@myapihq/cli 2.7.2 → 2.9.0

package/dist/commands/container.d.ts

@@ -17,6 +17,7 @@ export declare function deploy(id: string, image: string, flags: Flags): Promise
 export declare function _parseSmoke(raw: string): sdkContainer.SmokeCheck;
 export declare function revisions(id: string, flags: Flags): Promise<void>;
 export declare function promote(id: string, revision: string | undefined, flags: Flags): Promise<void>;
+export declare function rollback(id: string, flags: Flags): Promise<void>;
 export declare function logs(id: string, flags: Flags): Promise<void>;
 export declare function domain(id: string, domainArg: string | undefined, flags: Flags): Promise<void>;
 export declare function buildLogs(id: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -239,17 +239,16 @@ export async function deploy(id, image, flags) {
     // write their own; a guard that silently passes makes them stop. Restore
     // these the moment the upstream fix lands — see
     // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
-    if (flags['no-promote'] === true || typeof flags.smoke === 'string') {
-        const which = flags['no-promote'] === true ? '--no-promote' : '--smoke';
-        error(`${which} is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was guarded.\n\n` +
-            'It shipped in 2.7.0 and does not work end to end on either deploy path:\n' +
-            '  --source     the API accepts only the tarball on that path; the flag never reaches it\n' +
-            '  <image-ref>  the API accepts the flag, then fails while moving traffic\n\n' +
-            'Until it lands, the safe sequence is:\n' +
-            `  1. deploy to a non-production container first\n` +
-            `  2. check it yourself (curl for a string only a real build emits)\n` +
-            `  3. deploy the same image to production\n\n` +
-            'Reported upstream; this message goes away when the flag works.');
+    // --smoke is still not honoured; --no-promote was fixed upstream on
+    // 2026-07-28 and works on both deploy paths. Refusing what does not work
+    // beats accepting it, and un-refusing what does beats obstructing.
+    if (typeof flags.smoke === 'string') {
+        error('--smoke is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was checked.\n\n' +
+            'Use --no-promote instead, which now works:\n' +
+            '  1. myapi container deploy <id> <image> --no-promote\n' +
+            '  2. curl the revision URL it prints, for a string only a real build emits\n' +
+            '  3. myapi container promote <id> <revision>\n\n' +
+            'That is the same verify-then-promote, done by you rather than the platform.');
     }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
@@ -258,6 +257,11 @@ export async function deploy(id, image, flags) {
     if (source && image) {
         error('Pass either an image ref or --source, not both.');
     }
+    // Built once, passed to BOTH branches. The original bug was building these
+    // inside the image branch only, so a --source deploy dropped them silently.
+    const deployOpts = {};
+    if (flags['no-promote'] === true)
+        deployOpts.promote = false;
     // ── Source-build path (async) ───────────────────────────────────────────
     if (source) {
         let tarball;
@@ -281,7 +285,7 @@ export async function deploy(id, image, flags) {
         else {
             error(`--source must be a directory or a .tar/.tar.gz/.tgz archive — got ${source}`);
         }
-        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename);
+        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename, deployOpts);
         if (flags.json && start.status !== 'building') {
             printJson(start);
             return;
@@ -320,10 +324,7 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    // No DeployOptions built here: --no-promote and --smoke are refused above
-    // until the upstream fix lands. The SDK still carries them so the wiring is
-    // one commit away, and sdk-container.test.ts keeps them covered.
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, deployOpts);
     if (flags.json) {
         printJson(result);
         return;
@@ -331,9 +332,18 @@ export async function deploy(id, image, flags) {
     // An unpromoted revision must NOT read like a completed deploy. A response
     // that looked the same either way is how an agent concludes it has shipped
     // when it has not — the original outage in miniature.
-    // Unreachable while the flags are refused above. Kept because it is the
-    // render we want the moment they are restored, and deleting it would mean
-    // rewriting it from memory later.
+    // Read `promoted` rather than assuming --no-promote was honoured. On a
+    // container's FIRST deploy there is nothing already serving to hold traffic,
+    // so the platform promotes anyway and says so — reporting "not serving"
+    // there would be the lie this flag exists to prevent.
+    if (flags['no-promote'] === true && result.promoted !== false) {
+        success(`Deployed container ${id} (revision ${result.revision_id})`);
+        info('');
+        info('Note: --no-promote was NOT applied. This container had nothing already');
+        info('serving, so withholding traffic would have left it answering nothing.');
+        info(`URL:             ${result.url}`);
+        return;
+    }
     if (result.promoted === false) {
         success(`Revision ${result.revision_id} built — NOT serving traffic`);
         info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
@@ -417,13 +427,14 @@ export async function revisions(id, flags) {
     // state.
     //
     // Say so rather than render a table that reads as "nothing is live".
+    // The 0%-everywhere reporting bug was fixed upstream on 2026-07-28 (a v2
+    // traffic target of type LATEST carries no revision name, so 100% was filed
+    // under ""). Keeping a narrower check: all-zero on an active container is
+    // still worth flagging, it is just no longer expected.
     if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
         info('');
-        info('Note: every revision reports 0% traffic while this container is active and serving.');
-        info('The traffic column is wrong, not the container. Verified on a container created');
-        info('today, so this is not limited to older ones — an earlier version of this message');
-        info('said redeploying fixes it, which was wrong.');
-        info('promote depends on this data and currently fails. Reported upstream.');
+        info('Note: no revision reports any traffic while this container is active.');
+        info('That should not happen — report it rather than trusting the column.');
     }
 }
 // promote moves all traffic to one revision. Omitting the revision rolls back
@@ -447,16 +458,25 @@ export async function promote(id, revision, flags) {
     if (res.message)
         info(res.message);
 }
-// Not a command — guidance for a word that is not one. See the dispatch note.
-function rollbackGuidance(id) {
-    const ref = id || '<id>';
-    error('There is no `rollback` subcommand — rolling back is promoting an older revision.\n\n' +
-        `  myapi container revisions ${ref}          # find the last good revision\n` +
-        `  myapi container promote ${ref} <revision> # traffic moves in seconds\n\n` +
-        'Heads up: the platform currently reports 0% traffic on every revision of any\n' +
-        'container deployed before 2026-07-28, and its own roll-back-to-previous path\n' +
-        'returns a gateway error. Promoting a revision BY NAME works and is unaffected —\n' +
-        'use that. Reported upstream.');
+// rollback moves traffic to the previous ready revision. The API models it as
+// `promote` with no revision named — one operation, two targets — but
+// `rollback` is the word someone types during an incident, so it is a verb
+// here even though the SDK has a single function.
+export async function rollback(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container rollback <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container rollback <id>');
+    const res = await sdkContainer.promoteRevision(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Rolled back ${id} to the previous ready revision`);
+    if (res.serving)
+        info(`Now serving:     ${res.serving}`);
+    if (res.message)
+        info(res.message);
 }
 // logs prints the container's recent runtime logs, newest first. By default
 // this is the container's own stdout/stderr; --scope all adds the platform
@@ -565,19 +585,25 @@ Two ways to deploy:
            built server-side (typically ~4 minutes), then deployed.
            Asynchronous — the CLI polls until it's live.
 
