@myapihq/cli 2.9.0 → 2.11.0

package/dist/commands/container.js

@@ -239,17 +239,6 @@ export async function deploy(id, image, flags) {
     // write their own; a guard that silently passes makes them stop. Restore
     // these the moment the upstream fix lands — see
     // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
-    // --smoke is still not honoured; --no-promote was fixed upstream on
-    // 2026-07-28 and works on both deploy paths. Refusing what does not work
-    // beats accepting it, and un-refusing what does beats obstructing.
-    if (typeof flags.smoke === 'string') {
-        error('--smoke is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was checked.\n\n' +
-            'Use --no-promote instead, which now works:\n' +
-            '  1. myapi container deploy <id> <image> --no-promote\n' +
-            '  2. curl the revision URL it prints, for a string only a real build emits\n' +
-            '  3. myapi container promote <id> <revision>\n\n' +
-            'That is the same verify-then-promote, done by you rather than the platform.');
-    }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
     if (!image && typeof flags.image === 'string')
@@ -262,6 +251,28 @@ export async function deploy(id, image, flags) {
     const deployOpts = {};
     if (flags['no-promote'] === true)
         deployOpts.promote = false;
+    if (typeof flags.smoke === 'string')
+        deployOpts.smoke = _parseSmoke(flags.smoke);
+    // On a container's FIRST deploy there is no earlier revision to hold
+    // traffic, so the platform runs the assertion against the LIVE url — a
+    // failing build is already serving when you are told it failed. Say so
+    // before the deploy rather than after, because the remedy differs: on any
+    // later deploy a failure is contained, and here it is not.
+    if (deployOpts.smoke || deployOpts.promote === false) {
+        try {
+            const existing = await sdkContainer.listRevisions(config.api_key, orgId, id);
+            if (existing.length === 0) {
+                info('Note: this container has no earlier revision, so there is nothing to hold');
+                info('traffic while the new one is checked. A failing build WILL be serving.');
+                info('Deploy to a non-production container first if that matters.');
+                info('');
+            }
+        }
+        catch { /* advisory only — never block a deploy on it */ }
+    }
+    if (deployOpts.promote === false && deployOpts.smoke) {
+        error('--smoke already withholds traffic until the assertion passes, then promotes.\nUse one or the other: --smoke to verify-and-promote, --no-promote to hold the revision back.');
+    }
     // ── Source-build path (async) ───────────────────────────────────────────
     if (source) {
         let tarball;
@@ -593,13 +604,21 @@ Options:
                  On a container's FIRST deploy there is nothing already
                  serving, so traffic is NOT withheld and the output says so.
 
-  --smoke        Still refused — the platform accepts it and does nothing.
-                 --no-promote gives you the same verify-then-promote by hand.
+  --smoke '<assertion>'
+                 Deploy, assert against the new revision, and promote it ONLY
+                 if the assertion holds. A failure leaves the previous
+                 revision serving and returns SMOKE_FAILED with a revision URL
+                 to inspect. Works on both deploy paths.
+
+                 Grammar: [GET|HEAD] [/path] [status N] [contains TEXT]
+                 Assert on CONTENT — "returns 200" is true of a placeholder
+                 page too, which is how one reached production and stayed.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> <image> --no-promote`,
+  myapi container deploy <id> <image> --no-promote
+  myapi container deploy <id> --source ./app --smoke 'GET / contains assets/'`,
     'rollback': `myapi container rollback <id> [--org <id>] [--json]
 
