@myapihq/cli 2.16.4 → 2.18.0

package/dist/commands/auth-client-update.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/auth-client-update.test.js

@@ -0,0 +1,52 @@
+// Unit tests for the `auth client update` helpers.
+//
+// The subcommand exists because its absence cost a customer a container
+// generation: the PATCH route shipped on 19.08.2026 and the CLI still offered
+// only list|create|delete|rotate, so changing a redirect URI meant delete and
+// recreate — a new client_id, every deployed copy reconfigured, and two
+// audiences accepted through the cutover.
+//
+// Two things here would be silent if they broke: a --redirect that quietly
+// means "replace" while the customer reads "add", and a PATCH with nothing in
+// it answering 200.
+import { describe, it, expect } from 'vitest';
+import { _parseRedirects, _updateInput } from './authproduct.js';
+describe('_parseRedirects', () => {
+    it('takes every URI, comma-separated and trimmed', () => {
+        expect(_parseRedirects(' https://a.example.com/cb , https://b.example.com/cb '))
+            .toEqual(['https://a.example.com/cb', 'https://b.example.com/cb']);
+    });
+    it('drops a trailing comma rather than sending a blank URI', () => {
+        // The backend refuses an empty entry with INVALID_REDIRECT_URI, so passing
+        // one on turns a typo into a rejection the customer cannot read.
+        expect(_parseRedirects('https://a.example.com/cb,')).toEqual(['https://a.example.com/cb']);
+    });
+    it('is the same parser create uses', async () => {
+        // create and update must agree on what a redirect list is. They had two
+        // copies of this line; the second copy is the one that drifts.
+        const src = await import('node:fs').then(fs => fs.readFileSync(new URL('./authproduct.ts', import.meta.url), 'utf8'));
+        const splits = src.match(/redirect\.split\(/g) || [];
+        expect(splits.length, 'a second inline redirect parser has appeared').toBe(0);
+    });
+});
+describe('_updateInput', () => {
+    it('refuses a PATCH that would change nothing', () => {
+        const got = _updateInput('cli_123', '', '');
+        expect(got).toHaveProperty('error');
+        // The refusal names the next command, which is the house rule for refusals.
+        expect(got.error).toContain('myapi auth client update cli_123');
+    });
+    it('refuses a --redirect that parses to nothing', () => {
+        // ` , ` is not "keep what is there" — it replaces the list with an empty
+        // one, leaving a client that can never complete a sign-in.
+        expect(_updateInput('cli_123', ' , ', '')).toHaveProperty('error');
+    });
+    it('sends only the fields that were given', () => {
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', ''))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'] } });
+        expect(_updateInput('cli_123', '', 'Renamed'))
+            .toEqual({ input: { name: 'Renamed' } });
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', 'Both'))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'], name: 'Both' } });
+    });
+});

package/dist/commands/authproduct.d.ts

@@ -1,8 +1,15 @@
+import { auth as sdkAuth } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
-export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
+export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, update, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
+export declare function _parseRedirects(raw: string): string[];
+export declare function _updateInput(clientId: string, redirect: string, name: string): {
+    error: string;
+} | {
+    input: sdkAuth.UpdateClientInput;
+};

package/dist/commands/authproduct.js

@@ -22,6 +22,7 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/usage',
+    'PATCH /auth/orgs/{org_id}/clients/{client_id}',
     'DELETE /auth/orgs/{org_id}/clients/{client_id}',
     'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'POST /auth/orgs/{org_id}/domain',
@@ -57,12 +58,13 @@ Three steps: set → publish the ownership TXT → verify → publish the A reco
 Flow: 'set' returns a TXT record to prove ownership; create it, then 'verify'.
 Once verified, create the printed A record; TLS provisions automatically (~30 min)
 and the domain becomes your issuer when active.`,
-    'client': `myapi auth client <list|create|delete|rotate> [--org <id>] [--json]
+    'client': `myapi auth client <list|create|update|delete|rotate> [--org <id>] [--json]
 
 OIDC clients are the apps that authenticate against your tenant.
 
   myapi auth client list
   myapi auth client create --name "My App" --type spa --redirect https://app.example.com/callback
+  myapi auth client update <client_id> --redirect https://app.example.com/callback
   myapi auth client delete <client_id> [--yes]
   myapi auth client rotate <client_id>
 
@@ -71,6 +73,9 @@ OIDC clients are the apps that authenticate against your tenant.
   --redirect <urls>   Allowed redirect URIs, comma-separated (required for create).
                       Absolute https (or http://localhost for dev).
 