-TEMPORARILY REFUSED: --no-promote and --smoke
+Options:
+  --no-promote   Build the revision without giving it traffic, on either
+                 deploy path. Prints a revision URL to test at, then:
+                 myapi container promote <id> <revision>
 
-  Both shipped in 2.7.0 and do not work end to end. Rather than accept a flag
-  and deploy anyway, the CLI now refuses them and explains what to do instead.
-  A guard that silently passes is worse than no guard.
+                 On a container's FIRST deploy there is nothing already
+                 serving, so traffic is NOT withheld and the output says so.
 
-  Until they land: deploy to a non-production container, verify it yourself,
-  then deploy the same image to production.
+  --smoke        Still refused — the platform accepts it and does nothing.
+                 --no-promote gives you the same verify-then-promote by hand.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz`,
+  myapi container deploy <id> <image> --no-promote`,
+    'rollback': `myapi container rollback <id> [--org <id>] [--json]
+
+Move traffic back to the previous ready revision. Seconds, no rebuild.
+Refuses rather than guessing when it cannot tell what is serving.`,
     'revisions': `myapi container revisions <id> [--org <id>] [--json]
 
 Every revision the runtime currently holds, newest first, with the traffic
@@ -629,6 +655,7 @@ Subcommands:
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
   promote <id> <rev>   Move all traffic to a revision (seconds, no rebuild)
   revisions <id>       List revisions and the traffic each takes
+  rollback <id>        Move traffic back to the previous ready revision
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -652,12 +679,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'promote': return promote(args[0], args[1], flags);
         case 'domain': return domain(args[0], args[1], flags);
         case 'delete': return del(args[0], flags);
-        // `rollback` is the word people reach for during an incident, and it is
-        // NOT a verb here — the API models rollback as `promote` with no revision.
-        // A bare "unknown subcommand" would cost minutes at the worst possible
-        // moment, so say what to do instead, and be honest that the underlying
-        // call is currently broken rather than let someone discover that live.
-        case 'rollback': return rollbackGuidance(args[0]);
+        case 'rollback': return rollback(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/feedback.d.ts

@@ -0,0 +1,10 @@
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare function list(flags: Flags): Promise<void>;
+export declare function create(bodyArg: string | undefined, flags: Flags): Promise<void>;
+export declare function resolve(id: string, flags: Flags): Promise<void>;
+export declare function widget(sub: string | undefined, arg: string | undefined, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/feedback.js

