@myapihq/cli 2.8.0 → 2.10.0

package/dist/commands/container.d.ts

@@ -17,6 +17,7 @@ export declare function deploy(id: string, image: string, flags: Flags): Promise
 export declare function _parseSmoke(raw: string): sdkContainer.SmokeCheck;
 export declare function revisions(id: string, flags: Flags): Promise<void>;
 export declare function promote(id: string, revision: string | undefined, flags: Flags): Promise<void>;
+export declare function rollback(id: string, flags: Flags): Promise<void>;
 export declare function logs(id: string, flags: Flags): Promise<void>;
 export declare function domain(id: string, domainArg: string | undefined, flags: Flags): Promise<void>;
 export declare function buildLogs(id: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -239,18 +239,6 @@ export async function deploy(id, image, flags) {
     // write their own; a guard that silently passes makes them stop. Restore
     // these the moment the upstream fix lands — see
     // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
-    if (flags['no-promote'] === true || typeof flags.smoke === 'string') {
-        const which = flags['no-promote'] === true ? '--no-promote' : '--smoke';
-        error(`${which} is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was guarded.\n\n` +
-            'It shipped in 2.7.0 and does not work end to end on either deploy path:\n' +
-            '  --source     the API accepts only the tarball on that path; the flag never reaches it\n' +
-            '  <image-ref>  the API accepts the flag, then fails while moving traffic\n\n' +
-            'Until it lands, the safe sequence is:\n' +
-            `  1. deploy to a non-production container first\n` +
-            `  2. check it yourself (curl for a string only a real build emits)\n` +
-            `  3. deploy the same image to production\n\n` +
-            'Reported upstream; this message goes away when the flag works.');
-    }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
     if (!image && typeof flags.image === 'string')
@@ -258,6 +246,33 @@ export async function deploy(id, image, flags) {
     if (source && image) {
         error('Pass either an image ref or --source, not both.');
     }
+    // Built once, passed to BOTH branches. The original bug was building these
+    // inside the image branch only, so a --source deploy dropped them silently.
+    const deployOpts = {};
+    if (flags['no-promote'] === true)
+        deployOpts.promote = false;
+    if (typeof flags.smoke === 'string')
+        deployOpts.smoke = _parseSmoke(flags.smoke);
+    // On a container's FIRST deploy there is no earlier revision to hold
+    // traffic, so the platform runs the assertion against the LIVE url — a
+    // failing build is already serving when you are told it failed. Say so
+    // before the deploy rather than after, because the remedy differs: on any
+    // later deploy a failure is contained, and here it is not.
+    if (deployOpts.smoke || deployOpts.promote === false) {
+        try {
+            const existing = await sdkContainer.listRevisions(config.api_key, orgId, id);
+            if (existing.length === 0) {
+                info('Note: this container has no earlier revision, so there is nothing to hold');
+                info('traffic while the new one is checked. A failing build WILL be serving.');
+                info('Deploy to a non-production container first if that matters.');
+                info('');
+            }
+        }
+        catch { /* advisory only — never block a deploy on it */ }
+    }
+    if (deployOpts.promote === false && deployOpts.smoke) {
+        error('--smoke already withholds traffic until the assertion passes, then promotes.\nUse one or the other: --smoke to verify-and-promote, --no-promote to hold the revision back.');
+    }
     // ── Source-build path (async) ───────────────────────────────────────────
     if (source) {
         let tarball;
@@ -281,7 +296,7 @@ export async function deploy(id, image, flags) {
         else {
             error(`--source must be a directory or a .tar/.tar.gz/.tgz archive — got ${source}`);
         }
-        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename);
+        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename, deployOpts);
         if (flags.json && start.status !== 'building') {
             printJson(start);
             return;
@@ -320,10 +335,7 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    // No DeployOptions built here: --no-promote and --smoke are refused above
-    // until the upstream fix lands. The SDK still carries them so the wiring is
-    // one commit away, and sdk-container.test.ts keeps them covered.
