@myapihq/cli 2.8.0 → 2.9.0

package/dist/commands/container.d.ts

@@ -17,6 +17,7 @@ export declare function deploy(id: string, image: string, flags: Flags): Promise
 export declare function _parseSmoke(raw: string): sdkContainer.SmokeCheck;
 export declare function revisions(id: string, flags: Flags): Promise<void>;
 export declare function promote(id: string, revision: string | undefined, flags: Flags): Promise<void>;
+export declare function rollback(id: string, flags: Flags): Promise<void>;
 export declare function logs(id: string, flags: Flags): Promise<void>;
 export declare function domain(id: string, domainArg: string | undefined, flags: Flags): Promise<void>;
 export declare function buildLogs(id: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -239,17 +239,16 @@ export async function deploy(id, image, flags) {
     // write their own; a guard that silently passes makes them stop. Restore
     // these the moment the upstream fix lands — see
     // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
-    if (flags['no-promote'] === true || typeof flags.smoke === 'string') {
-        const which = flags['no-promote'] === true ? '--no-promote' : '--smoke';
-        error(`${which} is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was guarded.\n\n` +
-            'It shipped in 2.7.0 and does not work end to end on either deploy path:\n' +
-            '  --source     the API accepts only the tarball on that path; the flag never reaches it\n' +
-            '  <image-ref>  the API accepts the flag, then fails while moving traffic\n\n' +
-            'Until it lands, the safe sequence is:\n' +
-            `  1. deploy to a non-production container first\n` +
-            `  2. check it yourself (curl for a string only a real build emits)\n` +
-            `  3. deploy the same image to production\n\n` +
-            'Reported upstream; this message goes away when the flag works.');
+    // --smoke is still not honoured; --no-promote was fixed upstream on
+    // 2026-07-28 and works on both deploy paths. Refusing what does not work
+    // beats accepting it, and un-refusing what does beats obstructing.
+    if (typeof flags.smoke === 'string') {
+        error('--smoke is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was checked.\n\n' +
+            'Use --no-promote instead, which now works:\n' +
+            '  1. myapi container deploy <id> <image> --no-promote\n' +
+            '  2. curl the revision URL it prints, for a string only a real build emits\n' +
+            '  3. myapi container promote <id> <revision>\n\n' +
+            'That is the same verify-then-promote, done by you rather than the platform.');
     }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
@@ -258,6 +257,11 @@ export async function deploy(id, image, flags) {
     if (source && image) {
         error('Pass either an image ref or --source, not both.');
     }
+    // Built once, passed to BOTH branches. The original bug was building these
+    // inside the image branch only, so a --source deploy dropped them silently.
+    const deployOpts = {};
+    if (flags['no-promote'] === true)
+        deployOpts.promote = false;
     // ── Source-build path (async) ───────────────────────────────────────────
     if (source) {
         let tarball;
@@ -281,7 +285,7 @@ export async function deploy(id, image, flags) {
         else {
             error(`--source must be a directory or a .tar/.tar.gz/.tgz archive — got ${source}`);
         }
-        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename);
+        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename, deployOpts);
         if (flags.json && start.status !== 'building') {
             printJson(start);
             return;
@@ -320,10 +324,7 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    // No DeployOptions built here: --no-promote and --smoke are refused above
-    // until the upstream fix lands. The SDK still carries them so the wiring is
-    // one commit away, and sdk-container.test.ts keeps them covered.
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, deployOpts);
     if (flags.json) {
         printJson(result);
         return;
@@ -331,9 +332,18 @@ export async function deploy(id, image, flags) {
     // An unpromoted revision must NOT read like a completed deploy. A response
     // that looked the same either way is how an agent concludes it has shipped