@@ -0,0 +1,174 @@
+// `myapi feedback` — collect what the people using your product tell you.
+//
+// The slot shipped on 2026-07-28 with five endpoints and no CLI. A primitive
+// with no surface is one nobody finds, which is the failure this repo spent a
+// week fixing: two customers concluded a shipped capability did not exist
+// because nothing they read mentioned it.
+import { feedback as sdkFeedback } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, info, printTable, printJson, banner } from '../output.js';
+import { formatDate } from '../utils.js';
+import { requireOrg, requireArg, confirmDestructive } from '../helpers.js';
+export const EXPOSES = [
+    'GET /feedback/orgs/{org_id}/items',
+    'POST /feedback/orgs/{org_id}/items',
+    'POST /feedback/orgs/{org_id}/items/{id}/resolve',
+    'POST /feedback/orgs/{org_id}/widgets',
+    'DELETE /feedback/orgs/{org_id}/widgets/{id}',
+];
+export const SCHEMA = {
+    kind: 'string',
+    status: 'string',
+    body: 'string',
+    'page-url': 'string',
+    route: 'string',
+    origins: 'string',
+};
+// The platform's enum, checked against the schema rather than invented.
+const KINDS = ['bug', 'issue', 'suggestion'];
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi feedback list [--kind <k>] [--status open|resolved] [--org <id>]');
+    if (flags.kind !== undefined && !KINDS.includes(flags.kind)) {
+        error(`Invalid --kind "${flags.kind}". Use one of: ${KINDS.join(', ')}.`);
+    }
+    if (flags.status !== undefined && flags.status !== 'open' && flags.status !== 'resolved') {
+        error(`Invalid --status "${flags.status}". Use "open" or "resolved".`);
+    }
+    const page = await sdkFeedback.listFeedback(config.api_key, orgId, {
+        kind: flags.kind,
+        status: flags.status,
+        limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
+    });
+    if (flags.json) {
+        printJson(page);
+        return;
+    }
+    // `total` here is the match count, not the page size — the platform states
+    // that explicitly, having been bitten by the opposite in CRM search.
+    const shown = page.items?.length ?? 0;
+    info(shown === page.total ? `${shown} item${shown === 1 ? '' : 's'}` : `${shown} of ${page.total} items`);
+    printTable((page.items ?? []).map(i => ({
+        id: i.id,
+        kind: i.kind,
+        status: i.status,
+        body: i.body.length > 60 ? `${i.body.slice(0, 57)}…` : i.body,
+        route: i.route ?? i.page_url ?? '',
+        created: i.created_at ? formatDate(i.created_at) : '',
+    })), { flags, empty: 'No feedback yet. Put a widget on a page: myapi feedback widget create <name>' });
+    if (page.has_more)
+        info('More available — raise --limit or pass --offset.');
+}
+export async function create(bodyArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi feedback create "<text>" --kind <k> [--org <id>]');
+    const body = bodyArg ?? flags.body;
+    requireArg(body, 'text', 'myapi feedback create "<text>" --kind bug');
+    const kind = flags.kind ?? 'issue';
+    if (!KINDS.includes(kind)) {
+        error(`Invalid --kind "${kind}". Use one of: ${KINDS.join(', ')}.\n\n→ Kind is what the PERSON says it is. "bug" is a claim that the product is broken; do not infer it from the wording.`);
+    }
+    const item = await sdkFeedback.createFeedback(config.api_key, orgId, {
+        kind: kind,
+        body: body,
+        page_url: typeof flags['page-url'] === 'string' ? flags['page-url'] : undefined,
+        route: typeof flags.route === 'string' ? flags.route : undefined,
+    });
+    if (flags.json) {
+        printJson(item);
+        return;
+    }
+    success(`Recorded ${item.kind}: ${item.id}`);
+}
+export async function resolve(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi feedback resolve <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi feedback resolve <id>');
+    await sdkFeedback.resolveFeedback(config.api_key, orgId, id);
+    // Already-resolved and not-found answer identically, so this is not proof
+    // the id existed. Say so rather than implying a state change happened.
+    success(`Resolved ${id}`);
+    info('(An unknown id answers the same way, so this is not confirmation the item existed.)');
+}
+export async function widget(sub, arg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi feedback widget create <name> | revoke <id>');
+    if (sub === 'create') {
+        requireArg(arg, 'name', 'myapi feedback widget create <name> [--origins a.com,b.com]');
+        const origins = typeof flags.origins === 'string'
+            ? flags.origins.split(',').map(s => s.trim()).filter(Boolean)
+            : undefined;
+        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins);
+        if (flags.json) {
+            printJson(w);
+            return;
+        }
+        success(`Widget created: ${w.id}`);
+        info(`Key:  ${w.key}`);
+        info('');
+        // Saying this plainly matters: a value that looks like a credential and is
+        // not one gets treated as a secret, and then nobody puts it in the page.
+        info('This key is PUBLIC. It ships in your page source and authenticates nobody —');
+        info('it names your org so a visitor can submit without signing in.');
+        if (!origins?.length) {
+            banner('No --origins set, so any site can post through this key. Set them unless that is intended.');
+        }
+        return;
+    }
+    if (sub === 'revoke') {
+        requireArg(arg, 'id', 'myapi feedback widget revoke <id>');
+        await confirmDestructive(flags, `revoke widget ${arg} (submissions with it stop immediately)`, 'myapi feedback widget revoke <id> [--yes] [--org <id>]');
+        await sdkFeedback.revokeWidget(config.api_key, orgId, arg);
+        success(`Widget ${arg} revoked`);
+        info('Feedback already collected through it is kept.');
+        return;
+    }
+    error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget revoke <id>');
+}
+const SUBCOMMAND_USAGE = {
+    'list': `myapi feedback list [--kind bug|issue|suggestion] [--status open|resolved]
+       [--limit N] [--offset N] [--org <id>] [--json]
+
+Newest first. \`total\` is the number of matches, not the page size.`,
+    'create': `myapi feedback create "<text>" --kind <k> [--page-url <url>] [--route <path>] [--org <id>]
+
+--kind is what the person reporting says it is, not what the text sounds like.`,
+    'resolve': 'myapi feedback resolve <id> [--org <id>]',
+    'widget': `myapi feedback widget create <name> [--origins a.com,b.com] [--org <id>]
+       myapi feedback widget revoke <id> [--yes] [--org <id>]
+
+The key a widget mints is PUBLIC — it ships in page source and authenticates
+nobody. --origins stops another site posting through it.`,
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi feedback <subcommand>
+
+Collect feedback from the people using what you built. A widget key lets a
+page submit without a credential; you list, filter and resolve the results.
+
+Subcommands:
+  create "<text>"      Record one piece of feedback (--kind bug|issue|suggestion)
+  list                 List feedback, newest first (--kind, --status, --limit, --offset)
+  resolve <id>         Close a piece of feedback
+  widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)
+  widget revoke <id>   Revoke a widget key; collected feedback is kept
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        info(usage ? `Usage: ${usage}` : `Unknown subcommand: ${subcommand}. Run "myapi feedback --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(args[0], flags);
+        case 'list': return list(flags);
+        case 'resolve': return resolve(args[0], flags);
+        case 'widget': return widget(args[0], args[1], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi feedback --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/flag-reachability.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/flag-reachability.test.js