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, deployOpts);
     if (flags.json) {
         printJson(result);
         return;
@@ -331,9 +343,18 @@ export async function deploy(id, image, flags) {
     // An unpromoted revision must NOT read like a completed deploy. A response
     // that looked the same either way is how an agent concludes it has shipped
     // when it has not — the original outage in miniature.
-    // Unreachable while the flags are refused above. Kept because it is the
-    // render we want the moment they are restored, and deleting it would mean
-    // rewriting it from memory later.
+    // Read `promoted` rather than assuming --no-promote was honoured. On a
+    // container's FIRST deploy there is nothing already serving to hold traffic,
+    // so the platform promotes anyway and says so — reporting "not serving"
+    // there would be the lie this flag exists to prevent.
+    if (flags['no-promote'] === true && result.promoted !== false) {
+        success(`Deployed container ${id} (revision ${result.revision_id})`);
+        info('');
+        info('Note: --no-promote was NOT applied. This container had nothing already');
+        info('serving, so withholding traffic would have left it answering nothing.');
+        info(`URL:             ${result.url}`);
+        return;
+    }
     if (result.promoted === false) {
         success(`Revision ${result.revision_id} built — NOT serving traffic`);
         info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
@@ -417,13 +438,14 @@ export async function revisions(id, flags) {
     // state.
     //
     // Say so rather than render a table that reads as "nothing is live".
+    // The 0%-everywhere reporting bug was fixed upstream on 2026-07-28 (a v2
+    // traffic target of type LATEST carries no revision name, so 100% was filed
+    // under ""). Keeping a narrower check: all-zero on an active container is
+    // still worth flagging, it is just no longer expected.
     if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
         info('');
-        info('Note: every revision reports 0% traffic while this container is active and serving.');
-        info('The traffic column is wrong, not the container. Verified on a container created');
-        info('today, so this is not limited to older ones — an earlier version of this message');
-        info('said redeploying fixes it, which was wrong.');
-        info('promote depends on this data and currently fails. Reported upstream.');
+        info('Note: no revision reports any traffic while this container is active.');
+        info('That should not happen — report it rather than trusting the column.');
     }
 }
 // promote moves all traffic to one revision. Omitting the revision rolls back
@@ -447,16 +469,25 @@ export async function promote(id, revision, flags) {
     if (res.message)
         info(res.message);
 }
-// Not a command — guidance for a word that is not one. See the dispatch note.
-function rollbackGuidance(id) {
-    const ref = id || '<id>';
-    error('There is no `rollback` subcommand — rolling back is promoting an older revision.\n\n' +
-        `  myapi container revisions ${ref}          # find the last good revision\n` +
-        `  myapi container promote ${ref} <revision> # traffic moves in seconds\n\n` +
-        'Heads up: the platform currently reports 0% traffic on every revision of any\n' +
-        'container deployed before 2026-07-28, and its own roll-back-to-previous path\n' +
-        'returns a gateway error. Promoting a revision BY NAME works and is unaffected —\n' +
-        'use that. Reported upstream.');
+// rollback moves traffic to the previous ready revision. The API models it as
+// `promote` with no revision named — one operation, two targets — but
+// `rollback` is the word someone types during an incident, so it is a verb
+// here even though the SDK has a single function.
+export async function rollback(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container rollback <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container rollback <id>');
+    const res = await sdkContainer.promoteRevision(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Rolled back ${id} to the previous ready revision`);
+    if (res.serving)
+        info(`Now serving:     ${res.serving}`);
+    if (res.message)
+        info(res.message);
 }
 // logs prints the container's recent runtime logs, newest first. By default
 // this is the container's own stdout/stderr; --scope all adds the platform
@@ -565,19 +596,33 @@ Two ways to deploy:
            built server-side (typically ~4 minutes), then deployed.
            Asynchronous — the CLI polls until it's live.
 