     // when it has not — the original outage in miniature.
-    // Unreachable while the flags are refused above. Kept because it is the
-    // render we want the moment they are restored, and deleting it would mean
-    // rewriting it from memory later.
+    // Read `promoted` rather than assuming --no-promote was honoured. On a
+    // container's FIRST deploy there is nothing already serving to hold traffic,
+    // so the platform promotes anyway and says so — reporting "not serving"
+    // there would be the lie this flag exists to prevent.
+    if (flags['no-promote'] === true && result.promoted !== false) {
+        success(`Deployed container ${id} (revision ${result.revision_id})`);
+        info('');
+        info('Note: --no-promote was NOT applied. This container had nothing already');
+        info('serving, so withholding traffic would have left it answering nothing.');
+        info(`URL:             ${result.url}`);
+        return;
+    }
     if (result.promoted === false) {
         success(`Revision ${result.revision_id} built — NOT serving traffic`);
         info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
@@ -417,13 +427,14 @@ export async function revisions(id, flags) {
     // state.
     //
     // Say so rather than render a table that reads as "nothing is live".
+    // The 0%-everywhere reporting bug was fixed upstream on 2026-07-28 (a v2
+    // traffic target of type LATEST carries no revision name, so 100% was filed
+    // under ""). Keeping a narrower check: all-zero on an active container is
+    // still worth flagging, it is just no longer expected.
     if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
         info('');
-        info('Note: every revision reports 0% traffic while this container is active and serving.');
-        info('The traffic column is wrong, not the container. Verified on a container created');
-        info('today, so this is not limited to older ones — an earlier version of this message');
-        info('said redeploying fixes it, which was wrong.');
-        info('promote depends on this data and currently fails. Reported upstream.');
+        info('Note: no revision reports any traffic while this container is active.');
+        info('That should not happen — report it rather than trusting the column.');
     }
 }
 // promote moves all traffic to one revision. Omitting the revision rolls back
@@ -447,16 +458,25 @@ export async function promote(id, revision, flags) {
     if (res.message)
         info(res.message);
 }
-// Not a command — guidance for a word that is not one. See the dispatch note.
-function rollbackGuidance(id) {
-    const ref = id || '<id>';
-    error('There is no `rollback` subcommand — rolling back is promoting an older revision.\n\n' +
-        `  myapi container revisions ${ref}          # find the last good revision\n` +
-        `  myapi container promote ${ref} <revision> # traffic moves in seconds\n\n` +
-        'Heads up: the platform currently reports 0% traffic on every revision of any\n' +
-        'container deployed before 2026-07-28, and its own roll-back-to-previous path\n' +
-        'returns a gateway error. Promoting a revision BY NAME works and is unaffected —\n' +
-        'use that. Reported upstream.');
+// rollback moves traffic to the previous ready revision. The API models it as
+// `promote` with no revision named — one operation, two targets — but
+// `rollback` is the word someone types during an incident, so it is a verb
+// here even though the SDK has a single function.
+export async function rollback(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container rollback <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container rollback <id>');
+    const res = await sdkContainer.promoteRevision(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Rolled back ${id} to the previous ready revision`);
+    if (res.serving)
+        info(`Now serving:     ${res.serving}`);
+    if (res.message)
+        info(res.message);
 }
 // logs prints the container's recent runtime logs, newest first. By default
 // this is the container's own stdout/stderr; --scope all adds the platform
@@ -565,19 +585,25 @@ Two ways to deploy:
            built server-side (typically ~4 minutes), then deployed.
            Asynchronous — the CLI polls until it's live.
 