@@ -0,0 +1,287 @@
+// Does the flag REACH the call, or does it only parse?
+//
+// This file exists because of a bug we shipped and a customer found.
+//
+// `container deploy --no-promote` was wired to the pre-built-image path and
+// not to the `--source` path. `deployContainerSource()` was called without the
+// options object, so on a source build the flag was accepted and silently
+// discarded. Both flags were declared in the command schema, so the
+// foreign-flag check stayed quiet too. A team deployed with it, the build took
+// 100% of traffic anyway, and they reported it.
+//
+// The tests we had at the time all passed. They tested `_parseSmoke` (a pure
+// parser) and `deployContainer` (the SDK function). Nothing tested the CLI
+// handler, so nothing noticed that one of its two branches never passed the
+// options along. The backend hit the identical shape the same day and put it
+// better than we can:
+//
+//   "Counting call sites proves the helper is CALLED, not that it is REACHED."
+//
+// Ours is: testing the parser proves the flag PARSES, not that it is SENT.
+//
+// So this file tests HANDLERS, with the SDK mocked, asserting what actually
+// arrives at the boundary. Every case below is a real field report. When you
+// add a flag that changes a request, add a case here — a unit test on its
+// parser is not cover.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+// The SDK is mocked wholesale so we can see exactly what the handler passes.
+// Typed loosely on purpose: the later describes assign whole slot objects
+// (sdk.task = {...}) and TS would otherwise reject each one. The assertions
+// still check real shapes.
+const sdk = vi.hoisted(() => ({
+    container: {
+        deployContainer: vi.fn(),
+        deployContainerSource: vi.fn(),
+        getContainerLogs: vi.fn(),
+        listContainers: vi.fn(),
+        getContainer: vi.fn(),
+        listRevisions: vi.fn(),
+        promoteRevision: vi.fn(),
+        createContainer: vi.fn(),
+    },
+    crm: { searchContacts: vi.fn(), searchCompanies: vi.fn() },
+    fn: { listFunctions: vi.fn() },
+    // Top-level SDK exports the handlers reach for. Mocking the module
+    // wholesale drops anything not listed, and the failure reads as a missing
+    // export rather than a missing mock — so they are enumerated explicitly.
+    withFundsRetry: vi.fn(async (f) => f()),
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+let exitError;
+beforeEach(async () => {
+    exitError = null;
+    vi.clearAllMocks();
+    const output = await import('../output.js');
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        exitError = m;
+        throw new Error('__EXIT__');
+    }));
+    vi.spyOn(output, 'info').mockImplementation(() => { });
+    vi.spyOn(output, 'success').mockImplementation(() => { });
+    vi.spyOn(output, 'printTable').mockImplementation(() => { });
+    vi.spyOn(output, 'printJson').mockImplementation(() => { });
+    vi.spyOn(output, 'banner').mockImplementation(() => { });
+});
+afterEach(() => vi.restoreAllMocks());
+// Runs a handler and swallows the synthetic exit thrown by a mocked error().
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('container deploy — --no-promote must REACH both paths', () => {
+    // This is the original bug in its final form. --no-promote was wired to the
+    // image branch only, so a --source deploy accepted it and dropped it, and
+    // the build took 100% of traffic. The platform has since fixed its side and
+    // the flag works on both paths — so the assertion flips from "is refused" to
+    // "arrives", and the bug it guards is the same one either way.
+    const DEPLOYED = {
+        container_id: 'c1', revision_id: 'r1', url: 'https://x',
+        status: 'active', scoped_api_key: 'k', promoted: false,
+        revision_url: 'https://rev---x.run.app',
+    };
+    it('sends promote:false on the image path', async () => {
+        sdk.container.deployContainer.mockResolvedValue(DEPLOYED);
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', { promote: false });
+    });
+    // The branch that shipped broken. It reads a real tarball, so the assertion
+    // is that the options object reaches the call — argument 6.
+    it('sends promote:false on the --source path', async () => {
+        sdk.container.deployContainerSource.mockResolvedValue({ container_id: 'c1', revision_id: 'r1', status: 'building' });
+        sdk.container.getContainer.mockResolvedValue({ id: 'c1', status: 'active', url: 'https://x' });
+        const { _isTarball } = await import('./container.js');
+        void _isTarball;
+        const { deploy } = await import('./container.js');
+        const fsp = await import('node:fs/promises');
+        const tmp = `${process.env.TMPDIR ?? '/tmp'}/reach-${Date.now()}.tar.gz`;
+        await fsp.writeFile(tmp, 'not-a-real-tarball');
+        await run(() => deploy('c1', '', { source: tmp, 'no-promote': true, org: ORG }));
+        await fsp.rm(tmp, { force: true });
+        expect(sdk.container.deployContainerSource).toHaveBeenCalled();
+        expect(sdk.container.deployContainerSource.mock.calls[0][5]).toEqual({ promote: false });
+    });
+    it('sends no options at all when the flag is absent', async () => {
+        sdk.container.deployContainer.mockResolvedValue({ ...DEPLOYED, promoted: true });
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', {});
+    });
+    // --smoke is still not honoured upstream, and refusing beats accepting.
+    it('still refuses --smoke, on either path', async () => {
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains x', org: ORG }));
+        expect(exitError).toMatch(/--smoke is not honoured yet/);
+        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+    });
+});
+describe('crm pagination — --offset must reach the SDK', () => {
+    // Reported by a customer as returning page one forever. The API ignored it
+    // at the time; once fixed, the CLI had to actually send it, and only a
+    // handler-level test proves that.
+    beforeEach(() => {
+        sdk.crm.searchContacts.mockResolvedValue({ contacts: [], total: 0, has_more: false });
+        sdk.crm.searchCompanies.mockResolvedValue({ companies: [], total: 0, has_more: false });
+    });
+    it('passes --offset through on contacts list', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['list'], { offset: 25, limit: 10, org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 25, limit: 10 }));
+    });
+    it('passes --offset through on contacts search, alongside filters', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['search'], { offset: 5, origin: 'webhook', org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 5 }));
+    });
+    it('passes --offset through on companies', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('companies', ['list'], { offset: 7, org: ORG }));
+        expect(sdk.crm.searchCompanies).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 7 }));
+    });
+    // The deprecated spelling must still reach the request, or the alias is a
+    // promise we are not keeping.
+    it('still honours the deprecated --source spelling for provenance', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['search'], { source: 'goldfox', org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: ['goldfox'] }));
