@myapihq/cli 2.1.0 → 2.2.0

package/dist/commands/authproduct.d.ts

@@ -3,5 +3,5 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
-export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register and list OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
+export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/authproduct.js

@@ -1,5 +1,6 @@
 import { auth as sdkAuth } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
+import { confirm, isNonInteractive } from '../prompt.js';
 import { success, error, info, printTable, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
 // `myapi auth` — the END-USER auth product (my-auth-api): a managed OIDC IdP
@@ -21,8 +22,11 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/usage',
+    'DELETE /auth/orgs/{org_id}/clients/{client_id}',
+    'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'POST /auth/orgs/{org_id}/domain',
     'GET /auth/orgs/{org_id}/domain',
+    'POST /auth/orgs/{org_id}/domain/verify',
     'DELETE /auth/orgs/{org_id}/domain',
 ];
 const SUBCOMMAND_USAGE = {
@@ -40,27 +44,35 @@ in against. One per org.
     'usage': `myapi auth usage [--org <id>] [--json]
 
 Monthly active users (MAU) for the current period — auth is billed per MAU.`,
-    'domain': `myapi auth domain [show|set|delete] [--domain <host>] [--org <id>] [--json]
+    'domain': `myapi auth domain [show|set|verify|delete] [--domain <host>] [--org <id>] [--json]
 
 Serve auth on your own domain (e.g. auth.acme.com) instead of the default issuer.
+Three steps: set → publish the ownership TXT → verify → publish the A record.
 
   myapi auth domain                         Show the current custom domain + status
-  myapi auth domain set --domain auth.acme.com   Register it (prints the DNS record to create)
+  myapi auth domain set --domain auth.acme.com   Register it (prints a TXT challenge to publish)
+  myapi auth domain verify                  Check the TXT; on success prints the A record
   myapi auth domain delete                  Remove the custom domain
 
-After 'set', create the printed DNS A record; TLS provisions automatically
-(~30 min) and the domain becomes your issuer once active.`,
-    'client': `myapi auth client <list|create> [--org <id>] [--json]
+Flow: 'set' returns a TXT record to prove ownership; create it, then 'verify'.
+Once verified, create the printed A record; TLS provisions automatically (~30 min)
+and the domain becomes your issuer when active.`,
+    'client': `myapi auth client <list|create|delete|rotate> [--org <id>] [--json]
 
 OIDC clients are the apps that authenticate against your tenant.
 
   myapi auth client list
   myapi auth client create --name "My App" --type spa --redirect https://app.example.com/callback
+  myapi auth client delete <client_id> [--yes]
+  myapi auth client rotate <client_id>
 
-  --name <n>          Human label for the app (required)
+  --name <n>          Human label for the app (required for create)
   --type spa|web      spa = public (no secret); web = confidential (secret once)
-  --redirect <urls>   Allowed redirect URIs, comma-separated (required).
-                      Absolute https (or http://localhost for dev).`,
+  --redirect <urls>   Allowed redirect URIs, comma-separated (required for create).
+                      Absolute https (or http://localhost for dev).
+
+delete  Revoke a client (irreversible; stops authenticating immediately).
+rotate  Re-issue a 'web' client's secret (shown once; old secret stops working).`,
 };
 export const HELP = `Usage: myapi auth <subcommand>
 
@@ -74,7 +86,7 @@ which via \`tenant create --connections\`. (Operator/account commands moved to
 \`myapi account\`.)
 
