@myapihq/cli 2.17.0 → 2.19.0

package/dist/commands/auth-client-update.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/auth-client-update.test.js

@@ -0,0 +1,52 @@
+// Unit tests for the `auth client update` helpers.
+//
+// The subcommand exists because its absence cost a customer a container
+// generation: the PATCH route shipped on 19.08.2026 and the CLI still offered
+// only list|create|delete|rotate, so changing a redirect URI meant delete and
+// recreate — a new client_id, every deployed copy reconfigured, and two
+// audiences accepted through the cutover.
+//
+// Two things here would be silent if they broke: a --redirect that quietly
+// means "replace" while the customer reads "add", and a PATCH with nothing in
+// it answering 200.
+import { describe, it, expect } from 'vitest';
+import { _parseRedirects, _updateInput } from './authproduct.js';
+describe('_parseRedirects', () => {
+    it('takes every URI, comma-separated and trimmed', () => {
+        expect(_parseRedirects(' https://a.example.com/cb , https://b.example.com/cb '))
+            .toEqual(['https://a.example.com/cb', 'https://b.example.com/cb']);
+    });
+    it('drops a trailing comma rather than sending a blank URI', () => {
+        // The backend refuses an empty entry with INVALID_REDIRECT_URI, so passing
+        // one on turns a typo into a rejection the customer cannot read.
+        expect(_parseRedirects('https://a.example.com/cb,')).toEqual(['https://a.example.com/cb']);
+    });
+    it('is the same parser create uses', async () => {
+        // create and update must agree on what a redirect list is. They had two
+        // copies of this line; the second copy is the one that drifts.
+        const src = await import('node:fs').then(fs => fs.readFileSync(new URL('./authproduct.ts', import.meta.url), 'utf8'));
+        const splits = src.match(/redirect\.split\(/g) || [];
+        expect(splits.length, 'a second inline redirect parser has appeared').toBe(0);
+    });
+});
+describe('_updateInput', () => {
+    it('refuses a PATCH that would change nothing', () => {
+        const got = _updateInput('cli_123', '', '');
+        expect(got).toHaveProperty('error');
+        // The refusal names the next command, which is the house rule for refusals.
+        expect(got.error).toContain('myapi auth client update cli_123');
+    });
+    it('refuses a --redirect that parses to nothing', () => {
+        // ` , ` is not "keep what is there" — it replaces the list with an empty
+        // one, leaving a client that can never complete a sign-in.
+        expect(_updateInput('cli_123', ' , ', '')).toHaveProperty('error');
+    });
+    it('sends only the fields that were given', () => {
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', ''))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'] } });
+        expect(_updateInput('cli_123', '', 'Renamed'))
+            .toEqual({ input: { name: 'Renamed' } });
+        expect(_updateInput('cli_123', 'https://a.example.com/cb', 'Both'))
+            .toEqual({ input: { redirect_uris: ['https://a.example.com/cb'], name: 'Both' } });
+    });
+});

package/dist/commands/authproduct.d.ts

@@ -1,8 +1,15 @@
+import { auth as sdkAuth } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
-export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
+export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, update, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
+export declare function _parseRedirects(raw: string): string[];
+export declare function _updateInput(clientId: string, redirect: string, name: string): {
+    error: string;
+} | {
+    input: sdkAuth.UpdateClientInput;
+};

package/dist/commands/authproduct.js

@@ -22,6 +22,7 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/usage',
+    'PATCH /auth/orgs/{org_id}/clients/{client_id}',
     'DELETE /auth/orgs/{org_id}/clients/{client_id}',
     'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'POST /auth/orgs/{org_id}/domain',
@@ -57,12 +58,13 @@ Three steps: set → publish the ownership TXT → verify → publish the A reco
 Flow: 'set' returns a TXT record to prove ownership; create it, then 'verify'.
 Once verified, create the printed A record; TLS provisions automatically (~30 min)
 and the domain becomes your issuer when active.`,
-    'client': `myapi auth client <list|create|delete|rotate> [--org <id>] [--json]
+    'client': `myapi auth client <list|create|update|delete|rotate> [--org <id>] [--json]
 
 OIDC clients are the apps that authenticate against your tenant.
 
   myapi auth client list
   myapi auth client create --name "My App" --type spa --redirect https://app.example.com/callback
+  myapi auth client update <client_id> --redirect https://app.example.com/callback
   myapi auth client delete <client_id> [--yes]
   myapi auth client rotate <client_id>
 
@@ -71,6 +73,9 @@ OIDC clients are the apps that authenticate against your tenant.
   --redirect <urls>   Allowed redirect URIs, comma-separated (required for create).
                       Absolute https (or http://localhost for dev).
 
