@myapihq/cli 2.9.0 → 2.11.0

package/dist/helpers.js

@@ -1,4 +1,5 @@
-import { error } from './output.js';
+import { error, banner } from './output.js';
+import { saveConfig } from './config.js';
 import { confirm, isNonInteractive } from './prompt.js';
 // error() returns `never`, so after `if (!x) error(...)` TS narrows x to a
 // non-falsy value and the casts disappear.
@@ -13,8 +14,85 @@ export function requireOrg(flags, config, usage) {
     if (!orgId) {
         error(`Missing required arguments.\nUsage: ${usage}\n(Or set default: myapi config set-org <id>)`);
     }
+    noticeOrgChanged(orgId, config);
+    recordResolvedOrg(orgId, config);
     return orgId;
 }
+// ── Which org am I in? ───────────────────────────────────────────────────────
+//
+// The org is ambient, sticky and invisible: it comes from a saved default that
+// survives across turns, tasks and days, and a stale one looks exactly like a
+// correct one. Agents lose whole writes to this — a demo pushed onto a live
+// site, a domain reassigned away from the org that was serving it.
+//
+// The fix is NOT to announce the org on every command. A line that is always
+// there carries no information, gets filtered out within a day, and costs
+// tokens on every call in an agent loop. It only carries signal when it could
+// have been different — so it fires on CHANGE and is silent otherwise. Steady
+// single-org work never sees it; the moment the target moves, it says so once.
+//
+// Goes to stderr, like the spinner, so `--json | jq` and piped output stay
+// clean.
+let resolvedOrgId;
+let resolvedOrgName;
+/** The notice for a move, or undefined when there is nothing to say.
+ *
+ *  Pure and exported because both failure directions are silent in production:
+ *  return a string always and it becomes noise everyone filters out; return
+ *  undefined always and the wrong-org write it exists to catch goes through
+ *  unannounced. Neither shows up as a broken build, so it is pinned by a test.
+ */
+export function orgChangeNotice(previous, next, names = {}) {
+    if (!previous || previous === next)
+        return undefined;
+    const label = (id) => (names[id] ? `${names[id]} ` : '') + short(id);
+    return `→ org changed: ${label(previous)} → ${label(next)}`;
+}
+function noticeOrgChanged(orgId, config) {
+    const msg = orgChangeNotice(config.last_org_used, orgId, config.org_names ?? {});
+    if (msg)
+        banner(msg);
+}
+function recordResolvedOrg(orgId, config) {
+    resolvedOrgId = orgId;
+    resolvedOrgName = config.org_names?.[orgId];
+    if (config.last_org_used === orgId)
+        return;
+    // Written only on change, so the common path does no disk I/O. Failure here
+    // must never break the command the user actually asked for — the worst case
+    // is that the next run re-notices the same change.
+    try {
+        config.last_org_used = orgId;
+        saveConfig(config);
+    }
+    catch { /* advisory only */ }
+}
+function short(id) {
+    return id.length > 12 ? `${id.slice(0, 8)}…` : id;
+}
+/** The org this invocation resolved to, for `--json` consumers. */
+export function currentOrg() {
+    return resolvedOrgId ? { org_id: resolvedOrgId, org_name: resolvedOrgName } : undefined;
+}
+/** Cache id → name so later output can name an org instead of printing a UUID.
+ *  Called by the commands that already hold the mapping (`org list`, `status`). */
+export function rememberOrgNames(config, orgs) {
+    const names = { ...(config.org_names ?? {}) };
+    let changed = false;
+    for (const o of orgs) {
+        if (!o?.id || !o?.name || names[o.id] === o.name)
+            continue;
+        names[o.id] = o.name;
+        changed = true;
+    }
+    if (!changed)
+        return;
+    try {
+        config.org_names = names;
+        saveConfig(config);
+    }
+    catch { /* advisory only */ }
+}
 export function requireDomain(arg, flags, config, usage) {
     const fromFlag = typeof flags.domain === 'string' ? flags.domain : '';
     const fromConfig = typeof config.default_domain === 'string' ? config.default_domain : '';

