@myapihq/cli 2.16.4 → 2.17.0

package/dist/commands/container.js

@@ -11,6 +11,7 @@ export const EXPOSES = [
     'GET /container/orgs/{org_id}/containers',
     'GET /container/orgs/{org_id}/containers/{id}',
     'DELETE /container/orgs/{org_id}/containers/{id}',
+    'PATCH /container/orgs/{org_id}/containers/{id}',
     'POST /container/orgs/{org_id}/containers/{id}/deploy',
     'GET /container/orgs/{org_id}/containers/{id}/logs',
     'GET /container/orgs/{org_id}/containers/{id}/revisions',
@@ -28,6 +29,7 @@ export const SCHEMA = {
     'max-instances': 'number',
     port: 'number',
     env: 'string',
+    unset: 'string',
     tail: 'number',
     scope: 'string',
     'no-promote': 'boolean',
@@ -587,6 +589,18 @@ Examples:
   myapi container create --name api --port 8080
   myapi container create --name nightly --type job --cron "0 3 * * *"
   myapi container create --name queue-worker --type worker --memory 1Gi`,
+    'env': `myapi container env <id> --env KEY=VALUE[,K2=V2] [--unset KEY3[,KEY4]] [--org <id>] [--json]
+
+Change environment variables on a container that already exists, and roll a new
+revision on the SAME image so they take effect. No rebuild, and the container
+keeps its URL, its scoped key and its custom domain.
+
+This is a MERGE. Variables you do not name keep their values, so adding one
+entry to an allowlist does not mean resending every secret. --unset removes.
+
+Examples:
+  myapi container env c-123 --env ALLOWED=a@x.com,b@y.com
+  myapi container env c-123 --env LOG_LEVEL=debug --unset LEGACY_FLAG`,
     'deploy': `myapi container deploy <id> <image-ref> [--org <id>] [--json]
        myapi container deploy <id> --source <dir|tar.gz> [--org <id>] [--json]
 
@@ -673,6 +687,7 @@ Subcommands:
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
                        (--smoke to verify before promoting; --no-promote to hold it back)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
+  env <id>             Change environment variables (merge; rolls a new revision)
   get <id>             Inspect a container
   list                 List containers in your org
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
@@ -691,8 +706,59 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
             info(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for the list.`);
         return;
     }
+    /**
+     * `myapi container env <id> --env K=V[,K2=V2] [--unset K3[,K4]]`
+     *
+     * Until 2026-08-19 the only way to change a variable was to delete the
+     * container and create another, losing the URL, the scoped key and the custom
+     * domain. The skill said to do exactly that, and a customer went through three
+     * generations of one container in a week because of it.
+     */
+    async function envCmd(id, flags) {
+        const config = requireConfig();
+        const orgId = requireOrg(flags, config, 'myapi container env <id> --env K=V [--unset K2]');
+        if (!id)
+            error('Missing id.\nUsage: myapi container env <id> --env KEY=VALUE[,K2=V2] [--unset KEY3[,KEY4]]');
+        const env = {};
+        if (typeof flags.env === 'string') {
+            const parsed = _parseEnv(flags.env);
+            if (typeof parsed === 'string')
+                error(parsed);
+            Object.assign(env, parsed);
+        }
+        if (typeof flags.unset === 'string') {
+            for (const k of flags.unset.split(',').map(s => s.trim()).filter(Boolean))
+                env[k] = null;
+        }
+        if (Object.keys(env).length === 0) {
+            error('Nothing to change. Pass --env KEY=VALUE to set one, or --unset KEY to remove one.\n' +
+                'This is a merge: variables you do not name keep their values.');
+        }
+        info('› Updating environment…');
+        const res = await sdkContainer.updateContainerEnv(config.api_key, orgId, id, env);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        if (res.set?.length)
+            info(`  set:     ${res.set.join(', ')}`);
+        if (res.removed?.length)
+            info(`  removed: ${res.removed.join(', ')}`);
+        // Say plainly whether the running container has the new values, because
+        // "stored" and "live" are different states and only one of them is what the
+        // caller asked for.
+        if (res.applied) {
+            success(`Redeployed on the same image — the new values are live${res.revision ? ` (${res.revision})` : ''}.`);
+        }
+        else {
+            info('  Stored. This container has no deployment yet, so the values apply on your first deploy.');
+        }
+        if (res.env)
+            info(`  ${Object.keys(res.env).length} variable(s) now set: ${Object.keys(res.env).sort().join(', ')}`);
+    }
     switch (subcommand) {
         case 'create': return create(args[0], flags);
+        case 'env': return envCmd(args[0], flags);
         case 'build-logs': return buildLogs(args[0], flags);
         case 'deploy': return deploy(args[0], args[1], flags);
         case 'list': return list(flags);