+update  Change the redirect URIs or the name. Keeps the same client_id and
+        secret, so nothing deployed has to be reconfigured. --redirect REPLACES
+        the list: pass every URI you want, comma-separated.
 delete  Revoke a client (irreversible; stops authenticating immediately).
 rotate  Re-issue a 'web' client's secret (shown once; old secret stops working).`,
 };
@@ -86,7 +91,7 @@ which via \`tenant create --connections\`. (Operator/account commands moved to
 \`myapi account\`.)
 
 Subcommands:
-  client   Register, list, delete, and rotate OIDC clients (your apps)
+  client   Register, list, update, delete, and rotate OIDC clients (your apps)
   domain   Serve auth on your own domain (auth.acme.com)
   tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)
   usage    Monthly active users (MAU) for the current period`;
@@ -287,10 +292,50 @@ async function domain(args, flags) {
     }
     error(`Unknown action "${action}". Use: myapi auth domain [show|set|verify|delete]`);
 }
+/* Redirect URIs, as the CLI accepts them: comma-separated, trimmed, empties
+ * dropped. A trailing comma is a typo, not a request for a blank URI — passing
+ * one through would earn an INVALID_REDIRECT_URI for something the customer did
+ * not mean to send.
+ *
+ * Shared by create and update rather than written twice: they must agree, and
+ * the second copy is the one that drifts. */
+export function _parseRedirects(raw) {
+    return raw.split(',').map(s => s.trim()).filter(Boolean);
+}
+/* _updateInput builds the PATCH body, or returns the refusal.
+ *
+ * Sending neither field is refused rather than treated as a no-op: a PATCH that
+ * changes nothing and answers 200 reads as a change that was applied, and the
+ * customer finds out at the next sign-in.
+ *
+ * Returns { error } or { input } so the decision is testable without running
+ * the command, which is how the rest of this CLI is tested. */
+export function _updateInput(clientId, redirect, name) {
+    if (!redirect && !name) {
+        return {
+            error: 'Nothing to change. Pass --redirect, --name, or both:\n' +
+                `  myapi auth client update ${clientId} --redirect https://app.example.com/callback`,
+        };
+    }
+    const input = {};
+    if (redirect) {
+        const uris = _parseRedirects(redirect);
+        if (uris.length === 0) {
+            return {
+                error: '--redirect had no URI in it. It REPLACES the list, so an empty ' +
+                    'one would leave a client that can never complete a sign-in.',
+            };
+        }
+        input.redirect_uris = uris;
+    }
+    if (name)
+        input.name = name;
+    return { input };
+}
 async function client(args, flags) {
     const action = args[0] || 'list';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|delete|rotate> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|update|delete|rotate> [--org <id>]');
     if (action === 'list') {
         const res = await sdkAuth.listClients(config.api_key, orgId);
         if (flags.json) {
@@ -318,7 +363,7 @@ async function client(args, flags) {
             error("--type must be 'spa' (public) or 'web' (confidential)");
         if (!redirect)
             error('--redirect is required (comma-separate multiple URIs)');
-        const redirect_uris = redirect.split(',').map(s => s.trim()).filter(Boolean);
+        const redirect_uris = _parseRedirects(redirect);
         const c = await sdkAuth.createClient(config.api_key, orgId, { name, type: type, redirect_uris });
         if (flags.json) {
             printJson(c);
@@ -361,6 +406,30 @@ async function client(args, flags) {
         success(`Client deleted: ${clientId}`);
         return;
     }
+    if (action === 'update') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client update <client_id> [--redirect <uri,uri>] [--name <name>]');
+        // --redirect REPLACES the list, and the CLI says so in the help and again
+        // in the success line: a customer adding a second callback URL naturally
+        // reads this as "add", and that failure is silent — the first URI stops
+        // working and the sign-in that used it breaks at the next deploy, not here.
+        const built = _updateInput(clientId, flags.redirect || '', flags.name || '');
+        if ('error' in built)
+            error(built.error);
+        const input = built.input;
+        const c = await sdkAuth.updateClient(config.api_key, orgId, clientId, input);
+        if (flags.json) {
+            printJson(c);
+            return;
+        }
+        success(`Client updated: ${c.client_id || clientId}`);
+        if (c.name)
+            info(`Name:      ${c.name}`);
+        info(`Redirects: ${(c.redirect_uris || []).join(', ')}`);
+        info('The client_id and secret are unchanged — nothing deployed needs reconfiguring.');
+        return;
+    }
     if (action === 'rotate') {
         const clientId = args[1];
         if (!clientId)
@@ -379,5 +448,5 @@ async function client(args, flags) {
         }
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth client <list|create|delete|rotate>`);
+    error(`Unknown action "${action}". Use: myapi auth client <list|create|update|delete|rotate>`);
 }