+    });
+});
+describe('container logs — --scope must reach the SDK', () => {
+    it('sends scope=all when asked', async () => {
+        sdk.container.getContainerLogs.mockResolvedValue([]);
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { scope: 'all', tail: 500, org: ORG }));
+        expect(sdk.container.getContainerLogs).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 500, 'all');
+    });
+    it('sends no scope by default, rather than the string "container"', async () => {
+        sdk.container.getContainerLogs.mockResolvedValue([]);
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { org: ORG }));
+        expect(sdk.container.getContainerLogs).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', undefined, undefined);
+    });
+    it('refuses an invalid scope instead of passing it on', async () => {
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { scope: 'everything', org: ORG }));
+        expect(exitError).toMatch(/Invalid --scope/);
+        expect(sdk.container.getContainerLogs).not.toHaveBeenCalled();
+    });
+});
+describe('container create — --health-check is validated before the call', () => {
+    it('refuses /healthz client-side and never calls the SDK', async () => {
+        const { create } = await import('./container.js');
+        await run(() => create('probe', { 'health-check': '/healthz', org: ORG }));
+        expect(exitError).toMatch(/intercepts \/healthz/);
+        expect(sdk.container.createContainer).not.toHaveBeenCalled();
+    });
+    it('refuses a path that is not a path', async () => {
+        const { create } = await import('./container.js');
+        await run(() => create('probe', { 'health-check': 'livez', org: ORG }));
+        expect(exitError).toMatch(/must be a path/);
+        expect(sdk.container.createContainer).not.toHaveBeenCalled();
+    });
+});
+// ── Wider coverage ──────────────────────────────────────────────────────────
+//
+// The cases above are the ones a customer found. These are the same class of
+// risk elsewhere: a flag that changes WHAT GETS WRITTEN, where losing it in
+// transit produces a wrong record rather than an error.
+//
+// Coverage is partial and worth stating: this file exercises 8 commands of the
+// 32 that take flags. It covers the ones where a dropped flag is silent and
+// consequential. `list`/`get` verbs are omitted deliberately — a dropped
+// filter there is visible in the output, which is a different and much
+// cheaper failure.
+describe('task create — flags that change the stored record', () => {
+    beforeEach(() => { sdk.task = { createTask: vi.fn().mockResolvedValue({ id: 't1' }), listTasks: vi.fn().mockResolvedValue([]) }; });
+    it('sends --dedup-key, which is what makes creation idempotent', async () => {
+        const { create } = await import('./task.js');
+        await run(() => create('do a thing', { 'dedup-key': 'evt-123', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ dedupKey: 'evt-123' }));
+    });
+    it('sends --origin, and still honours the deprecated --source', async () => {
+        const { create } = await import('./task.js');
+        await run(() => create('x', { origin: 'agent', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'agent' }));
+        vi.clearAllMocks();
+        await run(() => create('x', { source: 'legacy', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'legacy' }));
+    });
+});
+describe('webhook create — the CRM ingest path must survive', () => {
+    beforeEach(() => { sdk.webhook = { createEndpoint: vi.fn().mockResolvedValue({ id: 'w1', url: 'u' }) }; });
+    // Losing this silently means submissions stop becoming contacts, with no
+    // error anywhere — the endpoint keeps accepting deliveries.
+    it('sends --crm-email-path', async () => {
+        const { create } = await import('./webhook.js');
+        await run(() => create('stripe', { 'crm-email-path': 'data.object.customer_email', org: ORG }));
+        const [, , , opts] = sdk.webhook.createEndpoint.mock.calls[0];
+        expect(opts).toMatchObject({ crm_email_path: 'data.object.customer_email' });
+    });
+    it('sends --forward-url', async () => {
+        const { create } = await import('./webhook.js');
+        await run(() => create('gh', { 'forward-url': 'https://example.com/hook', org: ORG }));
+        const [, , , opts] = sdk.webhook.createEndpoint.mock.calls[0];
+        expect(opts).toMatchObject({ forward_url: 'https://example.com/hook' });
+    });
+});
+describe('audience create — --from selects the dataset', () => {
+    beforeEach(() => { sdk.audience = { createAudience: vi.fn().mockResolvedValue({ id: 'a1', member_count: 0 }) }; });
+    // Picking the wrong dataset builds an audience of the wrong KIND of record.
+    // Nothing errors; the list is simply of companies when you wanted people.
+    it('sends --from', async () => {
+        const { run: audRun } = await import('./audience.js');
+        await run(() => audRun('create', ['my-list'], { from: 'company', filter: '{}', org: ORG }));
+        expect(sdk.audience.createAudience).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'company' }));
+    });
+    it('still honours the deprecated --source spelling', async () => {
+        const { run: audRun } = await import('./audience.js');
+        await run(() => audRun('create', ['my-list'], { source: 'people', filter: '{}', org: ORG }));
+        expect(sdk.audience.createAudience).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'people' }));
+    });
+});
+describe('git commit — authorship must not silently default', () => {
+    beforeEach(() => {
+        sdk.git = {
+            commit: vi.fn().mockResolvedValue({ sha: 'abc1234' }),
+            // The handler resolves the branch tip before committing; without this it
+            // refuses rather than guessing a base, which is the right behaviour and
+            // has to be satisfied to reach the call we are testing.
+            listRefs: vi.fn().mockResolvedValue({ branches: [{ name: 'main', sha: 'base123' }] }),
+        };
+    });
+    // Without these every agent-written commit is attributed to the key's
+    // account — wrong quietly rather than loudly.
+    it('sends --author-name and --author-email', async () => {
+        const { commit } = await import('./git.js');
+        await run(() => commit('repo', {
+            branch: 'main', message: 'm',
+            changes: '[{"path":"a.txt","content":"hi"}]',
+            'author-name': 'Ada', 'author-email': 'ada@example.com', org: ORG,
+        }));
+        expect(sdk.git.commit).toHaveBeenCalled();
+        const payload = sdk.git.commit.mock.calls[0][3];
+        expect(payload.author).toMatchObject({ name: 'Ada', email: 'ada@example.com' });
+    });
+    it('omits author entirely when neither flag is given', async () => {
+        const { commit } = await import('./git.js');
+        await run(() => commit('repo', {
+            branch: 'main', message: 'm', changes: '[{"path":"a.txt","content":"hi"}]', org: ORG,
+        }));
+        expect(sdk.git.commit.mock.calls[0][3].author).toBeUndefined();
+    });
+});