 Move traffic back to the previous ready revision. Seconds, no rebuild.
@@ -647,8 +666,10 @@ dependencies and long execution.
 Subcommands:
   build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
+                       (--health-check /livez for an HTTP startup probe)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
+                       (--smoke to verify before promoting; --no-promote to hold it back)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org

package/dist/commands/flag-reachability.test.js

@@ -122,11 +122,21 @@ describe('container deploy — --no-promote must REACH both paths', () => {
         await run(() => deploy('c1', 'img:v1', { org: ORG }));
         expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', {});
     });
-    // --smoke is still not honoured upstream, and refusing beats accepting.
-    it('still refuses --smoke, on either path', async () => {
+    // --smoke was refused while the platform ignored it, and is honoured now.
+    // The assertion has flipped twice; what has not changed is that it must
+    // REACH the call, on whichever path.
+    it('sends the parsed assertion on the image path', async () => {
+        sdk.container.deployContainer.mockResolvedValue({ ...DEPLOYED, promoted: true });
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains assets/', org: ORG }));
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1', { smoke: { method: 'GET', path: '/', contains: 'assets/' } });
+    });
+    // Combining them is a contradiction: --smoke promotes on success, and
+    // --no-promote withholds regardless. Refused rather than silently picking.
+    it('refuses --smoke together with --no-promote', async () => {
         const { deploy } = await import('./container.js');
-        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains x', org: ORG }));
-        expect(exitError).toMatch(/--smoke is not honoured yet/);
+        await run(() => deploy('c1', 'img:v1', { smoke: 'GET / contains x', 'no-promote': true, org: ORG }));
+        expect(exitError).toMatch(/one or the other/);
         expect(sdk.container.deployContainer).not.toHaveBeenCalled();
     });
 });

package/dist/commands/import-key.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/import-key.test.js

@@ -0,0 +1,69 @@
+import { describe, test, expect, beforeEach, afterEach } from 'vitest';
+import { EventEmitter } from 'node:events';
+import { resolveImportKey } from './setup.js';
+// Where `myapi account import-key` is allowed to take the key from.
+//
+// A secret in argv is readable by any user on the machine — /proc/<pid>/cmdline
+// on Linux, `ps` anywhere — and the shell records it in history. A 2026-07-31
+// security audit confirmed it with an OS-level probe against the syntax the CLI
+// itself documented, so the docs were instructing people to leak their key.
+//
+// The argument still works: breaking every CI pipeline that already calls it
+// would be worse than the exposure. But it is no longer the documented path, and
+// it announces itself.
+const ORIGINAL_STDIN = process.stdin;
+function fakeStdin(piped) {
+    const stream = new EventEmitter();
+    stream.setEncoding = () => { };
+    stream.isTTY = piped === null;
+    if (piped !== null) {
+        setImmediate(() => { stream.emit('data', piped); stream.emit('end'); });
+    }
+    Object.defineProperty(process, 'stdin', { value: stream, configurable: true });
+}
+describe('import-key key sources', () => {
+    beforeEach(() => {
+        delete process.env.MYAPI_API_KEY;
+        delete process.env.MYAPI_KEY;
+        fakeStdin(null); // a TTY with nothing piped, unless a test says otherwise
+    });
+    afterEach(() => {
+        Object.defineProperty(process, 'stdin', { value: ORIGINAL_STDIN, configurable: true });
+    });
+    test('stdin is accepted, and is not flagged as argv exposure', async () => {
+        fakeStdin('hq_live_frompipe\n');
+        const got = await resolveImportKey('');
+        expect(got.key).toBe('hq_live_frompipe');
+        expect(got.fromArgv).toBe(false);
+    });
+    test('MYAPI_API_KEY is accepted', async () => {
+        process.env.MYAPI_API_KEY = 'hq_live_fromenv';
+        const got = await resolveImportKey('');
+        expect(got.key).toBe('hq_live_fromenv');
+        expect(got.fromArgv).toBe(false);
+    });
+    test('MYAPI_KEY is accepted as the older name', async () => {
+        process.env.MYAPI_KEY = 'hq_live_fromoldenv';
+        expect((await resolveImportKey('')).key).toBe('hq_live_fromoldenv');
+    });
+    test('an argument still works, and is reported as argv so it can be warned about', async () => {
+        // The warning is the whole point: silently accepting it would leave the
+        // caller believing the documented-unsafe form is fine.
+        const got = await resolveImportKey('hq_live_fromargv');
+        expect(got.key).toBe('hq_live_fromargv');
+        expect(got.fromArgv).toBe(true);
+    });
+    test('nothing anywhere yields no key rather than hanging on a TTY', async () => {
+        // Reading stdin unconditionally would make the CLI look frozen when a human
+        // runs it with no input, which is how a safe default becomes one people
+        // route around.
+        const got = await resolveImportKey('');
+        expect(got.key).toBe('');
+    });
+    test('surrounding whitespace is stripped', async () => {
+        // `echo "$KEY" |` appends a newline, and a key with a trailing \n fails
+        // validation against the API for a reason nobody can see.
+        fakeStdin('  hq_live_padded \n');
+        expect((await resolveImportKey('')).key).toBe('hq_live_padded');
+    });
+});