+update  Change the redirect URIs or the name. Keeps the same client_id and
+        secret, so nothing deployed has to be reconfigured. --redirect REPLACES
+        the list: pass every URI you want, comma-separated.
 delete  Revoke a client (irreversible; stops authenticating immediately).
 rotate  Re-issue a 'web' client's secret (shown once; old secret stops working).`,
 };
@@ -86,7 +91,7 @@ which via \`tenant create --connections\`. (Operator/account commands moved to
 \`myapi account\`.)
 
 Subcommands:
-  client   Register, list, delete, and rotate OIDC clients (your apps)
+  client   Register, list, update, delete, and rotate OIDC clients (your apps)
   domain   Serve auth on your own domain (auth.acme.com)
   tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)
   usage    Monthly active users (MAU) for the current period`;
@@ -287,10 +292,50 @@ async function domain(args, flags) {
     }
     error(`Unknown action "${action}". Use: myapi auth domain [show|set|verify|delete]`);
 }
+/* Redirect URIs, as the CLI accepts them: comma-separated, trimmed, empties
+ * dropped. A trailing comma is a typo, not a request for a blank URI — passing
+ * one through would earn an INVALID_REDIRECT_URI for something the customer did
+ * not mean to send.
+ *
+ * Shared by create and update rather than written twice: they must agree, and
+ * the second copy is the one that drifts. */
+export function _parseRedirects(raw) {
+    return raw.split(',').map(s => s.trim()).filter(Boolean);
+}
+/* _updateInput builds the PATCH body, or returns the refusal.
+ *
+ * Sending neither field is refused rather than treated as a no-op: a PATCH that
+ * changes nothing and answers 200 reads as a change that was applied, and the
+ * customer finds out at the next sign-in.
+ *
+ * Returns { error } or { input } so the decision is testable without running
+ * the command, which is how the rest of this CLI is tested. */
+export function _updateInput(clientId, redirect, name) {
+    if (!redirect && !name) {
+        return {
+            error: 'Nothing to change. Pass --redirect, --name, or both:\n' +
+                `  myapi auth client update ${clientId} --redirect https://app.example.com/callback`,
+        };
+    }
+    const input = {};
+    if (redirect) {
+        const uris = _parseRedirects(redirect);
+        if (uris.length === 0) {
+            return {
+                error: '--redirect had no URI in it. It REPLACES the list, so an empty ' +
+                    'one would leave a client that can never complete a sign-in.',
+            };
+        }
+        input.redirect_uris = uris;
+    }
+    if (name)
+        input.name = name;
+    return { input };
+}
 async function client(args, flags) {
     const action = args[0] || 'list';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|delete|rotate> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|update|delete|rotate> [--org <id>]');
     if (action === 'list') {
         const res = await sdkAuth.listClients(config.api_key, orgId);
         if (flags.json) {
@@ -318,7 +363,7 @@ async function client(args, flags) {
             error("--type must be 'spa' (public) or 'web' (confidential)");
         if (!redirect)
             error('--redirect is required (comma-separate multiple URIs)');
-        const redirect_uris = redirect.split(',').map(s => s.trim()).filter(Boolean);
+        const redirect_uris = _parseRedirects(redirect);
         const c = await sdkAuth.createClient(config.api_key, orgId, { name, type: type, redirect_uris });
         if (flags.json) {
             printJson(c);
@@ -361,6 +406,30 @@ async function client(args, flags) {
         success(`Client deleted: ${clientId}`);
         return;
     }
+    if (action === 'update') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client update <client_id> [--redirect <uri,uri>] [--name <name>]');
+        // --redirect REPLACES the list, and the CLI says so in the help and again
+        // in the success line: a customer adding a second callback URL naturally
+        // reads this as "add", and that failure is silent — the first URI stops
+        // working and the sign-in that used it breaks at the next deploy, not here.
+        const built = _updateInput(clientId, flags.redirect || '', flags.name || '');
+        if ('error' in built)
+            error(built.error);
+        const input = built.input;
+        const c = await sdkAuth.updateClient(config.api_key, orgId, clientId, input);
+        if (flags.json) {
+            printJson(c);
+            return;
+        }
+        success(`Client updated: ${c.client_id || clientId}`);
+        if (c.name)
+            info(`Name:      ${c.name}`);
+        info(`Redirects: ${(c.redirect_uris || []).join(', ')}`);
+        info('The client_id and secret are unchanged — nothing deployed needs reconfiguring.');
+        return;
+    }
     if (action === 'rotate') {
         const clientId = args[1];
         if (!clientId)
@@ -379,5 +448,5 @@ async function client(args, flags) {
         }
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth client <list|create|delete|rotate>`);
+    error(`Unknown action "${action}". Use: myapi auth client <list|create|update|delete|rotate>`);
 }