package/dist/index.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { error, info, success, banner } from './output.js';
+import { error, info, success, banner, setResolvedContextSource } from './output.js';
 import { loadConfig } from './config.js';
 import { MyApiError, setUserAgent } from '@myapihq/sdk';
 import { friendlyError } from './errors.js';
+import { currentOrg } from './helpers.js';
 import * as fs from 'fs';
 import { parseFlags } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
@@ -12,6 +13,10 @@ const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
 // tell which client versions are still in the wild — which is what you need
 // before you can deprecate anything server-side.
 setUserAgent(`myapi-cli/${pkg.version} node/${process.versions.node}`);
+// Let `--json` output carry the org the call actually resolved to. Wired here
+// rather than imported inside output.ts so that module stays free of command
+// and config state. See printJson / requireOrg.
+setResolvedContextSource(currentOrg);
 import * as accountCmd from './commands/account.js';
 import * as keysCmd from './commands/keys.js';
 import * as billingCmd from './commands/billing.js';

package/dist/org-not-found.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-not-found.test.js

@@ -0,0 +1,42 @@
+// A resource sitting in another org answers exactly like a typo'd id. "Not
+// found" sends the reader to check the id — which is correct, and which is why
+// the org never gets questioned. Naming the org that was searched is what
+// turns the commonest org-drift symptom into its own diagnosis.
+//
+// The risk on the other side is appending it to everything, which is the
+// always-on banner in a different costume. These pin both edges.
+import { describe, it, expect } from 'vitest';
+import { withOrgContext } from './errors.js';
+const ORG = { org_id: 'org-aaaaaaaa-1111', org_name: 'Acme' };
+describe('withOrgContext', () => {
+    it('names the org searched on a 404', () => {
+        const out = withOrgContext('Funnel not found.', { status: 404, code: 'FUNNEL_NOT_FOUND' }, ORG);
+        expect(out).toContain('Funnel not found.');
+        expect(out).toContain('Acme');
+        expect(out).toContain('myapi org list');
+    });
+    it('fires on a not-found CODE even when the status is not 404', () => {
+        const out = withOrgContext('Resource not found.', { status: 400, code: 'not_found' }, ORG);
+        expect(out).toContain('Acme');
+    });
+    it('stays out of the way on unrelated errors', () => {
+        const msg = 'Too many requests. Please wait a moment and try again.';
+        expect(withOrgContext(msg, { status: 429, code: 'RATE_LIMITED' }, ORG)).toBe(msg);
+    });
+    it('says nothing when the org itself is what was not found', () => {
+        // "Looked in org X" where X is the id that does not exist restates the
+        // failure as though it were a clue.
+        const msg = 'Organization not found.';
+        expect(withOrgContext(msg, { status: 404, code: 'ORG_NOT_FOUND' }, ORG)).toBe(msg);
+    });
+    it('says nothing when no org was resolved', () => {
+        // Account-level commands (whoami, billing) never resolve an org; there is
+        // no org to blame and claiming one would be a fabrication.
+        const msg = 'Resource not found.';
+        expect(withOrgContext(msg, { status: 404, code: 'NOT_FOUND' }, undefined)).toBe(msg);
+    });
+    it('does not repeat an org the message already names', () => {
+        const msg = `Funnel not found in org ${ORG.org_id}.`;
+        expect(withOrgContext(msg, { status: 404, code: 'FUNNEL_NOT_FOUND' }, ORG)).toBe(msg);
+    });
+});

package/dist/org-notice.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-notice.test.js

