@myapihq/cli 2.12.0 → 2.14.0

package/dist/commands/feedback.js

@@ -14,10 +14,16 @@ export const EXPOSES = [
     'POST /feedback/orgs/{org_id}/items',
     'POST /feedback/orgs/{org_id}/items/{id}/resolve',
     'DELETE /feedback/orgs/{org_id}/items/{id}',
+    'GET /feedback/orgs/{org_id}/widgets',
+    'PATCH /feedback/orgs/{org_id}/widgets/{id}',
     'POST /feedback/orgs/{org_id}/widgets',
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
 export const SCHEMA = {
+    routes: 'string',
+    accent: 'string',
+    position: 'string',
+    label: 'string',
     kind: 'string',
     status: 'string',
     body: 'string',
@@ -50,14 +56,24 @@ export async function list(flags) {
     // that explicitly, having been bitten by the opposite in CRM search.
     const shown = page.items?.length ?? 0;
     info(shown === page.total ? `${shown} item${shown === 1 ? '' : 's'}` : `${shown} of ${page.total} items`);
+    // The table cannot carry a signed URL, a selector and a navigation trace, so
+    // it flags what exists and --json carries it. Saying nothing about a
+    // screenshot would leave a picture nobody knows to look for.
     printTable((page.items ?? []).map(i => ({
         id: i.id,
         kind: i.kind,
         status: i.status,
         body: i.body.length > 60 ? `${i.body.slice(0, 57)}…` : i.body,
         route: i.route ?? i.page_url ?? '',
+        // A failed signature still means a picture is there — distinguish that
+        // from having none, rather than showing both as blank.
+        shot: i.screenshot_url ? 'yes' : (i.screenshot_asset_id ? 'unsigned' : ''),
         created: i.created_at ? formatDate(i.created_at) : '',
     })), { flags, empty: 'No feedback yet. Put a widget on a page: myapi feedback widget create <name>' });
+    const withShots = (page.items ?? []).filter(i => i.screenshot_url || i.screenshot_asset_id).length;
+    if (withShots > 0 && !flags.json) {
+        info(`${withShots} item${withShots === 1 ? ' has' : 's have'} a screenshot — \`--json\` carries the link (signed, ~1h).`);
+    }
     if (page.has_more)
         info('More available — raise --limit or pass --offset.');
 }
@@ -130,6 +146,58 @@ export async function widget(sub, arg, flags) {
         }
         return;
     }
+    if (sub === 'list') {
+        const ws = await sdkFeedback.listWidgets(config.api_key, orgId);
+        if (flags.json) {
+            printJson(ws);
+            return;
+        }
+        if (!ws.length) {
+            info('No widgets yet. Mint one: myapi feedback widget create <name>');
+            return;
+        }
+        for (const w of ws) {
+            info(`${w.id}  ${w.name || '(unnamed)'}`);
+            // The platform builds the tag; printing it beats making anyone assemble
+            // the URL from a key and a base by hand.
+            info(`  ${w.script_tag || `<script src="https://api.myapihq.com/feedback/in/${w.key}/widget.js" async></script>`}`);
+            info(`  routes:  ${w.routes?.length ? w.routes.join(', ') : '(everywhere)'}`);
+            info(`  origins: ${w.allowed_origins?.length ? w.allowed_origins.join(', ') : '(any — anyone can post with this key)'}`);
+            info('');
+        }
+        return;
+    }
+    if (sub === 'update') {
+        requireArg(arg, 'id', 'myapi feedback widget update <id> [--routes /a,/b] [--origins a.com] [--accent #2563eb] [--position bottom-right] [--label "Feedback"]');
+        const patch = {};
+        const csv = (v) => typeof v === 'string' ? v.split(',').map(s => s.trim()).filter(Boolean) : undefined;
+        if (flags.routes !== undefined)
+            patch.routes = csv(flags.routes);
+        if (flags.origins !== undefined)
+            patch.allowed_origins = csv(flags.origins);
+        if (typeof flags.name === 'string')
+            patch.name = flags.name;
+        const theme = {};
+        for (const k of ['accent', 'position', 'label']) {
+            if (typeof flags[k] === 'string')
+                theme[k] = flags[k];
+        }
+        if (Object.keys(theme).length)
+            patch.theme = theme;
+        if (Object.keys(patch).length === 0) {
+            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label.');
+        }
+        const w = await sdkFeedback.updateWidget(config.api_key, orgId, arg, patch);
+        if (flags.json) {
+            printJson(w);
+            return;
+        }
+        success(`Widget ${arg} updated`);
+        // The key is unchanged, which is the reason to use this instead of
+        // revoke + create — the customer's page does not need editing.
+        info('Same key, so your page needs no change. Route changes reach browsers within ~5 minutes.');
+        return;
+    }
     if (sub === 'revoke') {
         requireArg(arg, 'id', 'myapi feedback widget revoke <id>');
         await confirmDestructive(flags, `revoke widget ${arg} (submissions with it stop immediately)`, 'myapi feedback widget revoke <id> [--yes] [--org <id>]');
@@ -138,7 +206,7 @@ export async function widget(sub, arg, flags) {
         info('Feedback already collected through it is kept.');
         return;
     }
-    error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget revoke <id>');
+    error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget list\n       myapi feedback widget update <id> [--routes <list>] [--origins <list>]\n       myapi feedback widget revoke <id>');
 }
 const SUBCOMMAND_USAGE = {
     'delete': `myapi feedback delete <id> [--yes] [--org <id>]
@@ -154,7 +222,8 @@ Newest first. \`total\` is the number of matches, not the page size.`,
 