package/dist/commands/container.js

@@ -75,7 +75,10 @@ function summarizeContainer(c) {
         name: c.name,
         type: c.type,
         status: c.status,
-        url: c.url || '(not deployed)',
+        // A job has no URL — it runs when triggered. '(not deployed)' in that
+        // column read as a broken deploy for a job that was working, which is the
+        // column reporting a fault where there is none.
+        url: c.url || (c.type === 'job' ? '— (job: runs on trigger)' : '(not deployed)'),
         updated_at: c.updated_at ? formatDate(c.updated_at) : '',
     };
 }

package/dist/commands/feedback-capture.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/feedback-capture.test.js

@@ -0,0 +1,49 @@
+// Capture flags send only what the operator named.
+//
+// The rule this file defends: an absent `capture` sub-field means "leave it
+// alone", never "off". ImmoPilot's screens carry tenant names, IBANs and dates
+// of birth; the widget photographs the viewport and reads the text of whatever
+// the reporter points at. If `--no-screenshot` also sent `text: true` because
+// the CLI helpfully filled in the object, it would turn one deliberate
+// restriction into a different, undeclared permission — on exactly those pages.
+//
+// Both fields default to true server-side, so this is also what keeps every
+// widget embedded before capture existed behaving as it always did.
+import { describe, it, expect } from 'vitest';
+import { _captureFrom } from './feedback.js';
+const f = (o) => o;
+describe('_captureFrom', () => {
+    it('is undefined when the operator said nothing', () => {
+        // Not `{}` — an empty object would still put `capture` in the PATCH body,
+        // and "Nothing to change" would stop being reachable.
+        expect(_captureFrom(f({}))).toBeUndefined();
+        expect(_captureFrom(f({ routes: '/a' }))).toBeUndefined();
+    });
+    it('sends only the field that was named', () => {
+        expect(_captureFrom(f({ 'no-screenshot': true }))).toEqual({ screenshot: false });
+        expect(_captureFrom(f({ 'no-text': true }))).toEqual({ text: false });
+        expect(_captureFrom(f({ screenshot: true }))).toEqual({ screenshot: true });
+        expect(_captureFrom(f({ text: true }))).toEqual({ text: true });
+    });
+    it('never infers the field it was not told about', () => {
+        // The whole point. Turning screenshots off must not carry an opinion about
+        // text, in either direction.
+        const only = _captureFrom(f({ 'no-screenshot': true }));
+        expect(only).not.toHaveProperty('text');
+        expect(Object.keys(only)).toEqual(['screenshot']);
+    });
+    it('carries both when both were named', () => {
+        expect(_captureFrom(f({ 'no-screenshot': true, 'no-text': true })))
+            .toEqual({ screenshot: false, text: false });
+        expect(_captureFrom(f({ screenshot: true, 'no-text': true })))
+            .toEqual({ screenshot: true, text: false });
+    });
+    it('lets the negative win when both spellings are passed', () => {
+        // `--screenshot --no-screenshot` is contradictory input. Resolving it to
+        // the restrictive answer is the safe direction: the cost of wrongly not
+        // capturing is a less useful bug report, the cost of wrongly capturing is
+        // a customer's records in a screenshot.
+        expect(_captureFrom(f({ screenshot: true, 'no-screenshot': true }))).toEqual({ screenshot: false });
+        expect(_captureFrom(f({ text: true, 'no-text': true }))).toEqual({ text: false });
+    });
+});