 Subcommands:
-  client   Register and list OIDC clients (your apps)
+  client   Register, list, delete, and rotate OIDC clients (your apps)
   domain   Serve auth on your own domain (auth.acme.com)
   tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)
   usage    Monthly active users (MAU) for the current period`;
@@ -165,25 +177,34 @@ async function usage(flags) {
     info(`Period:       ${u.period}`);
     info(`Active users: ${u.active_users} MAU`);
     info(`Price:        $${(u.price_cents_each / 100).toFixed(2)} per MAU`);
+    if (u.as_of)
+        info(`As of:        ${u.as_of} (MAU is aggregated, not real-time)`);
 }
 async function domain(args, flags) {
     const action = args[0] || 'show';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth domain [show|set|delete] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth domain [show|set|verify|delete] [--org <id>]');
     const showDomain = (d) => {
         info(`Domain: ${d.domain}`);
         info(`Status: ${d.status}`);
-        if (d.status !== 'active') {
+        if (d.status === 'awaiting_verification' && d.verification) {
+            info('');
+            info('Prove ownership — create this DNS record:');
+            info(`  ${d.verification.type}  ${d.verification.name}  →  ${d.verification.value}`);
+            info('\nThen run: myapi auth domain verify');
+        }
+        else if (d.dns) {
             info('');
-            info(`DNS — create this record:`);
+            info('DNS — create this record:');
             info(`  ${d.dns.type}  ${d.dns.name}  →  ${d.dns.value}`);
-            if (d.next)
-                info(`\n${d.next}`);
         }
-        else {
+        if (d.status === 'active') {
             info(`Issuer:    ${d.issuer}`);
             info(`Login URL: ${d.login_url}`);
         }
+        else if (d.next) {
+            info(`\n${d.next}`);
+        }
     };
     if (action === 'show') {
         try {
@@ -215,6 +236,35 @@ async function domain(args, flags) {
         showDomain(d);
         return;
     }
+    if (action === 'verify') {
+        try {
+            const d = await sdkAuth.verifyDomain(config.api_key, orgId);
+            if (flags.json) {
+                printJson(d);
+                return;
+            }
+            if (d.status === 'awaiting_verification') {
+                // Shouldn't normally happen (backend returns 422 when unverified), but
+                // be defensive.
+                info('Still awaiting verification — the TXT record was not found.');
+                showDomain(d);
+            }
+            else {
+                success(`Ownership verified — domain is now "${d.status}".`);
+                showDomain(d);
+            }
+        }
+        catch (e) {
+            if (e?.code === 'DOMAIN_NOT_VERIFIED') {
+                const exp = e?.body?.expected;
+                error(`Ownership TXT record not found yet (DNS can take a few minutes). Create it and retry:\n  ${exp ? `${exp.type}  ${exp.name}  →  ${exp.value}` : 'see: myapi auth domain show'}`);
+            }
+            if (e?.code === 'NO_DOMAIN' || e?.status === 404)
+                error('No custom auth domain set. Set one first: myapi auth domain set --domain auth.example.com');
+            throw e;
+        }
+        return;
+    }
     if (action === 'delete' || action === 'remove') {
         const host = flags.domain || args[1];
         let target = host;
@@ -231,12 +281,12 @@ async function domain(args, flags) {
         success(`Custom auth domain removed: ${target}`);
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth domain [show|set|delete]`);
+    error(`Unknown action "${action}". Use: myapi auth domain [show|set|verify|delete]`);
 }
 async function client(args, flags) {
     const action = args[0] || 'list';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth client <list|create> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|delete|rotate> [--org <id>]');
     if (action === 'list') {
         const res = await sdkAuth.listClients(config.api_key, orgId);
         if (flags.json) {
@@ -282,5 +332,48 @@ async function client(args, flags) {
         }
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth client <list|create>`);
+    if (action === 'delete') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client delete <client_id> [--yes]');
+        // Destructive + irreversible — echo the exact client_id and confirm (the
+        // client stops authenticating immediately). --yes bypasses; refuse to hang
+        // in non-interactive contexts without it.
+        if (!flags.yes && !flags.y) {
+            if (isNonInteractive()) {
+                error(`Deleting client ${clientId} is irreversible. Re-run with --yes:\n  myapi auth client delete ${clientId} --yes`);
+            }
+            const ok = await confirm(`› Delete OIDC client ${clientId}? It stops authenticating immediately. (y/N) `, false);
+            if (!ok) {
+                info('Cancelled.');
+                return;
+            }
+        }
+        const res = await sdkAuth.deleteClient(config.api_key, orgId, clientId);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        success(`Client deleted: ${clientId}`);
+        return;
+    }
+    if (action === 'rotate') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client rotate <client_id>');
+        const c = await sdkAuth.rotateClient(config.api_key, orgId, clientId);
+        if (flags.json) {
+            printJson(c);
+            return;
+        }
+        success(`Secret rotated for client: ${c.client_id || clientId}`);
+        info('The previous secret stops working immediately.');
+        if (c.client_secret) {
+            info('');
+            info('New client secret (shown ONCE — store it now, it cannot be retrieved again):');
+            info(`  ${c.client_secret}`);
+        }
+        return;
+    }
+    error(`Unknown action "${action}". Use: myapi auth client <list|create|delete|rotate>`);
 }

package/dist/skills/my-api-hq/SKILL.md

@@ -13,7 +13,7 @@ The root service. It manages accounts, API keys, organizations, and billing. No
 
 ## Capabilities
 <!-- llm:start -->
-MyApiHQ is the platform's foundation. Every other service (domain, funnel, email, image, storage, pixel, webhook, workflow, url) requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
+MyApiHQ is the platform's foundation. Every other service (domain, funnel, auth, payments, fn, workflow, database, storage, email, webhook, crm, llm, image, pixel, url) requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
 
 ```
 myapihq  ──►  org_id + api_key

package/dist/skills/my-auth-api/SKILL.md

@@ -39,9 +39,10 @@ its clients.
   returns a `client_secret` **once** — store it immediately. `--redirect` lists
   allowed callback URIs (absolute https, or http://localhost for dev).
 - **Usage** — `auth usage` shows monthly active users (auth is billed per MAU).
-- **Custom domain** — `auth domain set --domain auth.acme.com` serves auth on
-  your own domain; it prints the DNS record, TLS provisions automatically, and
-  the domain becomes your issuer once active.
+- **Custom domain** — serve auth on `auth.acme.com`. Three steps: `auth domain
+  set --domain auth.acme.com` prints a **TXT ownership challenge**; publish it,
+  then `auth domain verify`; that prints the **A record** to publish, TLS
+  provisions automatically, and the domain becomes your issuer once active.
 
 **Sign-in methods** are chosen per tenant via
 `auth tenant create --connections google,password,magic` (default `google`):
@@ -61,8 +62,10 @@ CLI is only the management surface.
 | `myapi auth tenant create` | Create/enable the tenant (`--connections google,password,magic`; `--theme <json>`) |
 | `myapi auth client list` | List the OIDC clients (apps) registered to your tenant |
 | `myapi auth client create` | Register an OIDC client (`--name`, `--type spa\|web`, `--redirect`) |
-| `myapi auth usage` | Monthly active users (MAU) for the current period |
-| `myapi auth domain` | Show/set/delete a custom auth domain (`set --domain auth.acme.com`) |
+| `myapi auth client delete <id>` | Revoke a client (irreversible); `--yes` to skip the confirm |
+| `myapi auth client rotate <id>` | Re-issue a `web` client's secret (shown once) |
+| `myapi auth usage` | Monthly active users (MAU) for the current period (`as_of` shows freshness) |
+| `myapi auth domain` | Custom auth domain: `set` (TXT challenge) → `verify` → A record; also `show`/`delete` |
 <!-- generated:end -->
 
 ## Examples

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -31,7 +31,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.1.0"
+    "@myapihq/sdk": "^2.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",