package/dist/commands/org.js

@@ -3,7 +3,7 @@ import { requireConfig, saveConfig } from '../config.js';
 import { success, error, printTable, printJson, info } from '../output.js';
 import { confirm, isNonInteractive } from '../prompt.js';
 import { formatDate, pollJob } from '../utils.js';
-import { requireOrg, requireArg } from '../helpers.js';
+import { requireOrg, requireArg, rememberOrgNames } from '../helpers.js';
 export const EXPOSES = [
     'POST /hq/orgs',
     'GET /hq/orgs',
@@ -74,6 +74,10 @@ export async function create(restArgs, flags) {
 export async function list(flags) {
     const config = requireConfig();
     const orgs = await hq.listOrgs(config.api_key);
+    // The only place the full id → name mapping is in hand. Caching it here is
+    // what lets every later "org changed" notice name the org instead of showing
+    // a UUID nobody can verify at a glance.
+    rememberOrgNames(config, orgs);
     if (flags.json) {
         if (flags.verbose) {
             printJson(orgs);

package/dist/commands/setup.d.ts

@@ -3,5 +3,9 @@ import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare function _isLocallyModified(src: string): boolean;
 export declare function installSkills(): Promise<void>;
-export declare function importKey(apiKey: string, flags: Flags): Promise<void>;
+export declare function resolveImportKey(positional: string): Promise<{
+    key: string;
+    fromArgv: boolean;
+}>;
+export declare function importKey(positional: string, flags: Flags): Promise<void>;
 export declare function setup(flags?: Flags): Promise<void>;

package/dist/commands/setup.js

@@ -221,11 +221,15 @@ async function anonymousFlow() {
 // ---------------------------------------------------------------------------
 // Main setup command
 // ---------------------------------------------------------------------------
-const IMPORT_KEY_HELP = `Usage: myapi account import-key <api_key> [--install-skills] [--no-skills]
+const IMPORT_KEY_HELP = `Usage: myapi account import-key [--install-skills] [--no-skills]
 
 Imports an existing API key non-interactively. Use this in CI, Docker, or any
 environment where the interactive "myapi account setup" flow is not practical.
 
+Give the key on stdin, or in MYAPI_API_KEY. Do NOT pass it as an argument:
+arguments are visible to every user on the machine through the process list
+(ps, /proc/<pid>/cmdline) and are written to your shell history.
+
 The key is validated against the API before being saved. Your default org and
 funnel are auto-detected from the account and written to the local config.
 
@@ -234,8 +238,9 @@ Flags:
   --no-skills        Skip skills installation even if previously installed
 
 Examples:
-  myapi account import-key hq_live_xxxxxxxxxxxxxxxxxxxx
-  myapi account import-key hq_live_xxxxxxxxxxxxxxxxxxxx --install-skills`;
+  echo "$MY_KEY" | myapi account import-key
+  MYAPI_API_KEY="$MY_KEY" myapi account import-key --install-skills
+  myapi account import-key < key.txt`;
 const SETUP_HELP = `Usage: myapi account setup [--anonymous] [--yes] [--install-skills|--no-skills]
 