@@ -0,0 +1,37 @@
+// The org-change notice has two silent failure modes and no build breaks for
+// either: always-speak turns it into noise that gets filtered out within a day
+// (and costs tokens on every call in an agent loop), always-silent lets the
+// wrong-org write it exists to catch go through unannounced. Pin both edges.
+import { describe, it, expect } from 'vitest';
+import { orgChangeNotice } from './helpers.js';
+const NAMES = { 'org-a': 'Acme', 'org-b': 'Demo Corp' };
+describe('orgChangeNotice', () => {
+    it('says nothing in steady state — the same org twice', () => {
+        expect(orgChangeNotice('org-a', 'org-a', NAMES)).toBeUndefined();
+    });
+    it('says nothing on the first ever resolution', () => {
+        // No prior means nothing has moved; announcing here would fire on every
+        // fresh config and train the reader to ignore the line.
+        expect(orgChangeNotice(undefined, 'org-a', NAMES)).toBeUndefined();
+    });
+    it('speaks when the org moves, naming both sides', () => {
+        const msg = orgChangeNotice('org-a', 'org-b', NAMES);
+        expect(msg).toBeDefined();
+        expect(msg).toContain('Acme');
+        expect(msg).toContain('Demo Corp');
+    });
+    it('still speaks when no name is cached, falling back to the id', () => {
+        // The cache is populated opportunistically by `org list` / `status`, so an
+        // agent that never ran either still has to be told the target moved.
+        const msg = orgChangeNotice('org-a', 'org-b', {});
+        expect(msg).toBeDefined();
+        expect(msg).toContain('org-a');
+        expect(msg).toContain('org-b');
+    });
+    it('shortens long ids so the line stays scannable', () => {
+        const long = 'org-7f1aa7f1-f6eb-4a6d-87b7-1bbe6584f5d6';
+        const msg = orgChangeNotice(long, 'org-b', {});
+        expect(msg).not.toContain(long);
+        expect(msg).toContain('org-7f1a');
+    });
+});

package/dist/output.d.ts

@@ -5,6 +5,11 @@ export declare function success(message: string): void;
 export declare function error(message: string): never;
 export declare function info(message: string): void;
 export declare function banner(message: string): void;
+type ResolvedContext = {
+    org_id: string;
+    org_name?: string;
+};
+export declare function setResolvedContextSource(fn: () => ResolvedContext | undefined): void;
 export declare function printJson(data: unknown): void;
 export declare function spinnerFrame(i: number): string;
 export declare function spinnerWrite(s: string): void;
@@ -16,3 +21,4 @@ export interface PrintTableOptions {
     empty?: string;
 }
 export declare function printTable<T extends object>(rows: T[], opts?: PrintTableOptions): void;
+export {};

package/dist/output.js

@@ -12,8 +12,15 @@ export function info(message) {
 export function banner(message) {
     process.stderr.write(message + '\n');
 }
+let resolvedContext;
+export function setResolvedContextSource(fn) {
+    resolvedContext = fn;
+}
 export function printJson(data) {
-    console.log(JSON.stringify(data, null, 2));
+    const ctx = resolvedContext?.();
+    const stampable = ctx && data !== null && typeof data === 'object' && !Array.isArray(data);
+    const payload = stampable ? { ...data, _resolved: ctx } : data;
+    console.log(JSON.stringify(payload, null, 2));
 }
 // Spinner / line-clear primitives. Used by polling helpers (utils.pollJob)
 // and any handler that wants its own progress UI.

package/dist/skills/my-api-hq/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-api-hq
-version: 1.0.0
+version: 1.1.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-fab324491446026e1600ac531bfbb164c10d46a617e528e6886be74b7dbdb4b1
+checksum: sha256-6f54c719facde1ddcdee04ffcf9527ed42550cbfc67679ced5aea55fc7adba7d
 ---
 
 # MyApiHQ
@@ -15,14 +15,6 @@ The root service. It manages accounts, API keys, organizations, and billing. No
 <!-- llm:start -->
 MyApiHQ is the platform's foundation. Every other service (domain, funnel, auth, payments, fn, workflow, database, storage, email, webhook, crm, llm, image, pixel, url) requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
 
-```
-myapihq  ──►  org_id + api_key
-                  │
-          ┌───────┴────────┐
-     mydomainapi       myfunnelapi
-     (domains)         (websites)
-```
-
 ### Anonymous vs registered accounts
 
