@myapihq/cli 2.17.0 → 2.18.0

package/dist/commands/auth-client-update.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/auth-client-update.test.js

@@ -0,0 +1,52 @@
+// Unit tests for the `auth client update` helpers.
+//
+// The subcommand exists because its absence cost a customer a container
+// generation: the PATCH route shipped on 19.08.2026 and the CLI still offered
+// only list|create|delete|rotate, so changing a redirect URI meant delete and
+// recreate — a new client_id, every deployed copy reconfigured, and two
+// audiences accepted through the cutover.
+//
+// Two things here would be silent if they broke: a --redirect that quietly
+// means "replace" while the customer reads "add", and a PATCH with nothing in
+// it answering 200.
+import { describe, it, expect } from 'vitest';
+import { _parseRedirects, _updateInput } from './authproduct.js';
+describe('_parseRedirects', () => {
+    it('takes every URI, comma-separated and trimmed', () => {
+        expect(_parseRedirects(' https://a.example.com/cb , https://b.example.com/cb '))
+            .toEqual(['https://a.example.com/cb', 'https://b.example.com/cb']);
+    });
+    it('drops a trailing comma rather than sending a blank URI', () => {
+        // The backend refuses an empty entry with INVALID_REDIRECT_URI, so passing
+        // one on turns a typo into a rejection the customer cannot read.
+        expect(_parseRedirects('https://a.example.com/cb,')).toEqual(['https://a.example.com/cb']);
+    });
+    it('is the same parser create uses', async () => {
+        // create and update must agree on what a redirect list is. They had two
+        // copies of this line; the second copy is the one that drifts.
+        const src = await import('node:fs').then(fs => fs.readFileSync(new URL('./authproduct.ts', import.meta.url), 'utf8'));
+        const splits = src.match(/redirect\.split\(/g) || [];
+        expect(splits.length, 'a second inline redirect parser has appeared').toBe(0);
+    });
+});
+describe('_updateInput', () => {
+    it('refuses a PATCH that would change nothing', () => {
+        const got = _updateInput('cli_123', '', '');
+        expect(got).toHaveProperty('error');
+        // The refusal names the next command, which is the house rule for refusals.
+        expect(got.error).toContain('myapi auth client update cli_123');
+    });
+    it('refuses a --redirect that parses to nothing', () => {
+        // ` , ` is not "keep what is there" — it replaces the list with an empty
+        // one, leaving a client that can never complete a sign-in.
+        expect(_updateInput('cli_123', ' , ', '')).toHaveProperty('error');
+    });
+    it('sends only the fields that were given', () => {
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', ''))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'] } });
+        expect(_updateInput('cli_123', '', 'Renamed'))
+            .toEqual({ input: { name: 'Renamed' } });
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', 'Both'))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'], name: 'Both' } });
+    });
+});

package/dist/commands/authproduct.d.ts

@@ -1,8 +1,15 @@
+import { auth as sdkAuth } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
-export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
+export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, update, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
+export declare function _parseRedirects(raw: string): string[];
+export declare function _updateInput(clientId: string, redirect: string, name: string): {
+    error: string;
+} | {
+    input: sdkAuth.UpdateClientInput;
+};

package/dist/commands/authproduct.js

@@ -22,6 +22,7 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/usage',
+    'PATCH /auth/orgs/{org_id}/clients/{client_id}',
     'DELETE /auth/orgs/{org_id}/clients/{client_id}',
     'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'POST /auth/orgs/{org_id}/domain',
@@ -57,12 +58,13 @@ Three steps: set → publish the ownership TXT → verify → publish the A reco
 Flow: 'set' returns a TXT record to prove ownership; create it, then 'verify'.
 Once verified, create the printed A record; TLS provisions automatically (~30 min)
 and the domain becomes your issuer when active.`,
-    'client': `myapi auth client <list|create|delete|rotate> [--org <id>] [--json]
+    'client': `myapi auth client <list|create|update|delete|rotate> [--org <id>] [--json]
 
 OIDC clients are the apps that authenticate against your tenant.
 
   myapi auth client list
   myapi auth client create --name "My App" --type spa --redirect https://app.example.com/callback
+  myapi auth client update <client_id> --redirect https://app.example.com/callback
   myapi auth client delete <client_id> [--yes]
   myapi auth client rotate <client_id>
 
@@ -71,6 +73,9 @@ OIDC clients are the apps that authenticate against your tenant.
   --redirect <urls>   Allowed redirect URIs, comma-separated (required for create).
                       Absolute https (or http://localhost for dev).
 