 Configures your account and stores your default org and funnel so you don't
@@ -246,12 +251,56 @@ Flags:
   --yes             Skip confirmation prompts
   --install-skills  Auto-install skills pack
   --no-skills       Skip skills installation`;
-// myapi account import-key <key> — non-interactively import a raw API key.
-export async function importKey(apiKey, flags) {
-    if (flags.help || !apiKey) {
+// Where the key may come from, safest first.
+//
+// A secret passed as a command-line argument is readable by any user on the
+// machine for as long as the process lives — /proc/<pid>/cmdline on Linux, `ps`
+// anywhere — and the shell writes it to history on the way in. A security audit
+// on 2026-07-31 confirmed this with an OS-level probe against the documented
+// syntax, so it was not theoretical: the docs told people to do the unsafe
+// thing.
+//
+// stdin and the environment both avoid the process list. The argument still
+// works, because breaking every CI pipeline that calls it would be a worse
+// outcome than the exposure, but it warns and the help no longer shows it.
+export async function resolveImportKey(positional) {
+    if (positional)
+        return { key: positional, fromArgv: true };
+    const fromEnv = (process.env.MYAPI_API_KEY || process.env.MYAPI_KEY || '').trim();
+    if (fromEnv)
+        return { key: fromEnv, fromArgv: false };
+    // Only read stdin when something is actually piped in. On a TTY this would
+    // hang looking like the CLI had frozen.
+    if (!process.stdin.isTTY) {
+        const data = await new Promise((resolve, reject) => {
+            let buf = '';
+            process.stdin.setEncoding('utf-8');
+            process.stdin.on('data', c => { buf += c; });
+            process.stdin.on('end', () => resolve(buf));
+            process.stdin.on('error', reject);
+        });
+        const key = data.trim();
+        if (key)
+            return { key, fromArgv: false };
+    }
+    return { key: '', fromArgv: false };
+}
+// myapi account import-key — non-interactively import a raw API key.
+export async function importKey(positional, flags) {
+    if (flags.help) {
         info(IMPORT_KEY_HELP);
         return;
     }
+    const { key: apiKey, fromArgv } = await resolveImportKey(positional);
+    if (!apiKey) {
+        info(IMPORT_KEY_HELP);
+        return;
+    }
+    if (fromArgv) {
+        info('Warning: passing the key as an argument exposes it in the process list ' +
+            '(ps, /proc) and your shell history. Pipe it instead: ' +
+            'echo "$MY_KEY" | myapi account import-key');
+    }
     let accountId = '';
     let email;
     try {
@@ -383,4 +432,16 @@ export async function setup(flags = {}) {
     else {
         success(`› Setup complete. Org ${defaultOrg} ready · $5.00 free credits added.`);
     }
+    // The key just saved is account-wide, and it has to be: an org-locked key
+    // cannot create orgs or manage billing, so locking the operator's own
+    // credential would break the next thing they do. The scoping belongs on the
+    // credential handed to a WORKLOAD — an agent loop or CI job that should only
+    // ever touch one org. That is the only defence that survives a stale default,
+    // because it moves the org from an ambient setting to a property of the key.
+    if (defaultOrg) {
+        info('');
+        info('› Handing this to an agent or CI? Give it an org-locked key, so a stale');
+        info('  default can never reach another org:');
+        info(`    myapi keys create --name agent --org ${defaultOrg} --grant '*'`);
+    }
 }