package/dist/commands/llm.d.ts

@@ -3,4 +3,5 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export declare function _parseJsonObjectFlag(raw: unknown, flagName: string): Record<string, unknown> | undefined;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/llm.js

@@ -24,6 +24,9 @@ export const SCHEMA = {
     schema: 'string',
     style: 'string',
     kind: 'string',
+    facts: 'string',
+    directives: 'string',
+    // Deprecated alias for --facts; undocumented, removable next minor.
     context: 'string',
     prompt: 'string',
     tier: 'string',
@@ -103,21 +106,33 @@ function parseSchemaFlag(flags) {
         return null;
     }
 }
-function parseContextFlag(flags) {
-    if (typeof flags.context !== 'string' || !flags.context)
+// --facts is referent data quoted into the prompt as reference; --directives
+// are writer controls (tone, max_words, format). The platform split them
+// because they are trusted differently, and `--context` predated the split.
+export function _parseJsonObjectFlag(raw, flagName) {
+    if (typeof raw !== 'string' || !raw)
         return undefined;
     try {
-        const parsed = JSON.parse(flags.context);
-        if (typeof parsed === 'object' && parsed !== null)
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
             return parsed;
-        error('--context must be a JSON object');
+        }
+        error(`${flagName} must be a JSON object`);
         return undefined;
     }
     catch {
-        error('--context must be valid JSON');
+        error(`${flagName} must be valid JSON`);
         return undefined;
     }
 }
+function parseContextFlag(flags) {
+    // --facts wins; --context is the old spelling and still works.
+    return _parseJsonObjectFlag(flags.facts, '--facts')
+        ?? _parseJsonObjectFlag(flags.context, '--context');
+}
+function parseDirectivesFlag(flags) {
+    return _parseJsonObjectFlag(flags.directives, '--directives');
+}
 function tierFromFlag(flags) {
     if (typeof flags.tier !== 'string' || !flags.tier)
         return undefined;
@@ -269,7 +284,7 @@ async function summarize(inputArg, flags) {
 }
 async function draft(inputArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi llm draft --kind <what> [--prompt "<instructions>"] [--context <json>] ["<source text>"] [--tier <t>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi llm draft --kind <what> [--prompt "<instructions>"] [--facts <json>] ["<source text>"] [--tier <t>] [--org <id>]');
     if (typeof flags.kind !== 'string' || !flags.kind) {
         error('Missing required flag: --kind <email|message|reply|...>');
         return;
@@ -281,12 +296,13 @@ async function draft(inputArg, flags) {
     const promptText = typeof flags.prompt === 'string' ? flags.prompt : '';
     const ctx = parseContextFlag(flags);
     if (!input.trim() && !promptText.trim() && (!ctx || Object.keys(ctx).length === 0)) {
-        error('draft needs at least one of: <source text> (arg or --file), --prompt, or --context.');
+        error('draft needs at least one of: <source text> (arg or --file), --prompt, or --facts.');
     }
     const res = await retryFunds(() => sdkLlm.draft(config.api_key, orgId, {
         input: input || undefined,
         kind,
-        context: ctx,
+        facts: ctx,
+        directives: parseDirectivesFlag(flags),
         prompt: promptText || undefined,
         tier: tierFromFlag(flags),
     }));