+update  Change the redirect URIs or the name. Keeps the same client_id and
+        secret, so nothing deployed has to be reconfigured. --redirect REPLACES
+        the list: pass every URI you want, comma-separated.
 delete  Revoke a client (irreversible; stops authenticating immediately).
 rotate  Re-issue a 'web' client's secret (shown once; old secret stops working).`,
 };
@@ -86,7 +91,7 @@ which via \`tenant create --connections\`. (Operator/account commands moved to
 \`myapi account\`.)
 
 Subcommands:
-  client   Register, list, delete, and rotate OIDC clients (your apps)
+  client   Register, list, update, delete, and rotate OIDC clients (your apps)
   domain   Serve auth on your own domain (auth.acme.com)
   tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)
   usage    Monthly active users (MAU) for the current period`;
@@ -287,10 +292,50 @@ async function domain(args, flags) {
     }
     error(`Unknown action "${action}". Use: myapi auth domain [show|set|verify|delete]`);
 }
+/* Redirect URIs, as the CLI accepts them: comma-separated, trimmed, empties
+ * dropped. A trailing comma is a typo, not a request for a blank URI — passing
+ * one through would earn an INVALID_REDIRECT_URI for something the customer did
+ * not mean to send.
+ *
+ * Shared by create and update rather than written twice: they must agree, and
+ * the second copy is the one that drifts. */
+export function _parseRedirects(raw) {
+    return raw.split(',').map(s => s.trim()).filter(Boolean);
+}
+/* _updateInput builds the PATCH body, or returns the refusal.
+ *
+ * Sending neither field is refused rather than treated as a no-op: a PATCH that
+ * changes nothing and answers 200 reads as a change that was applied, and the
+ * customer finds out at the next sign-in.
+ *
+ * Returns { error } or { input } so the decision is testable without running
+ * the command, which is how the rest of this CLI is tested. */
+export function _updateInput(clientId, redirect, name) {
+    if (!redirect && !name) {
+        return {
+            error: 'Nothing to change. Pass --redirect, --name, or both:\n' +
+                `  myapi auth client update ${clientId} --redirect https://app.example.com/callback`,
+        };
+    }
+    const input = {};
+    if (redirect) {
+        const uris = _parseRedirects(redirect);
+        if (uris.length === 0) {
+            return {
+                error: '--redirect had no URI in it. It REPLACES the list, so an empty ' +
+                    'one would leave a client that can never complete a sign-in.',
+            };
+        }
+        input.redirect_uris = uris;
+    }
+    if (name)
+        input.name = name;
+    return { input };
+}
 async function client(args, flags) {
     const action = args[0] || 'list';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|delete|rotate> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|update|delete|rotate> [--org <id>]');
     if (action === 'list') {
         const res = await sdkAuth.listClients(config.api_key, orgId);
         if (flags.json) {
@@ -318,7 +363,7 @@ async function client(args, flags) {
             error("--type must be 'spa' (public) or 'web' (confidential)");
         if (!redirect)
             error('--redirect is required (comma-separate multiple URIs)');
-        const redirect_uris = redirect.split(',').map(s => s.trim()).filter(Boolean);
+        const redirect_uris = _parseRedirects(redirect);
         const c = await sdkAuth.createClient(config.api_key, orgId, { name, type: type, redirect_uris });
         if (flags.json) {
             printJson(c);
@@ -361,6 +406,30 @@ async function client(args, flags) {
         success(`Client deleted: ${clientId}`);
         return;
     }
+    if (action === 'update') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client update <client_id> [--redirect <uri,uri>] [--name <name>]');
+        // --redirect REPLACES the list, and the CLI says so in the help and again
+        // in the success line: a customer adding a second callback URL naturally
+        // reads this as "add", and that failure is silent — the first URI stops
+        // working and the sign-in that used it breaks at the next deploy, not here.
+        const built = _updateInput(clientId, flags.redirect || '', flags.name || '');
+        if ('error' in built)
+            error(built.error);
+        const input = built.input;
+        const c = await sdkAuth.updateClient(config.api_key, orgId, clientId, input);
+        if (flags.json) {
+            printJson(c);
+            return;
+        }
+        success(`Client updated: ${c.client_id || clientId}`);
+        if (c.name)
+            info(`Name:      ${c.name}`);
+        info(`Redirects: ${(c.redirect_uris || []).join(', ')}`);
+        info('The client_id and secret are unchanged — nothing deployed needs reconfiguring.');
+        return;
+    }
     if (action === 'rotate') {
         const clientId = args[1];
         if (!clientId)
@@ -379,5 +448,5 @@ async function client(args, flags) {
         }
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth client <list|create|delete|rotate>`);
+    error(`Unknown action "${action}". Use: myapi auth client <list|create|update|delete|rotate>`);
 }