package/dist/commands/storage.js

@@ -14,11 +14,16 @@ export const EXPOSES = [
     'POST /storage/orgs/{org_id}/assets/upload',
     'GET /storage/orgs/{org_id}/assets',
     'DELETE /storage/orgs/{org_id}/assets/{asset_id}',
+    'PATCH /storage/orgs/{org_id}/assets/{asset_id}',
+    'POST /storage/orgs/{org_id}/assets/{asset_id}/signed-url',
+    'POST /storage/orgs/{org_id}/assets/{asset_id}/revoke-links',
 ];
 export const SCHEMA = {
     org: 'string',
     name: 'string',
     'content-type': 'string',
+    private: 'boolean',
+    ttl: 'string',
 };
 // Mirrors UploadContentType in @myapihq/sdk + backend allowlist.
 const EXT_TO_CT = {
@@ -36,7 +41,10 @@ function summarizeAsset(a) {
     return {
         asset_id: a.asset_id,
         name: a.name || '(unnamed)',
-        url: a.url,
+        // A private asset has no plain URL — the backend deliberately returns none,
+        // because that URL does not serve the file and would read as the answer.
+        url: a.url || (a.visibility === 'private' ? '— (private: myapi storage sign <id>)' : ''),
+        visibility: a.visibility ?? 'public',
         created_at: a.created_at ? formatDate(a.created_at) : '',
     };
 }
@@ -91,8 +99,103 @@ async function upload(filePath, flags) {
         error(`Could not read ${filePath}: ${e?.message ?? e}`);
     }
     const name = flags.name || basename(filePath);
-    const res = await sdkStorage.uploadAsset(config.api_key, orgId, data, contentType, name);
+    const visibility = flags.private ? 'private' : undefined;
+    const res = await sdkStorage.uploadAsset(config.api_key, orgId, data, contentType, name, visibility);
+    // A private upload has no URL to print, and saying nothing here would look
+    // like a partial failure. Name the next step instead.
+    if (visibility) {
+        success(`Asset uploaded (private)! ID: ${res.asset_id}`);
+        info('');
+        info('Private assets have no public URL. Get a time-limited link with:');
+        info(`  myapi storage sign ${res.asset_id} --ttl 900`);
+        return;
+    }
     success(`Asset uploaded! ID: ${res.asset_id}\nHosted URL: ${res.url}`);
+    info('');
+    info('This URL is public forever and needs no credential. Holding personal');
+    info(`data? Close it now:  myapi storage visibility ${res.asset_id} private`);
+}
+// ── Private assets ───────────────────────────────────────────────────────────
+async function visibility(id, value, flags) {
+    const usage = 'myapi storage visibility <asset_id> <public|private> [--org <id>]';
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, usage);
+    requireArg(id, 'asset_id', usage);
+    if (value !== 'public' && value !== 'private') {
+        error(`Missing or invalid visibility "${value ?? ''}".\nUsage: ${usage}\n\n` +
+            `→ private: the plain URL stops serving at once; only signed links work.\n` +
+            `  public:  anyone holding the URL can read it, forever.`);
+    }
+    const res = await sdkStorage.setAssetVisibility(config.api_key, orgId, id, value);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    if (value === 'private') {
+        success(`Asset ${id} is now private — the plain URL no longer serves it.`);
+        info('');
+        info('Links you handed out before this still work until they expire.');
+        info(`Kill them too:  myapi storage revoke-links ${id}`);
+    }
+    else {
+        success(`Asset ${id} is now public — anyone with the URL can read it, forever.`);
+    }
+}
+async function sign(id, flags) {
+    const usage = 'myapi storage sign <asset_id> [--ttl <seconds>] [--org <id>]';
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, usage);
+    requireArg(id, 'asset_id', usage);
+    let ttl;
+    if (flags.ttl !== undefined) {
+        ttl = Number(flags.ttl);
+        // Bounds are the backend's (default 900, max 86400). Checking here turns
+        // a round-trip and an EXPIRES_TOO_LONG into an instant, specific message.
+        if (!Number.isInteger(ttl) || ttl <= 0 || ttl > 86400) {
+            error(`--ttl must be a whole number of seconds between 1 and 86400 (24h). Got "${flags.ttl}".`);
+        }
+    }
+    const res = await sdkStorage.createSignedUrl(config.api_key, orgId, id, ttl);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    const url = sdkStorage.signedUrlOf(res);
+    if (!url) {
+        // Better to hand back what arrived than to claim nothing came: the schema
+        // does not describe this response, so an unexpected field name is possible.
+        info('Signed link created, but no recognised URL field was in the response:');
+        printJson(res);
+        return;
+    }
+    // Report what the backend returned, not what we asked for — they can differ,
+    // and stating the request as if it were the outcome is how a link gets
+    // handed out with the wrong lifetime believed of it.
+    const lifetime = typeof res.expires_in === 'number' ? `${res.expires_in}s`
+        : typeof res.expires_at === 'string' ? `until ${res.expires_at}`
+            : ttl !== undefined ? `${ttl}s (requested; backend did not confirm)` : 'the backend default';
+    success(`Signed link (expires ${lifetime.startsWith('until') ? '' : 'in '}${lifetime}):`);
+    info(url);
+}
+async function revokeLinks(id, flags) {
+    const usage = 'myapi storage revoke-links <asset_id> [--org <id>]';
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, usage);
+    requireArg(id, 'asset_id', usage);
+    // Revoking on a public asset succeeds and changes nothing — the plain URL
+    // still serves it. Reporting that as done would be the wrong answer during
+    // an exposure, which is exactly when this gets run. Only refuse on a
+    // definite 'public'; an absent field means proceed rather than guess.
+    const all = await sdkStorage.listAssets(config.api_key, orgId);
+    const asset = all.find(a => a.asset_id === id);
+    if (asset?.visibility === 'public') {
+        error(`Asset ${id} is public, so revoking signed links changes nothing —\n` +
+            `anyone holding the plain URL can still read it.\n\n` +
+            `→ Make it private first:  myapi storage visibility ${id} private`);
+    }
+    await sdkStorage.revokeAssetLinks(config.api_key, orgId, id);
+    success(`Every signed link for ${id} is dead, including unexpired ones.`);
+    info(`Issue a fresh one for anyone who should still have access: myapi storage sign ${id}`);
 }
 // `get`: round-trip metadata for one asset. Backend has no single-asset
 // GET endpoint today, so we list + filter locally. Switch to a direct
@@ -109,11 +212,16 @@ async function get(id, flags) {
         printJson(asset);
         return;
     }
-    info(`ID:      ${asset.asset_id}`);
-    info(`Name:    ${asset.name || '(unnamed)'}`);
-    info(`URL:     ${asset.url}`);
+    const vis = asset.visibility ?? 'public';
+    info(`ID:         ${asset.asset_id}`);
+    info(`Name:       ${asset.name || '(unnamed)'}`);
+    info(`Visibility: ${vis}`);
+    if (asset.url)
+        info(`URL:        ${asset.url}`);
+    else if (vis === 'private')
+        info(`URL:        — private; sign one: myapi storage sign ${asset.asset_id}`);
     if (asset.created_at)
-        info(`Created: ${formatDate(asset.created_at)}`);
+        info(`Created:    ${formatDate(asset.created_at)}`);
 }
 // `get-url`: cheapest possible — print the public URL pattern. No API
 // call. Curl-friendly. Doesn't even verify the asset exists; that's a
@@ -136,10 +244,29 @@ const SUBCOMMAND_USAGE = {
 