package/dist/completion.js

@@ -29,7 +29,7 @@ export const COMMANDS = [
     'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
     'doctor', 'install-skills', 'keys', 'llm', 'login', 'org', 'payments', 'people', 'pixel',
-    'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
+    'feedback', 'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',
 ];
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
@@ -61,6 +61,7 @@ export const SUBCOMMANDS = {
     payments: ['connect', 'status', 'charge', 'list', 'get', 'refund'],
     container: ['create', 'deploy', 'list', 'get', 'logs', 'domain', 'delete'],
     git: ['create', 'list', 'get', 'delete', 'refs', 'log', 'show', 'tree', 'blob', 'diff', 'commit', 'create-branch', 'delete-branch', 'tag', 'merge', 'repack'],
+    feedback: ['create', 'list', 'resolve', 'widget'],
     queue: ['create', 'list', 'get', 'delete', 'enqueue', 'jobs', 'job'],
     task: ['create', 'list', 'get', 'claim', 'extend', 'resolve', 'fail', 'cancel'],
     completion: ['install', 'uninstall'],

package/dist/exposes.test.js

@@ -42,6 +42,7 @@ const COMMAND_MODULES = [
     './commands/payments.js',
     './commands/container.js',
     './commands/git.js',
+    './commands/feedback.js',
     './commands/queue.js',
     './commands/task.js',
     './commands/doctor.js',

package/dist/index.js

@@ -41,6 +41,7 @@ import * as paymentsCmd from './commands/payments.js';
 import * as containerCmd from './commands/container.js';
 import * as gitCmd from './commands/git.js';
 import * as queueCmd from './commands/queue.js';
+import * as feedbackCmd from './commands/feedback.js';
 import * as taskCmd from './commands/task.js';
 import * as doctorCmd from './commands/doctor.js';
 import * as loginCmd from './commands/login.js';
@@ -85,6 +86,7 @@ const COMMAND_SCHEMAS = {
     people: peopleCmd.SCHEMA,
     pixel: pixelCmd.SCHEMA,
     queue: queueCmd.SCHEMA,
+    feedback: feedbackCmd.SCHEMA,
     status: statusCmd.SCHEMA,
     storage: storageCmd.SCHEMA,
     task: taskCmd.SCHEMA,
@@ -134,6 +136,7 @@ const COMBINED_SCHEMA = {
     ...containerCmd.SCHEMA,
     ...gitCmd.SCHEMA,
     ...queueCmd.SCHEMA,
+    ...feedbackCmd.SCHEMA,
     ...taskCmd.SCHEMA,
     ...doctorCmd.SCHEMA,
     ...loginCmd.SCHEMA,
@@ -258,6 +261,9 @@ async function main() {
             case 'queue':
                 await queueCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'feedback':
+                await feedbackCmd.run(subcommand, restArgs, flags);
+                break;
             case 'task':
                 await taskCmd.run(subcommand, restArgs, flags);
                 break;
@@ -463,6 +469,7 @@ Commands:
   doctor          Org-wide consistency check — funnels, webhooks, domains, containers
   domain          Manage domain configurations
   email           Manage mailboxes, send/read email, templates, and campaigns
+  feedback        Collect feedback from the people using what you built
   fn              Create and deploy functions on the edge runtime
   funnel          Manage websites (publish pages, custom domains, funnels)
   git             Hosted git repositories — repos, commits, branches, history

package/dist/skills/my-function-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-1ef76e07c9fb4f295b491224261b5719314f15d3645c32e6e7b443a7fdaf95c6
+checksum: sha256-a29b3c96645c59317c0896c9a886d9904bdb2ebde9eb8582d0cb7071d0b9ac2c
 ---
 
 # MyFunctionAPI
@@ -129,4 +129,10 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 - Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
 - `myapi fn env <id> --set KEY=VALUE,OTHER=VALUE` sets several secrets in one call instead of one command each.
 