package/dist/commands/container.js

@@ -11,6 +11,7 @@ export const EXPOSES = [
     'GET /container/orgs/{org_id}/containers',
     'GET /container/orgs/{org_id}/containers/{id}',
     'DELETE /container/orgs/{org_id}/containers/{id}',
+    'PATCH /container/orgs/{org_id}/containers/{id}',
     'POST /container/orgs/{org_id}/containers/{id}/deploy',
     'GET /container/orgs/{org_id}/containers/{id}/logs',
     'GET /container/orgs/{org_id}/containers/{id}/revisions',
@@ -28,6 +29,7 @@ export const SCHEMA = {
     'max-instances': 'number',
     port: 'number',
     env: 'string',
+    unset: 'string',
     tail: 'number',
     scope: 'string',
     'no-promote': 'boolean',
@@ -73,7 +75,10 @@ function summarizeContainer(c) {
         name: c.name,
         type: c.type,
         status: c.status,
-        url: c.url || '(not deployed)',
+        // A job has no URL — it runs when triggered. '(not deployed)' in that
+        // column read as a broken deploy for a job that was working, which is the
+        // column reporting a fault where there is none.
+        url: c.url || (c.type === 'job' ? '— (job: runs on trigger)' : '(not deployed)'),
         updated_at: c.updated_at ? formatDate(c.updated_at) : '',
     };
 }
@@ -587,6 +592,18 @@ Examples:
   myapi container create --name api --port 8080
   myapi container create --name nightly --type job --cron "0 3 * * *"
   myapi container create --name queue-worker --type worker --memory 1Gi`,
+    'env': `myapi container env <id> --env KEY=VALUE[,K2=V2] [--unset KEY3[,KEY4]] [--org <id>] [--json]
+
+Change environment variables on a container that already exists, and roll a new
+revision on the SAME image so they take effect. No rebuild, and the container
+keeps its URL, its scoped key and its custom domain.
+
+This is a MERGE. Variables you do not name keep their values, so adding one
+entry to an allowlist does not mean resending every secret. --unset removes.
+
+Examples:
+  myapi container env c-123 --env ALLOWED=a@x.com,b@y.com
+  myapi container env c-123 --env LOG_LEVEL=debug --unset LEGACY_FLAG`,
     'deploy': `myapi container deploy <id> <image-ref> [--org <id>] [--json]
        myapi container deploy <id> --source <dir|tar.gz> [--org <id>] [--json]
 