package/dist/commands/feedback.d.ts

@@ -1,8 +1,16 @@
+import { feedback as sdkFeedback } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+/** Reads the paired --x / --no-x flags into a capture patch.
+ *
+ *  Only the fields the operator actually named end up in the object. Sending a
+ *  full `capture` would turn "stop taking screenshots" into "stop taking
+ *  screenshots and start capturing text", silently changing a setting they did
+ *  not mention — on a widget that may be pointed at tenant records. */
+export declare function _captureFrom(flags: Flags): sdkFeedback.WidgetCapture | undefined;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(bodyArg: string | undefined, flags: Flags): Promise<void>;
 export declare function resolve(id: string, flags: Flags): Promise<void>;

package/dist/commands/feedback.js

@@ -36,7 +36,41 @@ export const SCHEMA = {
     'page-url': 'string',
     route: 'string',
     origins: 'string',
+    // Capture controls. Paired --x / --no-x rather than --x=true|false so that
+    // "unset" stays distinguishable from "set to false": the API treats an absent
+    // key as unchanged, and the CLI must be able to express that.
+    screenshot: 'boolean',
+    'no-screenshot': 'boolean',
+    text: 'boolean',
+    'no-text': 'boolean',
 };
+/** Reads the paired --x / --no-x flags into a capture patch.
+ *
+ *  Only the fields the operator actually named end up in the object. Sending a
+ *  full `capture` would turn "stop taking screenshots" into "stop taking
+ *  screenshots and start capturing text", silently changing a setting they did
+ *  not mention — on a widget that may be pointed at tenant records. */
+export function _captureFrom(flags) {
+    const cap = {};
+    if (flags['no-screenshot'])
+        cap.screenshot = false;
+    else if (flags.screenshot)
+        cap.screenshot = true;
+    if (flags['no-text'])
+        cap.text = false;
+    else if (flags.text)
+        cap.text = true;
+    return Object.keys(cap).length ? cap : undefined;
+}
+/** "on" / "off" for a resolved capture field. The server returns both fields
+ *  resolved, so an undefined here means an older backend that did not answer —
+ *  say so rather than printing "off" for something that is on. */
+function captureLine(c) {
+    if (!c)
+        return '(not reported by this backend)';
+    const s = (v) => v === undefined ? '?' : v ? 'on' : 'off';
+    return `screenshot ${s(c.screenshot)}, text ${s(c.text)}`;
+}
 // The platform's enum, checked against the schema rather than invented.
 const KINDS = ['bug', 'issue', 'suggestion'];
 // A selector says `div#install > button.save`. The context says the button read
@@ -96,6 +130,15 @@ export async function list(flags) {
         const pointing = describeTarget(i);
         if (pointing)
             info(`  pointing at  ${pointing}`);
+        // Whoever the host app named via window.__myapiFeedback.identify(). Opaque
+        // to us — their id for their user, never resolved against anything.
+        //
+        // Printed only when set: an anonymous visitor is still the normal case, and
+        // a blank `from` reads as a failure to capture rather than nobody to name.
+        // Every item filed before 2026-08-19 carries '' — the column existed and
+        // nothing ever wrote it — so most history will show no line here.
+        if (i.end_user_ref)
+            info(`  from         ${i.end_user_ref}`);
         const trace = Array.isArray(i.trace) ? i.trace : [];
         if (trace.length) {
             // Errors and failed requests are the highest-signal part — for most
@@ -244,7 +287,7 @@ export async function widget(sub, arg, flags) {
         return;
     }
     if (sub === 'update') {
-        requireArg(arg, 'id', 'myapi feedback widget update <id> [--routes /a,/b] [--origins a.com] [--accent #2563eb] [--position bottom-right] [--label "Feedback"]');
+        requireArg(arg, 'id', 'myapi feedback widget update <id> [--routes /a,/b] [--origins a.com] [--accent #2563eb] [--position bottom-right] [--label "Feedback"] [--no-screenshot] [--no-text]');
         const patch = {};
         const csv = (v) => typeof v === 'string' ? v.split(',').map(s => s.trim()).filter(Boolean) : undefined;
         if (flags.routes !== undefined)
@@ -282,7 +325,7 @@ export async function widget(sub, arg, flags) {
         info('Feedback already collected through it is kept.');
         return;
     }
-    error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget list\n       myapi feedback widget update <id> [--routes <list>] [--origins <list>]\n       myapi feedback widget revoke <id>');
+    error('Usage: myapi feedback widget create <name> [--origins <list>] [--no-screenshot] [--no-text]\n       myapi feedback widget list\n       myapi feedback widget update <id> [--routes <list>] [--origins <list>] [--no-screenshot] [--no-text]\n       myapi feedback widget revoke <id>');
 }
 export const SUBCOMMAND_USAGE = {
     'delete': `myapi feedback delete <id> [--yes] [--org <id>]
@@ -300,10 +343,24 @@ Newest first. \`total\` is the number of matches, not the page size.`,
     'resolve': 'myapi feedback resolve <id> [--org <id>]',
     'widget': `myapi feedback widget list
        myapi feedback widget create <name> [--origins a.com,b.com] [--org <id>]
+       myapi feedback widget update <id> [--routes <list>] [--no-screenshot] [--no-text] [--org <id>]
        myapi feedback widget revoke <id> [--yes] [--org <id>]
 