+**`--scope` is create-only, so treat it as permanent.** There is no
+`fn scope --add`. Adding a slot later means delete + recreate, which mints a
+**new function id and a new invocation URL**, breaking every reference already
+handed out — docs, front-end config, webhooks, anything given to a third
+party. Decide the full slot list before you publish the URL.
+
 Run `myapi fn --help` or `myapi fn <subcommand> --help` for full flag reference.

package/dist/skills/my-llm-api/SKILL.md

@@ -7,7 +7,7 @@ description: >
   (classify / extract / summarize / draft) that hide the model behind a
   task. Pricing in cents per 1M tokens; charged from your MyAPI balance.
 triggers: [llm, completion, chat, embed, embedding, inference, classify, extract, summarize, draft, qwen]
-checksum: sha256-6c399da099802637c68eda61ba85a23286ff3dca8f50c391e80ab442777c17c4
+checksum: sha256-2a9070e118134aea98a1be986d29f9c4e3a969aa960e7dfc87137bbc490ac04e
 ---
 
 # MyLLMAPI
@@ -21,9 +21,9 @@ Pricing is cents per 1M tokens at the actual upstream rate, debited from your My
 
 ## Capabilities
 <!-- llm:start -->
-Use this for workflow tasks — summarize a doc, classify an inbound email, extract structured data, draft a reply. The reply goes to stdout; a one-line usage footer (tokens + cost + finish reason) goes to stderr, so `myapi llm complete ... | jq` and similar pipelines work as expected.
+For workflow tasks — summarize, classify, extract, draft. The reply goes to stdout and the usage footer (tokens, cost, finish reason) to stderr, so `myapi llm complete ... | jq` works.
 
-**Don't use this as your own model.** If you're an agent reading this, you already have a more capable model than what's exposed here. Reach for the LLM verbs when you're scripting a recurring step where a small/cheap model is the right tool — not for one-shot reasoning you can just do yourself.
+**Don't use this as your own model.** If you are an agent reading this, you already have a more capable model. Reach for the LLM verbs when scripting a recurring step where a small, cheap model is the right tool — not for one-shot reasoning you can do yourself.
 
 Reach for raw `complete` when shape matters (you build the `messages` array and set `max_tokens`/`temperature`/`stop`); reach for a verb when you want a *result* and don't care which model produced it.
 
@@ -88,7 +88,7 @@ The model/provider is **never** named in the verb response — the verb is the c
 
 ### OpenAI-compatible drop-in
 
-`POST /llm/orgs/{org_id}/chat/completions` (and `/v1/chat/completions` alias) accepts the OpenAI request shape and returns the OpenAI response shape — **no envelope**. Same catalog and pricing as raw `complete`. Use it when existing OpenAI SDK / LangChain / any `base_url`-configurable tooling should point at MyAPI without rewriting.
+`POST /llm/orgs/{org_id}/chat/completions` (alias `/v1/chat/completions`) takes and returns the OpenAI shape — **no envelope**. Same catalog and pricing as `complete`. Use it when an existing OpenAI SDK or LangChain integration should point at MyAPI unchanged.
 
 ```python
 from openai import OpenAI
@@ -160,3 +160,16 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 - **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
 - **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Varies by tier: 200–600 ms to first token, 1–3 s end-to-end.
 - **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.
+
+## `--facts` vs `--directives` on draft
+
+`--facts '<json>'` is referent data, quoted as reference and never as
+instructions (recipient, dates, amounts). `--directives '<json>'` is writer
+controls only: tone, max_words, format, style. They are trusted differently.
+
+```bash
+myapi llm draft --kind email --prompt "the invoice is due" \
+  --facts '{"to":"Ada"}' --directives '{"tone":"warm"}'
+```
+
+`--context` is the old name for `--facts`; accepted, deprecated upstream.

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
+checksum: sha256-1f3e7f6de3435e0334a808b9d2faa978c9cb70982509a376abc0e539cb44e1ed
 ---
 
 # MyStorageAPI
@@ -93,11 +93,17 @@ Both produce identical asset records — `list` doesn't distinguish.
   fetch it; there is no private mode, no signed URL, and no revocation. The id
   being long and random is **not** access control — treat the URL as public the
   moment it exists.
-- **For personal or regulated data, encrypt before upload.** Storage only ever
-  sees ciphertext. A team shipping Swiss lease documents (names, dates of
-  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
-  per-document data key wrapped under a master key held in function secrets.
-  That is the pattern to copy until private assets exist.
+- **Private assets exist as of 2026-07-28** — upload with `visibility: private`,
+  or `PATCH` an existing asset to close an exposure, which takes effect
+  immediately. Fetch it with a signed URL (15 minutes default, 24 hours max);
+  `revoke-links` kills every link already handed out, including unexpired ones.
+  A private upload deliberately returns **no plain `url`**, because that URL
+  does not serve the file and would look like the answer.
+- **Encrypting before upload is still worth doing for the strictest cases.**
+  Private assets protect against the internet; client-side encryption protects
+  against the platform, and those are different threat models. A team shipping
+  Swiss lease documents used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key in function secrets.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.7.2",
+  "version": "2.9.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -38,11 +38,15 @@
     "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
     "lint:skill-coverage": "node scripts/lint-skill-coverage.js",
+    "bench:discoverability": "node scripts/bench-discoverability.js",
+    "lint:claims": "node scripts/verify-claims.js --lint",
+    "verify:claims": "npm run build && node scripts/verify-claims.js",
+    "audit:fields": "npm run build && node scripts/audit-field-honoured.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.7.2"
+    "@myapihq/sdk": "^2.9.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",