-TEMPORARILY REFUSED: --no-promote and --smoke
+Options:
+  --no-promote   Build the revision without giving it traffic, on either
+                 deploy path. Prints a revision URL to test at, then:
+                 myapi container promote <id> <revision>
 
-  Both shipped in 2.7.0 and do not work end to end. Rather than accept a flag
-  and deploy anyway, the CLI now refuses them and explains what to do instead.
-  A guard that silently passes is worse than no guard.
+                 On a container's FIRST deploy there is nothing already
+                 serving, so traffic is NOT withheld and the output says so.
 
-  Until they land: deploy to a non-production container, verify it yourself,
-  then deploy the same image to production.
+  --smoke        Still refused — the platform accepts it and does nothing.
+                 --no-promote gives you the same verify-then-promote by hand.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz`,
+  myapi container deploy <id> <image> --no-promote`,
+    'rollback': `myapi container rollback <id> [--org <id>] [--json]
+
+Move traffic back to the previous ready revision. Seconds, no rebuild.
+Refuses rather than guessing when it cannot tell what is serving.`,
     'revisions': `myapi container revisions <id> [--org <id>] [--json]
 
 Every revision the runtime currently holds, newest first, with the traffic
@@ -629,6 +655,7 @@ Subcommands:
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
   promote <id> <rev>   Move all traffic to a revision (seconds, no rebuild)
   revisions <id>       List revisions and the traffic each takes
+  rollback <id>        Move traffic back to the previous ready revision
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -652,12 +679,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'promote': return promote(args[0], args[1], flags);
         case 'domain': return domain(args[0], args[1], flags);
         case 'delete': return del(args[0], flags);
-        // `rollback` is the word people reach for during an incident, and it is
-        // NOT a verb here — the API models rollback as `promote` with no revision.
-        // A bare "unknown subcommand" would cost minutes at the worst possible
-        // moment, so say what to do instead, and be honest that the underlying
-        // call is currently broken rather than let someone discover that live.
-        case 'rollback': return rollbackGuidance(args[0]);
+        case 'rollback': return rollback(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/feedback.js

@@ -24,7 +24,8 @@ export const SCHEMA = {
     route: 'string',
     origins: 'string',
 };
-const KINDS = ['bug', 'idea', 'praise', 'confusion', 'other'];
+// The platform's enum, checked against the schema rather than invented.
+const KINDS = ['bug', 'issue', 'suggestion'];
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi feedback list [--kind <k>] [--status open|resolved] [--org <id>]');
@@ -64,7 +65,7 @@ export async function create(bodyArg, flags) {
     const orgId = requireOrg(flags, config, 'myapi feedback create "<text>" --kind <k> [--org <id>]');
     const body = bodyArg ?? flags.body;
     requireArg(body, 'text', 'myapi feedback create "<text>" --kind bug');
-    const kind = flags.kind ?? 'other';
+    const kind = flags.kind ?? 'issue';
     if (!KINDS.includes(kind)) {
         error(`Invalid --kind "${kind}". Use one of: ${KINDS.join(', ')}.\n\n→ Kind is what the PERSON says it is. "bug" is a claim that the product is broken; do not infer it from the wording.`);
     }
@@ -127,7 +128,7 @@ export async function widget(sub, arg, flags) {
     error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget revoke <id>');
 }
 const SUBCOMMAND_USAGE = {
-    'list': `myapi feedback list [--kind bug|idea|praise|confusion|other] [--status open|resolved]
+    'list': `myapi feedback list [--kind bug|issue|suggestion] [--status open|resolved]
        [--limit N] [--offset N] [--org <id>] [--json]
 
 Newest first. \`total\` is the number of matches, not the page size.`,
@@ -149,7 +150,7 @@ Collect feedback from the people using what you built. A widget key lets a
 page submit without a credential; you list, filter and resolve the results.
 
 Subcommands:
-  create "<text>"      Record one piece of feedback (--kind bug|idea|praise|confusion|other)
+  create "<text>"      Record one piece of feedback (--kind bug|issue|suggestion)
   list                 List feedback, newest first (--kind, --status, --limit, --offset)
   resolve <id>         Close a piece of feedback
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)