package/dist/commands/container.js

@@ -75,7 +75,10 @@ function summarizeContainer(c) {
         name: c.name,
         type: c.type,
         status: c.status,
-        url: c.url || '(not deployed)',
+        // A job has no URL — it runs when triggered. '(not deployed)' in that
+        // column read as a broken deploy for a job that was working, which is the
+        // column reporting a fault where there is none.
+        url: c.url || (c.type === 'job' ? '— (job: runs on trigger)' : '(not deployed)'),
         updated_at: c.updated_at ? formatDate(c.updated_at) : '',
     };
 }

package/dist/skills/my-auth-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-auth-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-07690e940717e8f65c195f9fbecdc1def9372edfd52dea19f6570227008d28ad
+checksum: sha256-e6bf7db60560fa6702d7864aaf515a524d3f79cf3eaafe265790005673e3ae29
 ---
 
 # MyAuthAPI
@@ -38,6 +38,11 @@ its clients.
   client (no secret; for browser/SPA/mobile). `type web` is confidential and
   returns a `client_secret` **once** — store it immediately. `--redirect` lists
   allowed callback URIs (absolute https, or http://localhost for dev).
+  `auth client update <id> --redirect <uri,uri>` changes them later, keeping the
+  same `client_id` and secret. Do NOT delete and recreate to add a callback
+  URL — that mints a new `client_id`, so every deployed copy of the app has to
+  be reconfigured and the cutover has to accept two audiences at once.
+  `--redirect` REPLACES the list: pass every URI you want, not just the new one.
 - **Usage** — `auth usage` shows monthly active users (auth is billed per MAU).
 - **Custom domain** — serve auth on `auth.acme.com`. Three steps: `auth domain
   set --domain auth.acme.com` prints a **TXT ownership challenge**; publish it,
@@ -62,6 +67,7 @@ CLI is only the management surface.
 | `myapi auth tenant create` | Create/enable the tenant (`--connections google,password,magic`; `--theme <json>`) |
 | `myapi auth client list` | List the OIDC clients (apps) registered to your tenant |
 | `myapi auth client create` | Register an OIDC client (`--name`, `--type spa\|web`, `--redirect`) |
+| `myapi auth client update <id>` | Change redirect URIs (`--redirect`, replaces the list) or `--name`; same client_id and secret |
 | `myapi auth client delete <id>` | Revoke a client (irreversible); `--yes` to skip the confirm |
 | `myapi auth client rotate <id>` | Re-issue a `web` client's secret (shown once) |
 | `myapi auth usage` | Monthly active users (MAU) for the current period (`as_of` shows freshness) |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "prebuild": "node scripts/copy-skills.js",
-    "build": "tsc && rm -rf dist/skills && cp -r src/skills dist/skills",
+    "build": "rm -rf dist && tsc && cp -r src/skills dist/skills",
     "dev": "tsc --watch",
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.17.0"
+    "@myapihq/sdk": "^2.18.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",