-TEMPORARILY REFUSED: --no-promote and --smoke
+Options:
+  --no-promote   Build the revision without giving it traffic, on either
+                 deploy path. Prints a revision URL to test at, then:
+                 myapi container promote <id> <revision>
 
-  Both shipped in 2.7.0 and do not work end to end. Rather than accept a flag
-  and deploy anyway, the CLI now refuses them and explains what to do instead.
-  A guard that silently passes is worse than no guard.
+                 On a container's FIRST deploy there is nothing already
+                 serving, so traffic is NOT withheld and the output says so.
 
-  Until they land: deploy to a non-production container, verify it yourself,
-  then deploy the same image to production.
+  --smoke '<assertion>'
+                 Deploy, assert against the new revision, and promote it ONLY
+                 if the assertion holds. A failure leaves the previous
+                 revision serving and returns SMOKE_FAILED with a revision URL
+                 to inspect. Works on both deploy paths.
+
+                 Grammar: [GET|HEAD] [/path] [status N] [contains TEXT]
+                 Assert on CONTENT — "returns 200" is true of a placeholder
+                 page too, which is how one reached production and stayed.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz`,
+  myapi container deploy <id> <image> --no-promote
+  myapi container deploy <id> --source ./app --smoke 'GET / contains assets/'`,
+    'rollback': `myapi container rollback <id> [--org <id>] [--json]
+
+Move traffic back to the previous ready revision. Seconds, no rebuild.
+Refuses rather than guessing when it cannot tell what is serving.`,
     'revisions': `myapi container revisions <id> [--org <id>] [--json]
 
 Every revision the runtime currently holds, newest first, with the traffic
@@ -621,14 +666,17 @@ dependencies and long execution.
 Subcommands:
   build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
+                       (--health-check /livez for an HTTP startup probe)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
+                       (--smoke to verify before promoting; --no-promote to hold it back)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
   promote <id> <rev>   Move all traffic to a revision (seconds, no rebuild)
   revisions <id>       List revisions and the traffic each takes
+  rollback <id>        Move traffic back to the previous ready revision
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -652,12 +700,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'promote': return promote(args[0], args[1], flags);
         case 'domain': return domain(args[0], args[1], flags);
         case 'delete': return del(args[0], flags);
-        // `rollback` is the word people reach for during an incident, and it is
-        // NOT a verb here — the API models rollback as `promote` with no revision.
-        // A bare "unknown subcommand" would cost minutes at the worst possible
-        // moment, so say what to do instead, and be honest that the underlying
-        // call is currently broken rather than let someone discover that live.
-        case 'rollback': return rollbackGuidance(args[0]);
+        case 'rollback': return rollback(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/feedback.js

@@ -24,7 +24,8 @@ export const SCHEMA = {
     route: 'string',
     origins: 'string',
 };
-const KINDS = ['bug', 'idea', 'praise', 'confusion', 'other'];
+// The platform's enum, checked against the schema rather than invented.
+const KINDS = ['bug', 'issue', 'suggestion'];
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi feedback list [--kind <k>] [--status open|resolved] [--org <id>]');
@@ -64,7 +65,7 @@ export async function create(bodyArg, flags) {
     const orgId = requireOrg(flags, config, 'myapi feedback create "<text>" --kind <k> [--org <id>]');
     const body = bodyArg ?? flags.body;
     requireArg(body, 'text', 'myapi feedback create "<text>" --kind bug');
-    const kind = flags.kind ?? 'other';
+    const kind = flags.kind ?? 'issue';
     if (!KINDS.includes(kind)) {
         error(`Invalid --kind "${kind}". Use one of: ${KINDS.join(', ')}.\n\n→ Kind is what the PERSON says it is. "bug" is a claim that the product is broken; do not infer it from the wording.`);
     }
@@ -127,7 +128,7 @@ export async function widget(sub, arg, flags) {
     error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget revoke <id>');
 }
 const SUBCOMMAND_USAGE = {
-    'list': `myapi feedback list [--kind bug|idea|praise|confusion|other] [--status open|resolved]
+    'list': `myapi feedback list [--kind bug|issue|suggestion] [--status open|resolved]
        [--limit N] [--offset N] [--org <id>] [--json]
 
 Newest first. \`total\` is the number of matches, not the page size.`,
@@ -149,7 +150,7 @@ Collect feedback from the people using what you built. A widget key lets a
 page submit without a credential; you list, filter and resolve the results.
 
 Subcommands:
-  create "<text>"      Record one piece of feedback (--kind bug|idea|praise|confusion|other)
+  create "<text>"      Record one piece of feedback (--kind bug|issue|suggestion)
   list                 List feedback, newest first (--kind, --status, --limit, --offset)
   resolve <id>         Close a piece of feedback
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)

