTP Basic auth — your MyAPI API key is the password**, any
-username works (git accepts the key in either field).
+username works (git accepts the API key in either field).
 
 ```bash
 # URL: https://git.mygitapi.com/<org-slug>/<repo>.git
@@ -100,7 +100,7 @@ username works (git accepts the key in either field).
 # Clone (key as password; "x" is a throwaway username)
 git clone https://x:$MYAPI_KEY@git.mygitapi.com/my-org-slug/my-app.git
 
-# Or set the remote and let git prompt for the password (paste the key)
+# Or set the remote and let git prompt for the password (paste the API key)
 git remote add origin https://git.mygitapi.com/my-org-slug/my-app.git
 git push origin main
 ```
@@ -117,6 +117,6 @@ surface never leaks which repos exist).
 - **`commit --base`** is the concurrency guard: pass the expected tip SHA to reject a stale write, or `--base ""` to require the branch be newly created. Omit it to create-or-update.
 - **Metering.** A `git push` (and `myapi git commit`) is metered like a commit. Clone/fetch (`upload-pack`) is free.
 - **Limits.** A push body is capped at 100 MiB; per-repo size limits apply (a push past the cap is reported as a receive-pack failure).
-- **Auth field.** git may put the key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the key into `.git/config`; use a credential helper for anything persistent.
+- **Auth field.** git may put the API key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the API key into `.git/config`; use a credential helper for anything persistent.
 
 Run `myapi git --help` for the full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -41,7 +41,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.7.0"
+    "@myapihq/sdk": "^2.7.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",