 The key a widget mints is PUBLIC — it ships in page source and authenticates
-nobody. --origins stops another site posting through it.`,
+nobody. --origins stops another site posting through it.
+
+What a report may collect (both on by default):
+  --no-screenshot   Stop photographing the viewport.
+  --no-text         Keep the SHAPE of the element pointed at — tag, role, id,
+                    data-feedback-id — and drop the words inside it. On a table
+                    row that is "row, id row-8" instead of the customer's name.
+Pass --screenshot / --text to turn one back on. Flags you omit are left alone,
+so turning one off never silently changes the other. Changes reach live
+browsers within ~5 minutes, with no redeploy of your site.
+
+To exempt one panel rather than the whole widget, mark it data-feedback-ignore
+in your page: it is skipped in the element context AND blacked out in the
+screenshot.`,
 };
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
@@ -320,7 +377,7 @@ Subcommands:
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)
   widget list          List widgets with the script tag to paste
   widget revoke <id>   Revoke a widget key; collected feedback is kept
-  widget update <id>   Change routes/origins/theme, keeping the same key
+  widget update <id>   Change routes/origins/theme/capture, keeping the same key
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;

package/dist/errors.js

@@ -26,6 +26,12 @@ export const ERROR_MESSAGES = {
     invalid_org: 'Invalid organization.',
     FORBIDDEN: 'You do not have permission to perform this action.',
     RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
+    // The backend refuses an unknown key or a non-boolean rather than ignoring it
+    // — `{"screenshots": false}` (plural) is a 422, not a no-op. That is
+    // deliberate: a capture setting accepted and ignored reads as "screenshots
+    // are off" while screenshots keep being taken, on pages that may carry
+    // customer records.
+    INVALID_CAPTURE: 'capture accepts only `screenshot` and `text`, both booleans. Check the spelling — an unknown key is refused, not ignored.',
     BODY_TOO_LARGE: 'The request is over 64 KB — usually an oversized feedback `trace`. Nothing was saved. This used to surface as INVALID_JSON, which sent people looking for a syntax error they did not have.',
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',

package/dist/skills/my-auth-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-auth-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-07690e940717e8f65c195f9fbecdc1def9372edfd52dea19f6570227008d28ad
+checksum: sha256-e6bf7db60560fa6702d7864aaf515a524d3f79cf3eaafe265790005673e3ae29
 ---
 
 # MyAuthAPI
@@ -38,6 +38,11 @@ its clients.
   client (no secret; for browser/SPA/mobile). `type web` is confidential and
   returns a `client_secret` **once** — store it immediately. `--redirect` lists
   allowed callback URIs (absolute https, or http://localhost for dev).
+  `auth client update <id> --redirect <uri,uri>` changes them later, keeping the
+  same `client_id` and secret. Do NOT delete and recreate to add a callback
+  URL — that mints a new `client_id`, so every deployed copy of the app has to
+  be reconfigured and the cutover has to accept two audiences at once.
+  `--redirect` REPLACES the list: pass every URI you want, not just the new one.
 - **Usage** — `auth usage` shows monthly active users (auth is billed per MAU).
 - **Custom domain** — serve auth on `auth.acme.com`. Three steps: `auth domain
   set --domain auth.acme.com` prints a **TXT ownership challenge**; publish it,
@@ -62,6 +67,7 @@ CLI is only the management surface.
 | `myapi auth tenant create` | Create/enable the tenant (`--connections google,password,magic`; `--theme <json>`) |
 | `myapi auth client list` | List the OIDC clients (apps) registered to your tenant |
 | `myapi auth client create` | Register an OIDC client (`--name`, `--type spa\|web`, `--redirect`) |
+| `myapi auth client update <id>` | Change redirect URIs (`--redirect`, replaces the list) or `--name`; same client_id and secret |
 | `myapi auth client delete <id>` | Revoke a client (irreversible); `--yes` to skip the confirm |
 | `myapi auth client rotate <id>` | Re-issue a `web` client's secret (shown once) |
 | `myapi auth usage` | Monthly active users (MAU) for the current period (`as_of` shows freshness) |