package/dist/commands/flag-reachability.test.js

@@ -83,38 +83,61 @@ async function run(fn) {
             throw e;
     }
 }
-describe('container deploy — the flag must be refused on BOTH paths', () => {
-    // The original bug: this branch dropped the options entirely. Now the flags
-    // are refused platform-wide, and the refusal has to fire here too — a
-    // refusal wired to one branch is the same defect wearing a different hat.
-    it('refuses --no-promote on the --source path, and never calls the SDK', async () => {
+describe('container deploy — --no-promote must REACH both paths', () => {
+    // This is the original bug in its final form. --no-promote was wired to the
+    // image branch only, so a --source deploy accepted it and dropped it, and
+    // the build took 100% of traffic. The platform has since fixed its side and
+    // the flag works on both paths — so the assertion flips from "is refused" to
+    // "arrives", and the bug it guards is the same one either way.
+    const DEPLOYED = {
+        container_id: 'c1', revision_id: 'r1', url: 'https://x',
+        status: 'active', scoped_api_key: 'k', promoted: false,
+        revision_url: 'https://rev---x.run.app',
+    };
+    it('sends promote:false on the image path', async () => {
+        sdk.container.deployContainer.mockResolvedValue(DEPLOYED);
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', '', { source: './app', 'no-promote': true, org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
-        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', { promote: false });
     });
-    it('refuses --smoke on the --source path', async () => {
+    // The branch that shipped broken. It reads a real tarball, so the assertion
+    // is that the options object reaches the call — argument 6.
+    it('sends promote:false on the --source path', async () => {
+        sdk.container.deployContainerSource.mockResolvedValue({ container_id: 'c1', revision_id: 'r1', status: 'building' });
+        sdk.container.getContainer.mockResolvedValue({ id: 'c1', status: 'active', url: 'https://x' });
+        const { _isTarball } = await import('./container.js');
+        void _isTarball;
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', '', { source: './app', smoke: 'GET / contains x', org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
+        const fsp = await import('node:fs/promises');
+        const tmp = `${process.env.TMPDIR ?? '/tmp'}/reach-${Date.now()}.tar.gz`;
+        await fsp.writeFile(tmp, 'not-a-real-tarball');
+        await run(() => deploy('c1', '', { source: tmp, 'no-promote': true, org: ORG }));
+        await fsp.rm(tmp, { force: true });
+        expect(sdk.container.deployContainerSource).toHaveBeenCalled();
+        expect(sdk.container.deployContainerSource.mock.calls[0][5]).toEqual({ promote: false });
     });
-    it('refuses --no-promote on the image path', async () => {
+    it('sends no options at all when the flag is absent', async () => {
+        sdk.container.deployContainer.mockResolvedValue({ ...DEPLOYED, promoted: true });
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+        await run(() => deploy('c1', 'img:v1', { org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', {});
     });
-    // The refusal must not become a blanket block on deploying at all.
-    it('still deploys normally when neither flag is passed', async () => {
-        sdk.container.deployContainer.mockResolvedValue({
-            container_id: 'c1', revision_id: 'r1', url: 'https://x', status: 'active', scoped_api_key: 'k',
-        });
+    // --smoke was refused while the platform ignored it, and is honoured now.
+    // The assertion has flipped twice; what has not changed is that it must
+    // REACH the call, on whichever path.
+    it('sends the parsed assertion on the image path', async () => {
+        sdk.container.deployContainer.mockResolvedValue({ ...DEPLOYED, promoted: true });
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', 'img:v1', { org: ORG }));
-        expect(exitError).toBeNull();
-        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1');
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains assets/', org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', { smoke: { method: 'GET', path: '/', contains: 'assets/' } });
+    });
+    // Combining them is a contradiction: --smoke promotes on success, and
+    // --no-promote withholds regardless. Refused rather than silently picking.
+    it('refuses --smoke together with --no-promote', async () => {
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains x', 'no-promote': true, org: ORG }));
+        expect(exitError).toMatch(/one or the other/);
+        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
     });
 });
 describe('crm pagination — --offset must reach the SDK', () => {

package/dist/errors.js

@@ -45,6 +45,12 @@ export const ERROR_MESSAGES = {
     // on a backend deploy we do not control the timing of, and a CLI that only
     // knows the new names would print a bare code for anyone on the old build.
     // The old five can go once that deploy is everywhere.
+    // Deploy-guard validation, added when the platform started refusing bad
+    // assertions BEFORE building — a source build costs minutes you pay for, so
+    // catching a typo up front matters more than it looks.
+    INVALID_SMOKE: 'The --smoke assertion is not usable. It must assert something: add `contains <text>` or `status <code>`. A check that only requests a path passes on any response, including the placeholder page the flag exists to catch.',
+    SMOKE_FAILED: 'The smoke assertion did not pass, so the new revision was NOT promoted. On a container with an earlier revision that one is still serving; on a FIRST deploy there was nothing to hold traffic and the failing build is live. Inspect the revision URL in the error.',
+    INVALID_HEALTH_CHECK: 'That health-check path is not usable. /healthz is refused specifically: the runtime answers it before your container does, so a probe on it passes even when your app is down. Use /livez or any other path.',
     DNS_UNAVAILABLE: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
     DNS_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
     DNS_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-47eda6baa9055dadbd3e9d04df9fc425f1a7e96a9cd80c971c4951b97f1e94ff
+checksum: sha256-0e68a4596027c9ccccf0cc86423deffbe71307d265aa973d3cd6261db2695152
 ---
 