package/dist/commands/flag-reachability.test.js

@@ -83,38 +83,51 @@ async function run(fn) {
             throw e;
     }
 }
-describe('container deploy — the flag must be refused on BOTH paths', () => {
-    // The original bug: this branch dropped the options entirely. Now the flags
-    // are refused platform-wide, and the refusal has to fire here too — a
-    // refusal wired to one branch is the same defect wearing a different hat.
-    it('refuses --no-promote on the --source path, and never calls the SDK', async () => {
+describe('container deploy — --no-promote must REACH both paths', () => {
+    // This is the original bug in its final form. --no-promote was wired to the
+    // image branch only, so a --source deploy accepted it and dropped it, and
+    // the build took 100% of traffic. The platform has since fixed its side and
+    // the flag works on both paths — so the assertion flips from "is refused" to
+    // "arrives", and the bug it guards is the same one either way.
+    const DEPLOYED = {
+        container_id: 'c1', revision_id: 'r1', url: 'https://x',
+        status: 'active', scoped_api_key: 'k', promoted: false,
+        revision_url: 'https://rev---x.run.app',
+    };
+    it('sends promote:false on the image path', async () => {
+        sdk.container.deployContainer.mockResolvedValue(DEPLOYED);
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', '', { source: './app', 'no-promote': true, org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
-        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', { promote: false });
     });
-    it('refuses --smoke on the --source path', async () => {
+    // The branch that shipped broken. It reads a real tarball, so the assertion
+    // is that the options object reaches the call — argument 6.
+    it('sends promote:false on the --source path', async () => {
+        sdk.container.deployContainerSource.mockResolvedValue({ container_id: 'c1', revision_id: 'r1', status: 'building' });
+        sdk.container.getContainer.mockResolvedValue({ id: 'c1', status: 'active', url: 'https://x' });
+        const { _isTarball } = await import('./container.js');
+        void _isTarball;
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', '', { source: './app', smoke: 'GET / contains x', org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
+        const fsp = await import('node:fs/promises');
+        const tmp = `${process.env.TMPDIR ?? '/tmp'}/reach-${Date.now()}.tar.gz`;
+        await fsp.writeFile(tmp, 'not-a-real-tarball');
+        await run(() => deploy('c1', '', { source: tmp, 'no-promote': true, org: ORG }));
+        await fsp.rm(tmp, { force: true });
+        expect(sdk.container.deployContainerSource).toHaveBeenCalled();
+        expect(sdk.container.deployContainerSource.mock.calls[0][5]).toEqual({ promote: false });
     });
-    it('refuses --no-promote on the image path', async () => {
+    it('sends no options at all when the flag is absent', async () => {
+        sdk.container.deployContainer.mockResolvedValue({ ...DEPLOYED, promoted: true });
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
-        expect(exitError).toMatch(/not honoured yet/);
-        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+        await run(() => deploy('c1', 'img:v1', { org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', {});
     });
-    // The refusal must not become a blanket block on deploying at all.
-    it('still deploys normally when neither flag is passed', async () => {
-        sdk.container.deployContainer.mockResolvedValue({
-            container_id: 'c1', revision_id: 'r1', url: 'https://x', status: 'active', scoped_api_key: 'k',
-        });
+    // --smoke is still not honoured upstream, and refusing beats accepting.
+    it('still refuses --smoke, on either path', async () => {
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', 'img:v1', { org: ORG }));
-        expect(exitError).toBeNull();
-        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1');
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains x', org: ORG }));
+        expect(exitError).toMatch(/--smoke is not honoured yet/);
+        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
     });
 });
 describe('crm pagination — --offset must reach the SDK', () => {

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
+checksum: sha256-1f3e7f6de3435e0334a808b9d2faa978c9cb70982509a376abc0e539cb44e1ed
 ---
 
 # MyStorageAPI
@@ -93,11 +93,17 @@ Both produce identical asset records — `list` doesn't distinguish.
   fetch it; there is no private mode, no signed URL, and no revocation. The id
   being long and random is **not** access control — treat the URL as public the
   moment it exists.
-- **For personal or regulated data, encrypt before upload.** Storage only ever
-  sees ciphertext. A team shipping Swiss lease documents (names, dates of
-  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
-  per-document data key wrapped under a master key held in function secrets.
-  That is the pattern to copy until private assets exist.
+- **Private assets exist as of 2026-07-28** — upload with `visibility: private`,
+  or `PATCH` an existing asset to close an exposure, which takes effect
+  immediately. Fetch it with a signed URL (15 minutes default, 24 hours max);
+  `revoke-links` kills every link already handed out, including unexpired ones.
+  A private upload deliberately returns **no plain `url`**, because that URL
+  does not serve the file and would look like the answer.
+- **Encrypting before upload is still worth doing for the strictest cases.**
+  Private assets protect against the internet; client-side encryption protects
+  against the platform, and those are different threat models. A team shipping
+  Swiss lease documents used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key in function secrets.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.8.0"
+    "@myapihq/sdk": "^2.9.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",