@@ -673,6 +690,7 @@ Subcommands:
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
                        (--smoke to verify before promoting; --no-promote to hold it back)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
+  env <id>             Change environment variables (merge; rolls a new revision)
   get <id>             Inspect a container
   list                 List containers in your org
   logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
@@ -691,8 +709,59 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
             info(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for the list.`);
         return;
     }
+    /**
+     * `myapi container env <id> --env K=V[,K2=V2] [--unset K3[,K4]]`
+     *
+     * Until 2026-08-19 the only way to change a variable was to delete the
+     * container and create another, losing the URL, the scoped key and the custom
+     * domain. The skill said to do exactly that, and a customer went through three
+     * generations of one container in a week because of it.
+     */
+    async function envCmd(id, flags) {
+        const config = requireConfig();
+        const orgId = requireOrg(flags, config, 'myapi container env <id> --env K=V [--unset K2]');
+        if (!id)
+            error('Missing id.\nUsage: myapi container env <id> --env KEY=VALUE[,K2=V2] [--unset KEY3[,KEY4]]');
+        const env = {};
+        if (typeof flags.env === 'string') {
+            const parsed = _parseEnv(flags.env);
+            if (typeof parsed === 'string')
+                error(parsed);
+            Object.assign(env, parsed);
+        }
+        if (typeof flags.unset === 'string') {
+            for (const k of flags.unset.split(',').map(s => s.trim()).filter(Boolean))
+                env[k] = null;
+        }
+        if (Object.keys(env).length === 0) {
+            error('Nothing to change. Pass --env KEY=VALUE to set one, or --unset KEY to remove one.\n' +
+                'This is a merge: variables you do not name keep their values.');
+        }
+        info('› Updating environment…');
+        const res = await sdkContainer.updateContainerEnv(config.api_key, orgId, id, env);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        if (res.set?.length)
+            info(`  set:     ${res.set.join(', ')}`);
+        if (res.removed?.length)
+            info(`  removed: ${res.removed.join(', ')}`);
+        // Say plainly whether the running container has the new values, because
+        // "stored" and "live" are different states and only one of them is what the
+        // caller asked for.
+        if (res.applied) {
+            success(`Redeployed on the same image — the new values are live${res.revision ? ` (${res.revision})` : ''}.`);
+        }
+        else {
+            info('  Stored. This container has no deployment yet, so the values apply on your first deploy.');
+        }
+        if (res.env)
+            info(`  ${Object.keys(res.env).length} variable(s) now set: ${Object.keys(res.env).sort().join(', ')}`);
+    }
     switch (subcommand) {
         case 'create': return create(args[0], flags);
+        case 'env': return envCmd(args[0], flags);
         case 'build-logs': return buildLogs(args[0], flags);
         case 'deploy': return deploy(args[0], args[1], flags);
         case 'list': return list(flags);

package/dist/sdk-container.test.js

@@ -144,12 +144,16 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 11 container endpoints', () => {
+    it('covers the 12 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers/{id}',
             'DELETE /container/orgs/{org_id}/containers/{id}',
+            // Added 2026-08-19. Env is the one create-time setting that is NOT
+            // immutable: PATCH merges the map and rolls a revision on the same
+            // image, so the container keeps its URL, scoped key and custom domain.
+            'PATCH /container/orgs/{org_id}/containers/{id}',
             'POST /container/orgs/{org_id}/containers/{id}/deploy',
             // Added 2026-07-28. Promote and rollback are ONE endpoint: naming a
             // revision promotes it, omitting one rolls back to the previous ready

package/dist/skills/my-auth-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-auth-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-07690e940717e8f65c195f9fbecdc1def9372edfd52dea19f6570227008d28ad
+checksum: sha256-e6bf7db60560fa6702d7864aaf515a524d3f79cf3eaafe265790005673e3ae29
 ---
 
 # MyAuthAPI
@@ -38,6 +38,11 @@ its clients.
   client (no secret; for browser/SPA/mobile). `type web` is confidential and
   returns a `client_secret` **once** — store it immediately. `--redirect` lists
   allowed callback URIs (absolute https, or http://localhost for dev).
+  `auth client update <id> --redirect <uri,uri>` changes them later, keeping the
+  same `client_id` and secret. Do NOT delete and recreate to add a callback
+  URL — that mints a new `client_id`, so every deployed copy of the app has to
+  be reconfigured and the cutover has to accept two audiences at once.
+  `--redirect` REPLACES the list: pass every URI you want, not just the new one.
 - **Usage** — `auth usage` shows monthly active users (auth is billed per MAU).
 - **Custom domain** — serve auth on `auth.acme.com`. Three steps: `auth domain
   set --domain auth.acme.com` prints a **TXT ownership challenge**; publish it,
@@ -62,6 +67,7 @@ CLI is only the management surface.
 | `myapi auth tenant create` | Create/enable the tenant (`--connections google,password,magic`; `--theme <json>`) |
 | `myapi auth client list` | List the OIDC clients (apps) registered to your tenant |
 | `myapi auth client create` | Register an OIDC client (`--name`, `--type spa\|web`, `--redirect`) |
+| `myapi auth client update <id>` | Change redirect URIs (`--redirect`, replaces the list) or `--name`; same client_id and secret |
 | `myapi auth client delete <id>` | Revoke a client (irreversible); `--yes` to skip the confirm |
 | `myapi auth client rotate <id>` | Re-issue a `web` client's secret (shown once) |
 | `myapi auth usage` | Monthly active users (MAU) for the current period (`as_of` shows freshness) |

package/dist/skills/my-container-api/SKILL.md

@@ -1,21 +1,21 @@
 ---
 name: my-container-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-a5aabfe95b85f1e6ceb2b9254441183d540e81f888cefbdcf302385b95db2fd0
+checksum: sha256-0a83428114cbc7065d1a4db4f8a0cf39ff965c51acac78f5eeff159345a08da2
 ---
 