 # MyContainerAPI
@@ -23,26 +23,33 @@ The lifecycle is **create → deploy → (optionally) bind a custom domain**.
   can deploy; you do not need to be able to run one.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
-### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
+### Deploying safely
 
-A deploy takes 100% of traffic the moment it lands. There is no dry run, no
-definition of correct beyond "something is listening on the port", and no way
-back. Plan for that.
+A plain deploy takes 100% of traffic the moment it lands.
 
-`--no-promote` and `--smoke` exist as flags and **the CLI refuses them**: they
-shipped before the platform could honour them, and a guard that silently
-passes is worse than no guard. `--health-check` is accepted at create but does
-not appear on the container afterwards, so do not rely on it either.
+**`--smoke '<assertion>'`** deploys the revision with no traffic, checks the
+assertion, and promotes only if it holds. A failure returns `SMOKE_FAILED`,
+leaves the previous revision serving, and returns a revision URL to inspect.
 
-Until they work, the only safe sequence is:
+```bash
+myapi container deploy <id> --source ./app --smoke 'GET / contains assets/'
+```
+
+**Assert on content, not status.** A build whose frontend never bundled still
+binds its port and answers `200` — that is how a placeholder page reached
+production and served a dead page for fifteen minutes.
+
+**`--no-promote`** holds the revision back and prints a URL to test yourself,
+then `myapi container promote <id> <revision>`. Use it when the check is more
+than one assertion. On a container's *first* deploy nothing is serving yet, so
+traffic is not withheld and the output says so.
 
-1. deploy to a **non-production** container
-2. verify it yourself — `curl` for a string only a real build emits, not just
-   a 200, because a broken build returns 200 too
-3. deploy the same image to production
+**`myapi container rollback <id>`** returns traffic to the previous ready
+revision in seconds, no rebuild.
 
-`myapi container promote <id> <revision>` currently fails, so a bad deploy
-must be fixed by deploying forward. Keep a known-good image reference to hand.
+`--health-check /livez` at create makes the startup probe an HTTP request
+rather than a bare TCP connect. `/healthz` is refused — the runtime intercepts
+it, so the probe would never reach your container.
 
 ### Custom domains (dynamic apps)
 
@@ -121,8 +128,7 @@ way that looks like an application bug.
   error envelope will not reach the caller. Return a 4xx if the reason has to
   survive.
 - **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
-  `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
-  nothing. Recreate the container to change them.
+  `create` and cannot be changed by `deploy`.** Recreate to change them.
 
 ### Keeping a service warm
 

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
+checksum: sha256-1f3e7f6de3435e0334a808b9d2faa978c9cb70982509a376abc0e539cb44e1ed
 ---
 
 # MyStorageAPI
@@ -93,11 +93,17 @@ Both produce identical asset records — `list` doesn't distinguish.
   fetch it; there is no private mode, no signed URL, and no revocation. The id
   being long and random is **not** access control — treat the URL as public the
   moment it exists.
-- **For personal or regulated data, encrypt before upload.** Storage only ever
-  sees ciphertext. A team shipping Swiss lease documents (names, dates of
-  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
-  per-document data key wrapped under a master key held in function secrets.
-  That is the pattern to copy until private assets exist.
+- **Private assets exist as of 2026-07-28** — upload with `visibility: private`,
+  or `PATCH` an existing asset to close an exposure, which takes effect
+  immediately. Fetch it with a signed URL (15 minutes default, 24 hours max);
+  `revoke-links` kills every link already handed out, including unexpired ones.
+  A private upload deliberately returns **no plain `url`**, because that URL
+  does not serve the file and would look like the answer.
+- **Encrypting before upload is still worth doing for the strictest cases.**
+  Private assets protect against the internet; client-side encryption protects
+  against the platform, and those are different threat models. A team shipping
+  Swiss lease documents used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key in function secrets.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.8.0",
+  "version": "2.10.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.8.0"
+    "@myapihq/sdk": "^2.10.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",