 --kind is what the person reporting says it is, not what the text sounds like.`,
     'resolve': 'myapi feedback resolve <id> [--org <id>]',
-    'widget': `myapi feedback widget create <name> [--origins a.com,b.com] [--org <id>]
+    'widget': `myapi feedback widget list
+       myapi feedback widget create <name> [--origins a.com,b.com] [--org <id>]
        myapi feedback widget revoke <id> [--yes] [--org <id>]
 
 The key a widget mints is PUBLIC — it ships in page source and authenticates
@@ -173,7 +242,9 @@ Subcommands:
   list                 List feedback, newest first (--kind, --status, --limit, --offset)
   resolve <id>         Close a piece of feedback
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)
+  widget list          List widgets with the script tag to paste
   widget revoke <id>   Revoke a widget key; collected feedback is kept
+  widget update <id>   Change routes/origins/theme, keeping the same key
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;

package/dist/commands/fn.d.ts

@@ -12,6 +12,7 @@ export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function deploy(id: string, bundlePath: string, flags: Flags): Promise<void>;
 export declare function _parseSetPairs(raw: string | string[]): Record<string, string> | string;
+export declare function scopes(id: string | undefined, flags: Flags): Promise<void>;
 export declare function setEnv(id: string, name: string, value: string, flags: Flags): Promise<void>;
 export declare function runs(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -3,7 +3,7 @@ import { fn as sdkFn } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson, banner, spinnerFrame, spinnerWrite, clearLine } from '../output.js';
 import { formatDate } from '../utils.js';
-import { requireOrg, confirmDestructive } from '../helpers.js';
+import { requireOrg, requireArg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
     'POST /function/orgs/{org_id}/functions',
     'GET /function/orgs/{org_id}/functions',
@@ -12,6 +12,7 @@ export const EXPOSES = [
     'POST /function/orgs/{org_id}/functions/{id}/bundle',
     'POST /function/orgs/{org_id}/functions/{id}/env',
     'GET /function/orgs/{org_id}/functions/{id}/runs',
+    'PATCH /function/orgs/{org_id}/functions/{id}/scopes',
 ];
 export const SCHEMA = {
     // `create` takes a positional name; --name stays accepted for
@@ -231,6 +232,42 @@ export function _parseSetPairs(raw) {
     }
     return env;
 }
+// scopes changes which slots a deployed function may call, in place.
+//
+// This closes the trap the skill used to have to warn about: --scope was
+// create-only, so adding a slot meant delete + recreate, which minted a NEW
+// function id and invocation URL and broke every reference already handed out.
+// One customer hit that twice in a day and was left over-provisioning scopes
+// up front — the opposite of the least privilege the flag exists to encourage.
+export async function scopes(id, flags) {
+    const usage = "myapi fn scopes <id> --set <slot,slot> [--org <id>]";
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, usage);
+    requireArg(id, 'id', usage);
+    const raw = typeof flags.set === 'string' ? flags.set : '';
+    const list = raw.split(',').map(s => s.trim()).filter(Boolean);
+    if (list.length === 0) {
+        error(`Missing --set.\nUsage: ${usage}\n\n` +
+            `→ --set REPLACES the scope list; name every slot the function should reach.\n` +
+            `  See the current list with: myapi fn get ${id ?? '<id>'}`);
+    }
+    const res = await sdkFn.setFunctionScopes(config.api_key, orgId, id, list);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Scopes for ${id}: ${list.join(', ')}`);
+    info('The function id and invocation URL are unchanged — references already handed out keep working.');
+    // Same rotation as a deploy, and for the same reason: a narrowing that left
+    // the old key alive would narrow nothing. Say so, because a caller holding a
+    // manual copy of the key needs to know it just went stale.
+    info('');
+    info('The scoped key was replaced and pushed to the running function.');
+    if (res.scoped_api_key)
+        info(`  New value (returned once): ${res.scoped_api_key}`);
+    else
+        info('  env.__MYAPI_KEY inside the function is already current; a manual copy is now stale.');
+}
 // env sets encrypted secret(s) (Stripe key, etc.) on a deployed function.
 // Single form:  myapi fn env <id> <name> <value>
 // Bulk form:    myapi fn env <id> --set K=V[,K2=V2 ...]
@@ -325,6 +362,14 @@ in MyAPI or echoed back. The function must already be deployed.
 