 Two tiers, chosen at setup time:
@@ -42,6 +34,7 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 | Command | What it does |
 |---|---|
 | `myapi account setup` | Interactive setup: creates account, generates api_key, sets defaults |
+| `myapi status` | Single-screen orientation: account + every resource in the default org. Start here when you don't know what already exists |
 | `myapi account whoami` | Show current account, default org/funnel, balance, free-tier usage |
 | `myapi account link [email]` | Upgrade anonymous account to registered (or add a second session) |
 | `myapi account switch [index]` | Switch active account |
@@ -72,6 +65,7 @@ myapi account setup
 myapi org create "Acme" --yes
 
 # Day-to-day
+myapi status                   # what exists already, in one screen
 myapi account whoami           # confirm what's active
 myapi billing balance       # before doing anything that costs credits
 myapi billing topup 20      # add $20
@@ -98,28 +92,54 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
-## Minting a least-privilege API key
+## Scoping a key — and why `--org` is the one that saves you
 
 A key's authority is inline and always a subset of the key that mints it, so
 you can hand work a key that cannot exceed its job:
 
 ```bash
+myapi keys create --name agent --org <id> --grant '*'       # locked to ONE org
 myapi keys create --name ci --grant funnel:write,storage:read
 myapi keys create --name readonly --grant '*:read'          # read anything, write nothing
 myapi keys create --name billing-fn --org <id> --grant email --spend-cap 25
 ```
 
+- `--org <id>` — **lock it to one org.** Omit for account-wide.
 - `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
   means all. **Omitting `--grant` mints an unrestricted key.**
-- `--org <id>` — lock it to one org. Omit for account-wide.
 - `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.
 - `keys revoke-all --kind function|manual|account` narrows the kill switch.
 
+**Agents working for one org: use an org-locked key.** The org is otherwise
+ambient — a saved default that survives across turns, where a stale one looks
+exactly like a correct one. That is how a demo lands on a live site. Locking
+turns a wrong-org write into a `403`. Keep your *own* key account-wide though:
+an org-locked one cannot create orgs or manage billing.
+
+Two more signals, no flags needed: resolving to a different org than last time
+prints `→ org changed: <from> → <to>` on stderr, once — silence means it has
+not moved. Under `--json`, object responses carry `_resolved: {org_id,
+org_name}`; assert on that rather than assuming.
+
 ## Org profile fields
 
 `myapi org create <name>` also takes `--tagline`, `--description`,
 `--business-sector` and `--logo-url`. They populate the org's public profile
-and the funnel created alongside it, so setting them at create avoids editing
-two places later.
+and the funnel created alongside it.
+
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   GET /hq/orgs/{org_id}
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
 
 Run `myapi --help` or `myapi <command> --help` for full flag reference.

package/dist/skills/my-audience-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Saved audiences = named Goldfox-filter snapshots over the people or company database. Build a target list once, name it, reuse it across campaigns, refresh to re-evaluate against current data. The persistence layer on top of my-people-api + my-company-api.
 triggers: [audience, segment, target list, saved filter, goldfox, lead list, abm list, refresh, members, prospect database]
-checksum: sha256-a2c7142e880932ac2aa53cdb29b8632ce2c4d5ef33c3f8b6df705f7e987ab6af
+checksum: sha256-3fc9f2966804381cb9e2b5f52d44a0c12c857f243b151a93a813c6345574f07f
 ---
 
 # MyAudienceAPI
@@ -136,4 +136,19 @@ myapi audience create "EU growth-stage SaaS accounts" \
 - Audiences are per-org. Two orgs can have audiences with the same name; ids are globally unique.
 - Look before you delete: confirm the target with `myapi audience get <id>`, pass `--org` explicitly; delete verbs require `--yes` in non-interactive runs.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /audience/orgs/{org_id}/audiences
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi audience --help` for full flag reference.

package/dist/skills/my-auth-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-5eeacc463d7323f85a330639b7073f735ccc80bddfb8217c9c15c56989b8a99a
+checksum: sha256-07690e940717e8f65c195f9fbecdc1def9372edfd52dea19f6570227008d28ad
 ---
 
 # MyAuthAPI
@@ -121,4 +121,19 @@ with no email — for throwaway or machine-owned orgs. It cannot receive
 password resets or magic links, so attach a real identity before anything
 depends on it. `myapi status` shows `Type: anonymous`.
 