 Server fetches the URL and stores the file. Useful for migrating assets that
 already live on a public URL (e.g. importing brand assets from another host).`,
-    'upload': `myapi storage upload <file> [--name <name>] [--org <id>]
+    'upload': `myapi storage upload <file> [--private] [--name <name>] [--org <id>]
 
 Direct multipart upload of a local file. Supported: ${Object.keys(EXT_TO_CT).join(', ')}.
-The display name defaults to the file's basename — override with --name.`,
+The display name defaults to the file's basename — override with --name.
+
+--private stores it with no public URL; read it back with a signed link
+(myapi storage sign <id>). Use it for anything holding personal data — the
+default is a permanent, unauthenticated URL.`,
+    'visibility': `myapi storage visibility <asset_id> <public|private> [--org <id>]
+
+Flip an asset between public and private. Going private takes effect at once:
+the plain URL stops serving and only signed links work. This is the
+close-an-exposure path — follow it with revoke-links to kill links already
+handed out.`,
+    'sign': `myapi storage sign <asset_id> [--ttl <seconds>] [--org <id>]
+
+Make a time-limited link to a private asset. The link carries its own
+authorisation, so it can go to someone with no MyAPI account.
+--ttl defaults to 900 (15 min), maximum 86400 (24h). Signing is billable.`,
+    'revoke-links': `myapi storage revoke-links <asset_id> [--org <id>]
+
+Kill every signed link for an asset, including ones that had not expired yet.
+Refused on a public asset, where it would change nothing.`,
     'get': `myapi storage get <asset_id> [--org <id>] [--json]
 