package/dist/sdk-container.test.js

@@ -144,12 +144,16 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 11 container endpoints', () => {
+    it('covers the 12 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers/{id}',
             'DELETE /container/orgs/{org_id}/containers/{id}',
+            // Added 2026-08-19. Env is the one create-time setting that is NOT
+            // immutable: PATCH merges the map and rolls a revision on the same
+            // image, so the container keeps its URL, scoped key and custom domain.
+            'PATCH /container/orgs/{org_id}/containers/{id}',
             'POST /container/orgs/{org_id}/containers/{id}/deploy',
             // Added 2026-07-28. Promote and rollback are ONE endpoint: naming a
             // revision promotes it, omitting one rolls back to the previous ready

package/dist/skills/my-container-api/SKILL.md

@@ -1,21 +1,21 @@
 ---
 name: my-container-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-a5aabfe95b85f1e6ceb2b9254441183d540e81f888cefbdcf302385b95db2fd0
+checksum: sha256-0a83428114cbc7065d1a4db4f8a0cf39ff965c51acac78f5eeff159345a08da2
 ---
 
 # MyContainerAPI
 
-A container runs a pre-built image on managed cloud infrastructure. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on background process), or a **job** (runs to completion — the only type that takes a cron schedule). Containers are the heavier-duty sibling of edge functions (`myapi fn`) — use them for native dependencies, long execution, or a full dynamic app.
+A container runs a pre-built image on managed cloud infrastructure. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on background process), or a **job** (runs to completion — the only type that takes a cron schedule).
 
 ## Capabilities
 <!-- llm:start -->
 The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 
-- `create` registers the container and issues a **scoped API key**, returned once. The running container receives it as the `MYAPI_KEY` env var, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
+- `create` registers the container and issues a **scoped API key**, returned once. The container gets it as `MYAPI_KEY`, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
 - `deploy` takes **either** a pre-built image reference **or** a source
   directory. `--source ./dir` tars the directory, builds it server-side
   (typically ~4 minutes) and deploys the result — **no Docker on your machine,
@@ -53,12 +53,12 @@ it, so the probe would never reach your container.
 
 ### Custom domains (dynamic apps)
 
-`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, served over HTTPS automatically. This is the path for a dynamic backend on a real domain — distinct from `my-funnel-api`, which serves static sites.
+`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, over HTTPS automatically. The path for a dynamic backend on a real domain — unlike `my-funnel-api`, which serves static sites.
 
 Get it right:
 
 - **Deploy first.** Binding a domain to a container that has never deployed fails (422) — there is nothing running to route to.
-- **Register the parent domain first.** The domain's MyAPI-managed parent must already be registered via `my-domain-api`. Binding `app.synthesisdaily.com` requires `synthesisdaily.com` registered in MyAPI; otherwise 422.
+- **Register the parent domain first** via `my-domain-api`. Binding `app.synthesisdaily.com` requires `synthesisdaily.com` registered in MyAPI; otherwise 422.
 - **One domain per container.** Re-binding, or binding a hostname already taken, fails (409).
 - `--remove` unbinds. `myapi container get <id>` shows the bound `custom_domain`.
 <!-- llm:end -->
@@ -127,8 +127,13 @@ way that looks like an application bug.
 - **Any 5xx from your code is replaced by an edge HTML error page.** A JSON
   error envelope will not reach the caller. Return a 4xx if the reason has to
   survive.
-- **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
-  `create` and cannot be changed by `deploy`.** Recreate to change them.
+- **`--cpu`, `--memory`, `--max-instances` and `--cron` are set at `create` and
+  cannot be changed by `deploy`.** Recreate to change those.
+- **`--env` CAN be changed after create**, with `container env` — a merge
+  (`--unset` removes) that rolls a new revision on the same image, keeping the
+  URL, the scoped key and the custom domain. Do NOT recreate to edit a variable:
+  this page said to for months, and it cost one customer three generations of
+  the same container in a week.
 
 ### Keeping a service warm
 
@@ -167,4 +172,4 @@ reply  { "success": true, "data": …, "error": null, "meta": {…} }
 
 Run `myapi container --help` for the full flag reference.
 
-**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container. Every constraint it hits is in **Runtime constraints** above.
+**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.16.4",
+  "version": "2.17.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.16.4"
+    "@myapihq/sdk": "^2.17.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",