-**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (verify the id_token for identity; the access token is a bearer credential for `<issuer>/userinfo`).
+**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (verify the id_token for identity; the access token is a bearer credential for `<issuer>/userinfo`).
+
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /auth/orgs/{org_id}/tenant
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->

package/dist/skills/my-company-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Company database backed by the Goldfox crawl. Filter companies by Goldfox confidence tier, country/TLD consistency, behavioral page signals (has_careers_page, has_investors_page, has_shop_page, has_c_level, has_decision_maker), legal-entity status, headcount, and source-URL count. Account-based targeting and B2B firmographics.
 triggers: [companies, accounts, firmographics, abm, search, filter, goldfox, careers signal, investors, c-level, shop, b2b targeting]
-checksum: sha256-4754de8a66bf13e7e2f2a23acc407ccec147e142abf8adc670ae7962ca860a74
+checksum: sha256-5204c6218af2d4c52b1b81aa0d917b69c863be1d3c0384d2d2f7d9dda1587534
 ---
 
 # MyCompanyAPI
@@ -107,4 +107,19 @@ myapi audience members $AID --limit 50 --json > accounts.json
 - `keyword` is a substring match on the company's **domain** — use `--keyword stripe` to find domains containing "stripe".
 - For a persistent account list, use `my-audience-api` with `--from company`.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /company/orgs/{org_id}/search
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi company --help` for full flag reference.

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-47eda6baa9055dadbd3e9d04df9fc425f1a7e96a9cd80c971c4951b97f1e94ff
+checksum: sha256-a5aabfe95b85f1e6ceb2b9254441183d540e81f888cefbdcf302385b95db2fd0
 ---
 
 # MyContainerAPI
@@ -23,26 +23,33 @@ The lifecycle is **create → deploy → (optionally) bind a custom domain**.
   can deploy; you do not need to be able to run one.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
-### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
+### Deploying safely
 
-A deploy takes 100% of traffic the moment it lands. There is no dry run, no
-definition of correct beyond "something is listening on the port", and no way
-back. Plan for that.
+A plain deploy takes 100% of traffic the moment it lands.
 
-`--no-promote` and `--smoke` exist as flags and **the CLI refuses them**: they
-shipped before the platform could honour them, and a guard that silently
-passes is worse than no guard. `--health-check` is accepted at create but does
-not appear on the container afterwards, so do not rely on it either.
+**`--smoke '<assertion>'`** deploys the revision with no traffic, checks the
+assertion, and promotes only if it holds. A failure returns `SMOKE_FAILED`,
+leaves the previous revision serving, and returns a revision URL to inspect.
 
-Until they work, the only safe sequence is:
+```bash
+myapi container deploy <id> --source ./app --smoke 'GET / contains assets/'
+```
+
+**Assert on content, not status.** A build whose frontend never bundled still
+binds its port and answers `200` — that is how a placeholder page reached
+production and served a dead page for fifteen minutes.
 
-1. deploy to a **non-production** container
-2. verify it yourself — `curl` for a string only a real build emits, not just
-   a 200, because a broken build returns 200 too
-3. deploy the same image to production
+**`--no-promote`** holds the revision back and prints a URL to test yourself,
+then `myapi container promote <id> <revision>`. Use it when the check is more
+than one assertion. On a container's *first* deploy nothing is serving yet, so
+traffic is not withheld and the output says so.
 
-`myapi container promote <id> <revision>` currently fails, so a bad deploy
-must be fixed by deploying forward. Keep a known-good image reference to hand.
+**`myapi container rollback <id>`** returns traffic to the previous ready
+revision in seconds, no rebuild.
+
+`--health-check /livez` at create makes the startup probe an HTTP request
+rather than a bare TCP connect. `/healthz` is refused — the runtime intercepts
+it, so the probe would never reach your container.
 