 Round-trips the API to fetch the asset's metadata (name, URL, created_at).`,
@@ -154,12 +281,19 @@ export async function run(subcommand, args, flags) {
         info(`Usage: myapi storage <subcommand>
 
 Subcommands:
-  delete <asset_id>   Permanently delete a stored asset
-  get <asset_id>      Fetch asset metadata (name, URL, created_at)
-  get-url <asset_id>  Print the public CDN URL (no API call)
-  ingest <url>        Server pulls a public URL into storage
-  list                List all your stored assets
-  upload <file>       Direct upload of a local file
+  delete <asset_id>        Permanently delete a stored asset
+  get <asset_id>           Fetch asset metadata (name, URL, visibility)
+  get-url <asset_id>       Print the public CDN URL (no API call)
+  ingest <url>             Server pulls a public URL into storage
+  list                     List all your stored assets
+  revoke-links <asset_id>  Kill every signed link for a private asset
+  sign <asset_id>          Time-limited link to a private asset
+  upload <file>            Direct upload of a local file (--private supported)
+  visibility <asset_id>    Flip an asset public|private
+
+Assets are PUBLIC by default — a permanent URL that needs no credential.
+Storing personal data? Upload with --private, or close an existing exposure
+with: myapi storage visibility <asset_id> private
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -179,6 +313,9 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'get': return get(args[0], flags);
         case 'get-url': return getUrl(args[0], flags);
         case 'delete': return del(args[0], flags);
+        case 'visibility': return visibility(args[0], args[1], flags);
+        case 'sign': return sign(args[0], flags);
+        case 'revoke-links': return revokeLinks(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for available subcommands.`);
     }
 }

package/dist/config.d.ts

@@ -9,6 +9,8 @@ export interface AccountEntry {
     registrant?: sdkDomain.Registrant;
     is_anonymous?: boolean;
     skills_installed?: boolean;
+    last_org_used?: string;
+    org_names?: Record<string, string>;
 }
 export interface Config extends AccountEntry {
     autocomplete_setup?: boolean;

package/dist/errors.d.ts

@@ -1,3 +1,7 @@
 import { MyApiError } from '@myapihq/sdk';
 export declare const ERROR_MESSAGES: Record<string, string>;
 export declare function friendlyError(err: MyApiError): string;
+export declare function withOrgContext(message: string, err: Pick<MyApiError, 'status' | 'code'>, org?: {
+    org_id: string;
+    org_name?: string;
+} | undefined): string;