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.5.1
+version: 1.6.0
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-b1aba273d6d32b4145dcee85fb59fec35f50b257fc41fb8da9f649a0b519e909
+checksum: sha256-f8be1cee17e2dc5e1dcf2310cf18d275982d54460af26a0b642fc46bd8c4691e
 ---
 
 # MyFeedbackAPI
@@ -18,111 +18,129 @@ Two halves: a **widget key** a page embeds, and the **items** it produces.
 
 ### The widget key is public, and that is the point
 
-`myapi feedback widget create <name>` mints a key that ships in your page
-source. It is **not a secret** — it names your org so a visitor can submit
-without signing in, and it authenticates nobody.
+`widget create <name>` mints a key that ships in your page source. It is **not a
+secret** — it names your org so a visitor can submit without signing in, and
+authenticates nobody.
 
-Treating it as a credential is the mistake to avoid: people hide it, and then
-the widget cannot work. What it does need is `--origins`, so another site
-cannot post through it:
+Treating it as a credential is the mistake: people hide it and the widget cannot
+work. It needs `--origins`, so another site cannot post through it:
 
 ```bash
 myapi feedback widget create site --origins app.example.com,example.com
 ```
 
-Revoke with `myapi feedback widget revoke <id>`. Submissions stop immediately;
-feedback already collected is kept.
+Revoke with `myapi feedback widget revoke <id>`: submissions stop immediately,
+collected feedback is kept.
 
 ### Embedding it: one script tag
 
-The platform hosts the widget, compiled per key with that widget's routes and
-theme baked in. This is the intended way in — you do not build a UI:
+The platform hosts the widget, compiled per key with its routes and theme baked
+in. The intended way in — you build no UI:
 
 ```html
 <script src="https://api.myapihq.com/feedback/in/<widget_key>/widget.js" async></script>
 ```
 
-It renders a button and shows itself only on the routes the widget is
-configured for — set them with `widget update <id> --routes /app,/app/**`, and
-the change reaches browsers within ~5 minutes with no redeploy of your site.
+It shows only on the widget's routes — set them with `widget update <id>
+--routes /app,/app/**`; live in ~5 min, no redeploy.
 
-The person points at an element or drags a region, and it sends:
+The person points at an element or drags a region; it sends:
 
 - `kind`, `body`, `page_url`, `route`, `viewport`
-- `target_selector` and `target_region` `{x,y,w,h}` — the region is on **every**
-  report now: the element's bounding rectangle for a click, the dragged box for
-  a drag
-- `target_context` — what the element *was*: its text, role, the heading above it
+- `target_selector` and `target_region` `{x,y,w,h}` — on **every** report: the
+  element's bounding box for a click, the dragged box for a drag
+- `target_context` — what the element *was*: text, role, the heading above it
 - `trace` — the last events before the report
 
-A wrong key does not break the page: the response is `application/javascript`
-carrying a JS comment that names the fix, so a typo cannot throw a syntax error
-in your app.
+A wrong key cannot break the page: the response is `application/javascript`
+with a comment naming the fix, so a typo throws no syntax error.
 
-**Screenshots are automatic — you do not build a capture step.** When someone
-opens the feedback sheet the widget fetches a renderer on demand and attaches
-the picture itself, as a second call after the report is saved. That ordering is
-deliberate: an image that fails to render or upload never costs the report.
+**Screenshots are automatic — you build no capture step.** The widget attaches
+the picture as a second call after the report is saved, so an image that fails
+to render never costs the report.
 