 ### Custom domains (dynamic apps)
 
@@ -85,14 +92,14 @@ myapi container deploy <id> --source ./my-app
 # 2b. Or ship an image you already built and pushed.
 myapi container deploy <id> registry.example.com/my-app:v1
 
-# Either way this takes 100% of traffic immediately — there is no staging
-# step, so verify on a non-production container FIRST.
+# A plain deploy takes 100% of traffic the moment it lands. Gate it with
+# --smoke, or hold it back with --no-promote and test the revision yourself.
 
-# 3. Check what you actually shipped. Assert on content: a build whose
-#    frontend never bundled still binds its port and returns 200.
+# 3. Verify content, not status: a build whose frontend never bundled
+#    still binds its port and returns 200.
 curl -s https://<your-domain>/ | grep -q 'assets/' || echo "BROKEN BUILD"
 
-# 3. Serve it on a custom domain. The parent domain must already be
+# 4. Serve it on a custom domain. The parent domain must already be
 #    registered: myapi domain register synthesisdaily.com
 myapi container domain <id> app.synthesisdaily.com
 # → app.synthesisdaily.com now serves the container over HTTPS
@@ -121,8 +128,7 @@ way that looks like an application bug.
   error envelope will not reach the caller. Return a 4xx if the reason has to
   survive.
 - **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
-  `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
-  nothing. Recreate the container to change them.
+  `create` and cannot be changed by `deploy`.** Recreate to change them.
 
 ### Keeping a service warm
 
@@ -144,6 +150,21 @@ service costs nothing while idle.
   `invalid_json_response`. Build the tarball yourself and pass
   `--source ctx.tar.gz`, or keep the directory clean.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /container/orgs/{org_id}/containers
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi container --help` for the full flag reference.
 
-**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (env vars are create-only; a service is multi-instance; health-check `/livez` not `/healthz`).
+**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container. Every constraint it hits is in **Runtime constraints** above.

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-dfadb20670d9d978503549d330c2c9717fbe6d13ac35b53d9e1a8874d2136fde
+checksum: sha256-3f840c8d7205d6a3eacc7c2be3ba2580a52a1964c085af241fd9ad67d48e19b6
 ---
 
 # MyCRMAPI
@@ -167,4 +167,19 @@ myapi crm contacts events <id> --kind webhook_received
 - **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.
 - **Free in v1.** Metered later if usage warrants.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /crm/orgs/{org_id}/contacts
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi crm --help` or `myapi crm <namespace> --help` for inline reference.

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-924071245c33bf3e43f085fbd756af003e19c990f4522f658de33f42504452d7
+checksum: sha256-9b6f14fa5b0115ce042c71f861cb71ec8993aa68447d740b63f5b3689c23b629
 ---
 
 # MyDatabaseAPI
@@ -105,26 +105,22 @@ myapi database get "by-email:$EMAIL" --ns users --json | jq -r .value
 - **Free in v1.** Metered later if usage shows a need. Cost discipline still applies — store data, not blobs.
 
 
-## Calling this from deployed code (HTTP)
-
-The CLI is not what runs in production — a deployed function or container calls
-the HTTP API directly. That surface was previously only discoverable by
-grepping the CLI bundle, which cost one team an hour per slot.
+## HTTP (from deployed code)
 
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
 ```
-base    https://api.myapihq.com
-path    /database/orgs/{org_id}/namespaces/{ns}/keys/{key}
-auth    Authorization: Bearer <api key>
-        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
-body    writes take {"value": <json>} — the value is WRAPPED
-reply   { "success": true, "data": …, "error": null, "meta": {…} }
-        Unwrap `data`. On failure `success` is false and `error` is
-        { code, message }.
+base   https://api.myapihq.com
+path   PUT /database/orgs/{org_id}/namespaces/{ns}/keys/{key}
+body   writes are WRAPPED: {"value": <json>} — not the bare value
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
 ```
 
-**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
-**Base URLs differ per slot** — do not assume one host for everything.
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
 
 Run `myapi database --help` for inline reference.
 
-**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (KV writes must be wrapped as `{"value": …}`).
+**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (KV writes must be wrapped as `{"value": …}`).