package/dist/errors.js

@@ -1,3 +1,4 @@
+import { currentOrg } from './helpers.js';
 // Per-code friendly messages for MyApiError.code. Kept in its own module (not
 // index.ts) so it can be unit-tested without importing the CLI entrypoint,
 // which runs main() on import.
@@ -45,6 +46,12 @@ export const ERROR_MESSAGES = {
     // on a backend deploy we do not control the timing of, and a CLI that only
     // knows the new names would print a bare code for anyone on the old build.
     // The old five can go once that deploy is everywhere.
+    // Deploy-guard validation, added when the platform started refusing bad
+    // assertions BEFORE building — a source build costs minutes you pay for, so
+    // catching a typo up front matters more than it looks.
+    INVALID_SMOKE: 'The --smoke assertion is not usable. It must assert something: add `contains <text>` or `status <code>`. A check that only requests a path passes on any response, including the placeholder page the flag exists to catch.',
+    SMOKE_FAILED: 'The smoke assertion did not pass, so the new revision was NOT promoted. On a container with an earlier revision that one is still serving; on a FIRST deploy there was nothing to hold traffic and the failing build is live. Inspect the revision URL in the error.',
+    INVALID_HEALTH_CHECK: 'That health-check path is not usable. /healthz is refused specifically: the runtime answers it before your container does, so a probe on it passes even when your app is down. Use /livez or any other path.',
     DNS_UNAVAILABLE: 'The DNS provider is unavailable. This is platform-side and usually transient — retry shortly rather than changing your request.',
     DNS_ZONE_NOT_FOUND: 'No DNS zone for this domain. Register or import it first: myapi domain register <domain>.',
     DNS_ZONE_UNAVAILABLE: 'The DNS zone exists but could not be reached. Platform-side and transient.',
@@ -89,7 +96,33 @@ export function friendlyError(err) {
     const base = ERROR_MESSAGES[err.code] || err.code;
     // Generic fallback: append the backend's `message` when it adds info beyond
     // the friendly mapping. Future per-service detail fields can be added here.
-    if (err.detail && err.detail !== base)
-        return `${base} — ${err.detail}`;
-    return base;
+    const message = err.detail && err.detail !== base ? `${base} — ${err.detail}` : base;
+    return withOrgContext(message, err);
+}
+// A resource that exists in another org answers exactly like a typo'd id, and
+// "not found" reads as the id being wrong. So the reader checks the id — which
+// is correct — and never questions the org, which is the actual fault. Naming
+// the org that was searched turns the most common org-drift symptom into its
+// own diagnosis.
+//
+// Only on not-found, and only when an org was actually resolved: appending
+// this to every error would be the always-on banner in a different costume.
+const NOT_FOUND_CODE = /NOT_FOUND|not_found/;
+export function withOrgContext(message, err, org = currentOrg()) {
+    if (err.status !== 404 && !NOT_FOUND_CODE.test(err.code))
+        return message;
+    // ORG_NOT_FOUND is excluded deliberately: there the org id IS the thing that
+    // could not be found, so "looked in org <that same id>" restates the failure
+    // as if it were a clue.
+    if (/ORG_NOT_FOUND|org_not_found/.test(err.code))
+        return message;
+    if (!org)
+        return message;
+    const label = org.org_name ? `${org.org_name} (${shortId(org.org_id)})` : org.org_id;
+    if (message.includes(org.org_id) || (org.org_name && message.includes(org.org_name)))
+        return message;
+    return `${message}\n→ Looked in org ${label}. If it lives elsewhere, \`myapi org list\` shows the rest — pass --org <id>.`;
+}
+function shortId(id) {
+    return id.length > 12 ? `${id.slice(0, 8)}…` : id;
 }

package/dist/helpers.d.ts

@@ -1,6 +1,25 @@
-import type { Config } from './config.js';
+import { type Config } from './config.js';
 export type Flags = Record<string, string | boolean | number>;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
+/** The notice for a move, or undefined when there is nothing to say.
+ *
+ *  Pure and exported because both failure directions are silent in production:
+ *  return a string always and it becomes noise everyone filters out; return
+ *  undefined always and the wrong-org write it exists to catch goes through
+ *  unannounced. Neither shows up as a broken build, so it is pinned by a test.
+ */
+export declare function orgChangeNotice(previous: string | undefined, next: string, names?: Record<string, string>): string | undefined;
+/** The org this invocation resolved to, for `--json` consumers. */
+export declare function currentOrg(): {
+    org_id: string;
+    org_name?: string;
+} | undefined;
+/** Cache id → name so later output can name an org instead of printing a UUID.
+ *  Called by the commands that already hold the mapping (`org list`, `status`). */
+export declare function rememberOrgNames(config: Config, orgs: Array<{
+    id?: string;
+    name?: string;
+}>): void;
 export declare function requireDomain(arg: string | undefined, flags: Flags, config: Config, usage: string): string;
 export declare function requireArg(value: string | undefined, name: string, usage: string): string;
 export declare function confirmDestructive(flags: Flags, description: string, usage: string): Promise<void>;