   Single:  myapi fn env <id> STRIPE_KEY sk_live_...
   Bulk:    myapi fn env <id> --set STRIPE_KEY=sk_live_...,WEBHOOK_SECRET=whsec_...`,
+    'scopes': `myapi fn scopes <id> --set <slot,slot> [--org <id>]
+
+Change which slots a deployed function may call, in place. The function id and
+invocation URL are unchanged, so references already handed out keep working.
+
+--set REPLACES the list: name every slot the function should reach, not just
+the new one. The scoped key is replaced and pushed to the running function, the
+same as a deploy does — env.__MYAPI_KEY stays current, a manual copy goes stale.`,
     'runs': `myapi fn runs <id> [--org <id>] [--json]
 
 Lists recent invocation records (most recent first, up to 100).`,
@@ -346,6 +391,7 @@ Subcommands:
   get <id>             Inspect a function
   list                 List functions in your org
   runs <id>            List recent invocation records
+  scopes <id>       Change which slots the function may call (--set a,b)
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -362,6 +408,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'create': return create(args[0], flags);
         case 'deploy': return deploy(args[0], args[1], flags);
         case 'env': return setEnv(args[0], args[1], args[2], flags);
+        case 'scopes': return scopes(args[0], flags);
         case 'runs': return runs(args[0], flags);
         case 'list': return list(flags);
         case 'get': return get(args[0], flags);

package/dist/sdk-function.test.js

@@ -213,7 +213,7 @@ describe('fn.listFunctionRuns', () => {
     });
 });
 describe('fn.EXPOSES', () => {
-    it('matches the Story 1 + Story 2/4/5 contract — exactly 7 endpoints', () => {
+    it('matches the Story 1 + Story 2/4/5 contract, plus in-place scopes — exactly 8 endpoints', () => {
         expect(fn.EXPOSES).toEqual([
             'POST /function/orgs/{org_id}/functions',
             'GET /function/orgs/{org_id}/functions',
@@ -222,6 +222,10 @@ describe('fn.EXPOSES', () => {
             'POST /function/orgs/{org_id}/functions/{id}/bundle',
             'POST /function/orgs/{org_id}/functions/{id}/env',
             'GET /function/orgs/{org_id}/functions/{id}/runs',
+            // Added 2026-08-13. Scopes became changeable in place, which is what
+            // ends the delete-and-recreate trap that cost a customer two invocation
+            // URLs in one day.
+            'PATCH /function/orgs/{org_id}/functions/{id}/scopes',
         ]);
     });
     it('exposes deploy/env/runs but not /logs (still pending)', () => {

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.2.0
+version: 1.4.0
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-199fba185e85ccc91a6858bce4a60e20167a6591dee28cbc475606c72cb8d787
+checksum: sha256-b8a6dbed6fa4aa393e538225ae611f5f5d8c4fbb1ffea7922e4a0286d984eca4
 ---
 