-The image is **stored private in your org's assets**, and listing feedback
-returns a **signed link good for about an hour** (`screenshot_url`). It is
-signed on read, so it is not stable — re-list rather than persisting it. PNG,
-JPEG or WebP up to 3 MB; over that the feedback is kept without the picture.
+The image is **private in your org's assets**; listing returns a **signed link
+good for ~an hour** (`screenshot_url`) — re-list rather than persisting it.
+PNG/JPEG/WebP up to 3 MB; over that the report is kept without it.
 
 ### Submitting by hand (only if you cannot use the script)
 
-`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK.
-Same fields the widget sends:
-
-```js
-await fetch(`https://api.myapihq.com/feedback/in/${WIDGET_KEY}`, {
-  method: 'POST',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({ kind: 'bug', body: text, page_url: location.href }),
-});
-```
+`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK, same
+fields the widget sends (`kind`, `body`, `page_url`, …).
 
 Errors: `WIDGET_NOT_FOUND` (a revoked key reads like an invented one, so keys
 cannot be probed), `ORIGIN_NOT_ALLOWED`, `RATE_LIMITED`, `INVALID_KIND`,
-`BODY_REQUIRED`, `BODY_TOO_LONG` (the text is over 8000 chars) and
-`BODY_TOO_LARGE` (the whole request is over 64 KB, usually an oversized
-`trace`). Nothing is saved in either case. The key only ever writes.
+`BODY_REQUIRED`, `BODY_TOO_LONG` (>8000 chars), `BODY_TOO_LARGE` (>64 KB, usually
+an oversized `trace`). Nothing is saved; the key only writes.
 
 ### Kind is a claim, not a guess
 
-`--kind` is one of `bug`, `issue`, `suggestion`, and it is **what the person
-reporting says it is**. Someone filing a `bug` is telling you
-they believe the product is broken — which is a different and more urgent
+`--kind` is one of `bug`, `issue`, `suggestion`, and it is **what the reporter
+says it is**. A `bug` means they believe the product is broken — a more urgent
 signal than a wish for something new. Do not re-classify from the wording.
 
-Classification and duplicate-grouping exist in the platform's design and are
-not built yet, so treat `kind` as the person's own label rather than a
-processed signal.
+Classification and duplicate-grouping are designed but not built, so treat
+`kind` as the person's own label, not a processed signal.
+
+### Controlling what a report contains
+
+A report carries a screenshot of the viewport plus the text of the element
+pointed at. On a page of customer records, that is the page. Both on by default:
+
+```bash
+myapi feedback widget update <id> --no-screenshot   # stop photographing
+myapi feedback widget update <id> --no-text         # keep SHAPE, drop words
+```
+
+`--no-text` keeps tag, role, id and `data-feedback-id`: on a table row, "row, id
+`row-8`" not the tenant's name. `--screenshot` / `--text` turn one back on.
+Omitted flags are left alone, so one off never changes the other. Live in ~5 min.
+
+**In your page**, two levers only you control:
+
+```js
+window.__myapiFeedback.identify("your-user-id");  // when you learn who it is
+window.__myapiFeedback.identify();                // on sign-out
+```
+
+Callable any time, even long after load. Your id for your user — opaque to us,
+never resolved, posted to a public endpoint: a label, not authentication. Shows
+as `from` in `feedback list`.
+
+Mark an element `data-feedback-ignore` to skip it in the context AND black it out
+in the screenshot.
+
+| Need | Lever |
+|---|---|
+| No pictures at all | `--no-screenshot` |
+| Pictures, no words | `--no-text` |
+| All but one panel | `data-feedback-ignore` |
+| Different rules per page | two widgets, two route sets |
+
+The last row is usually right: capture off on record-bearing routes, on
+elsewhere — not one global switch.
 