 # MyContainerAPI
 
-A container runs a pre-built image on managed cloud infrastructure. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on background process), or a **job** (runs to completion — the only type that takes a cron schedule). Containers are the heavier-duty sibling of edge functions (`myapi fn`) — use them for native dependencies, long execution, or a full dynamic app.
+A container runs a pre-built image on managed cloud infrastructure. Three types: a **service** (HTTP server, scales to zero), a **worker** (always-on background process), or a **job** (runs to completion — the only type that takes a cron schedule).
 
 ## Capabilities
 <!-- llm:start -->
 The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 
-- `create` registers the container and issues a **scoped API key**, returned once. The running container receives it as the `MYAPI_KEY` env var, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
+- `create` registers the container and issues a **scoped API key**, returned once. The container gets it as `MYAPI_KEY`, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
 - `deploy` takes **either** a pre-built image reference **or** a source
   directory. `--source ./dir` tars the directory, builds it server-side
   (typically ~4 minutes) and deploys the result — **no Docker on your machine,
@@ -53,12 +53,12 @@ it, so the probe would never reach your container.
 
 ### Custom domains (dynamic apps)
 
-`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, served over HTTPS automatically. This is the path for a dynamic backend on a real domain — distinct from `my-funnel-api`, which serves static sites.
+`myapi container domain <id> <domain>` binds a custom domain to a **deployed** container, over HTTPS automatically. The path for a dynamic backend on a real domain — unlike `my-funnel-api`, which serves static sites.
 
 Get it right:
 
 - **Deploy first.** Binding a domain to a container that has never deployed fails (422) — there is nothing running to route to.
-- **Register the parent domain first.** The domain's MyAPI-managed parent must already be registered via `my-domain-api`. Binding `app.synthesisdaily.com` requires `synthesisdaily.com` registered in MyAPI; otherwise 422.
+- **Register the parent domain first** via `my-domain-api`. Binding `app.synthesisdaily.com` requires `synthesisdaily.com` registered in MyAPI; otherwise 422.
 - **One domain per container.** Re-binding, or binding a hostname already taken, fails (409).
 - `--remove` unbinds. `myapi container get <id>` shows the bound `custom_domain`.
 <!-- llm:end -->
@@ -127,8 +127,13 @@ way that looks like an application bug.
 - **Any 5xx from your code is replaced by an edge HTML error page.** A JSON
   error envelope will not reach the caller. Return a 4xx if the reason has to
   survive.
-- **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
-  `create` and cannot be changed by `deploy`.** Recreate to change them.
+- **`--cpu`, `--memory`, `--max-instances` and `--cron` are set at `create` and
+  cannot be changed by `deploy`.** Recreate to change those.
+- **`--env` CAN be changed after create**, with `container env` — a merge
+  (`--unset` removes) that rolls a new revision on the same image, keeping the
+  URL, the scoped key and the custom domain. Do NOT recreate to edit a variable:
+  this page said to for months, and it cost one customer three generations of
+  the same container in a week.
 
 ### Keeping a service warm
 
@@ -167,4 +172,4 @@ reply  { "success": true, "data": …, "error": null, "meta": {…} }
 
 Run `myapi container --help` for the full flag reference.
 
-**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container. Every constraint it hits is in **Runtime constraints** above.
+**End-to-end example:** `examples/authenticated-app/` in github.com/myapihq/myapi walks the full seam — hosted login → token verification → per-user KV record → deployed container.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.16.4",
+  "version": "2.18.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "prebuild": "node scripts/copy-skills.js",
-    "build": "tsc && rm -rf dist/skills && cp -r src/skills dist/skills",
+    "build": "rm -rf dist && tsc && cp -r src/skills dist/skills",
     "dev": "tsc --watch",
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.16.4"
+    "@myapihq/sdk": "^2.18.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",