 # MyFeedbackAPI
@@ -43,7 +43,8 @@ theme baked in. This is the intended way in — you do not build a UI:
 ```
 
 It renders a button, shows itself only on the routes the widget is configured
-for, and lets the person point at an element or drag a region. It sends `kind`,
+for (set them with `widget update <id> --routes /app,/app/**`; changes reach
+browsers within ~5 minutes with no redeploy of your site), and lets the person point at an element or drag a region. It sends `kind`,
 `body`, `page_url`, `route`, `viewport`, plus **either** `target_selector` (they
 clicked something) **or** `target_region` `{x,y,w,h}` (they dragged a box).
 
@@ -51,9 +52,15 @@ A wrong key does not break the page: the response is `application/javascript`
 carrying a JS comment that names the fix, so a typo cannot throw a syntax error
 in your app.
 
-**No screenshots.** The submit body takes no image and there is no multipart
-form — `target_selector` / `target_region` are the platform's answer to "where
-were they pointing". Do not build a capture step expecting somewhere to put it.
+**Screenshots are automatic — you do not build a capture step.** When someone
+opens the feedback sheet the widget fetches a renderer on demand and attaches
+the picture itself, as a second call after the report is saved. That ordering is
+deliberate: an image that fails to render or upload never costs the report.
+
+The image is **stored private in your org's assets**, and listing feedback
+returns a **signed link good for about an hour** (`screenshot_url`). It is
+signed on read, so it is not stable — re-list rather than persisting it. PNG,
+JPEG or WebP up to 3 MB; over that the feedback is kept without the picture.
 
 ### Submitting by hand (only if you cannot use the script)
 
@@ -85,6 +92,11 @@ processed signal.
 
 ### Reading it back
 
+Each item also carries what was pointed at (`target_selector`, `target_region`,
+`target_context`), how they got there (`trace`), the `viewport`, and
+`screenshot_url` when there is a picture. The table flags which items have one;
+`--json` carries the link.
+
 `myapi feedback list` is newest first, filterable by `--kind` and `--status`
 (`open` | `resolved`), paged with `--limit` / `--offset`. **`total` is the
 number of matches, not the size of the page**, and `has_more` flags a truncated
@@ -104,6 +116,8 @@ that is deliberate, so ids cannot be probed across orgs.
 | `myapi feedback resolve <id>` | Close an item, keeping it |
 | `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
+| `myapi feedback widget list` | List widgets, each with the script tag to paste |
+| `myapi feedback widget update <id>` | Change `--routes`, `--origins`, `--name`, or the look (`--accent`, `--position`, `--label`), keeping the same key |
 | `myapi feedback widget revoke <id>` | Revoke a key; collected feedback is kept |
 <!-- generated:end -->
 
@@ -114,7 +128,13 @@ that is deliberate, so ids cannot be probed across orgs.
 myapi feedback widget create marketing --origins example.com,www.example.com
 # → prints a PUBLIC key to embed in the page
 
-# 2. Read what came back, newest first
+# 2. See your widgets and the exact tag to paste
+myapi feedback widget list
+
+# 3. Change where it appears — same key, so your page needs no edit
+myapi feedback widget update <id> --routes /app,/app/**
+
+# 4. Read what came back, newest first
 myapi feedback list --status open
 myapi feedback list --kind bug --limit 20
 

package/dist/skills/my-function-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-function-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-0ab1d08fb6c9cc917fd3d1aa5d730ff3e4fe5dd37e8e30ebe225085593139cca
+checksum: sha256-3702cfd630b5ff8a892704c4f6aee9f6678881c73fd3522ce4bd52be865e639e
 ---
 
 # MyFunctionAPI
@@ -40,6 +40,7 @@ Name rules (validated client- and server-side, kept identical):
 | `myapi fn runs <id>` | List recent invocation records (status, duration, errors) |
 | `myapi fn list` | List functions in your org |
 | `myapi fn get <id>` | Inspect a function (name, trigger, invocation URL) |
+| `myapi fn scopes <id> --set <slot,slot>` | Change which slots the function may call, in place. Replaces the list; rotates the scoped key |
 | `myapi fn delete <id>` | Soft-delete the record + revoke the scoped API key |
 <!-- generated:end -->
 
@@ -70,6 +71,9 @@ myapi fn create --name daily-report --cron "0 8 * * *"
 # Register with a narrowed key — the function can only call email + storage
 myapi fn create --name mailer --scope email,storage
 
+# Need another slot later? Change it in place — same id, same URL.
+myapi fn scopes fn_abc123 --set email,storage,crm
+
 # List + inspect
 myapi fn list
 myapi fn get fn_abc123
@@ -129,11 +133,18 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 - Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
 - `myapi fn env <id> --set KEY=VALUE,OTHER=VALUE` sets several secrets in one call instead of one command each.
 
-**`--scope` is create-only, so treat it as permanent.** There is no
-`fn scope --add`. Adding a slot later means delete + recreate, which mints a
-**new function id and a new invocation URL**, breaking every reference already
-handed out — docs, front-end config, webhooks, anything given to a third
-party. Decide the full slot list before you publish the URL.
+**Scopes are changeable in place — `myapi fn scopes <id> --set <slot,slot>`.**
+The function id and invocation URL are unchanged, so references already handed
+out keep working. This used to be create-only, and adding a slot meant delete +
+recreate with a new id and URL; that is no longer the trade-off.
+
+Two things to know:
+
+- **`--set` REPLACES the list**, it does not add to it. Name every slot the
+  function should reach. `myapi fn get <id>` shows the current set.
+- **It rotates the scoped key**, exactly as a deploy does — a narrowing that
+  left the old key alive would narrow nothing. `env.__MYAPI_KEY` inside the
+  function is updated for you; a copy you saved elsewhere goes stale.
 
 ## HTTP (from deployed code)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.12.0",
+  "version": "2.14.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.12.0"
+    "@myapihq/sdk": "^2.14.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",