 ### Reading it back
 
 Each item carries what was pointed at, how they got there, and a picture.
-`myapi feedback list` summarises that per report — the element's own text rather
-than its CSS selector, a count of steps/errors/failed requests, and whether a
-screenshot exists. `--trace` expands the event list; `--json` passes everything
-through.
-
-Two things not to misread: **`trace[].t` is milliseconds since page load**, not
-a clock time, so it only means anything as a delta within one trace. And
-**`target_context.filled` says an input had a value, never what it was** — the
-widget does not collect it.
-
-`delete` removes the screenshot along with the report, which is the case that
-matters: somebody erasing a report because of what is in the picture.
-
-`myapi feedback list` is newest first, filterable by `--kind` and `--status`
-(`open` | `resolved`), paged with `--limit` / `--offset`. **`total` is the
-number of matches, not the size of the page**, and `has_more` flags a truncated
-result — both describe the whole match set.
-
-`myapi feedback resolve <id>` closes an item. An unknown id answers the same
-way as an already-resolved one, so a success is not proof the item existed —
-that is deliberate, so ids cannot be probed across orgs.
+`list` summarises it — the element's own text rather than its CSS selector,
+counts of steps/errors/failed requests, whether a screenshot exists, and `from`
+when the page called `identify()`. `--trace` expands the events; `--json` passes
+everything through.
+
+Two not to misread: **`trace[].t` is ms since page load**, not clock time — only
+a delta means anything. And **`target_context.filled` says an input had a value,
+never what**.
+
+`delete` removes the screenshot with the report — what matters is somebody
+erasing a report because of what is in the picture.
+
+`list` is newest first, filterable by `--kind`/`--status`, paged with `--limit`
+/ `--offset`. **`total` is the match count, not the page size**; `has_more` flags
+truncation — both describe the whole match set.
+
+`resolve <id>` closes an item. An unknown id answers like an already-resolved
+one, so success is not proof it existed — deliberate, so ids cannot be probed.
 <!-- llm:end -->
 
 ## Commands
@@ -135,7 +153,7 @@ that is deliberate, so ids cannot be probed across orgs.
 | `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
 | `myapi feedback widget list` | List widgets, each with the script tag to paste |
-| `myapi feedback widget update <id>` | Change `--routes`, `--origins`, `--name`, or the look (`--accent`, `--position`, `--label`), keeping the same key |
+| `myapi feedback widget update <id>` | Change `--routes`, `--origins`, `--name`, look (`--accent`/`--position`/`--label`) or capture (`--no-screenshot`/`--no-text`); same key |
 | `myapi feedback widget revoke <id>` | Revoke a key; collected feedback is kept |
 <!-- generated:end -->
 
@@ -149,16 +167,16 @@ myapi feedback widget create marketing --origins example.com,www.example.com
 # 2. See your widgets and the exact tag to paste
 myapi feedback widget list
 
-# 3. Change where it appears — same key, so your page needs no edit
+# 3. Change where it appears, or what it may collect — same key either way
 myapi feedback widget update <id> --routes /app,/app/**
+myapi feedback widget update <id> --no-screenshot --no-text   # record-bearing routes
 
-# 4. Read what came back, newest first
+# 4. Read what came back, newest first (`from` shows if the page identify()d)
 myapi feedback list --status open
 myapi feedback list --kind bug --limit 20
 
 # 5. Record something yourself (support call, your own testing)
-myapi feedback create "checkout 500s on the second attempt" --kind bug \
-  --route /checkout
+myapi feedback create "checkout 500s on retry" --kind bug --route /checkout
 
 # 6. Close it — or delete it, which also removes its screenshot
 myapi feedback resolve <id>
@@ -168,12 +186,11 @@ myapi feedback delete <id> --yes
 
 ## Notes
 
-- The widget key is public by design — restrict it with `--origins` rather than hiding it.
-- `resolve` is idempotent and deliberately indistinguishable from an unknown id.
+- The widget key is public by design — restrict with `--origins`, don't hide it.
 - Feedback survives widget revocation.
-- **`resolve` keeps, `delete` erases.** A public inbox collects spam and the
-  occasional report with personal details in it; `delete` is how those leave.
-  Both are idempotent and answer the same for an unknown id.
+- **`resolve` keeps, `delete` erases.** A public inbox collects spam and the odd
+  report with personal details in it; `delete` is how those leave. Both are
+  idempotent and answer the same for an unknown id, so ids cannot be probed.
 
 ## HTTP (from deployed code)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.17.0",
+  "version": "2.19.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "prebuild": "node scripts/copy-skills.js",
-    "build": "tsc && rm -rf dist/skills && cp -r src/skills dist/skills",
+    "build": "rm -rf dist && tsc && cp -r src/skills dist/skills",
     "dev": "tsc --watch",
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.17.0"
+    "@myapihq/sdk": "^2.19.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",