@myapihq/cli 2.19.0 → 2.19.2

package/dist/commands/authproduct.d.ts

@@ -4,6 +4,7 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
+export declare const NESTED_SUBCOMMAND_USAGE: Record<string, Record<string, string>>;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
 export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, update, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/authproduct.js

@@ -30,6 +30,38 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/domain/verify',
     'DELETE /auth/orgs/{org_id}/domain',
 ];
+// `auth` is a flat module with a second level inside it — `auth client update`,
+// `auth domain verify` — so SUBCOMMAND_USAGE alone stops at `auth client` and
+// everything under it is invisible to `myapi __commands`.
+//
+// That was not theoretical: `auth client update` shipped in 2.18.0 because
+// ImmoPilot asked for it by name, and it was absent from the published manifest
+// the same day. The manifest is what the myapi-hq site checker consults to
+// decide whether a documented command is real, and what lint-skill-coverage
+// walks — so a verb missing here is a verb neither can check.
+//
+// Same mechanism `domain records` uses; see commands/manifest.ts.
+export const NESTED_SUBCOMMAND_USAGE = {
+    tenant: {
+        'show': 'myapi auth tenant show [--org <id>] [--json]',
+        'create': 'myapi auth tenant create [--connections google,password,magic] [--theme <json>] [--org <id>]',
+    },
+    client: {
+        'list': 'myapi auth client list [--org <id>] [--json]',
+        'create': 'myapi auth client create --name <name> --type spa|web --redirect <uri> [--org <id>]',
+        'update': 'myapi auth client update <client_id> [--redirect <uri>] [--name <name>] [--org <id>]',
+        'delete': 'myapi auth client delete <client_id> [--yes] [--org <id>]',
+        'rotate': 'myapi auth client rotate <client_id> [--org <id>]',
+    },
+    domain: {
+        'show': 'myapi auth domain show [--org <id>] [--json]',
+        'set': 'myapi auth domain set --domain <host> [--org <id>]',
+        'verify': 'myapi auth domain verify [--org <id>]',
+        'delete': 'myapi auth domain delete [--yes] [--org <id>]',
+    },
+    // `usage` takes flags only, no second level — deliberately absent rather than
+    // an empty object, which would advertise a level that does not exist.
+};
 export const SUBCOMMAND_USAGE = {
     'tenant': `myapi auth tenant [show|create] [--connections <list>] [--theme <json>] [--org <id>] [--json]
 

package/dist/commands/feedback.js

@@ -240,13 +240,14 @@ export async function widget(sub, arg, flags) {
         const origins = typeof flags.origins === 'string'
             ? flags.origins.split(',').map(s => s.trim()).filter(Boolean)
             : undefined;
-        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins);
+        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins, _captureFrom(flags));
         if (flags.json) {
             printJson(w);
             return;
         }
         success(`Widget created: ${w.id}`);
         info(`Key:  ${w.key}`);
+        info(`Capture: ${captureLine(w.capture)}`);
         info('');
         // Saying this plainly matters: a value that looks like a credential and is
         // not one gets treated as a secret, and then nobody puts it in the page.
@@ -282,6 +283,10 @@ export async function widget(sub, arg, flags) {
                     .filter(Boolean).join(' · ')}`);
             }
             info(`  origins: ${w.allowed_origins?.length ? w.allowed_origins.join(', ') : '(any — anyone can post with this key)'}`);
+            // Listed for the same reason position and label are: the only other way
+            // to read it back was to fetch widget.js and read the JavaScript, which
+            // ImmoPilot reported once already.
+            info(`  capture: ${captureLine(w.capture)}`);
             info('');
         }
         return;
@@ -303,8 +308,36 @@ export async function widget(sub, arg, flags) {
         }
         if (Object.keys(theme).length)
             patch.theme = theme;
+        // Read-modify-write, because the backend REPLACES `capture` rather than
+        // merging it. Verified against production 2026-08-20: set
+        // {screenshot:false, text:false}, PATCH {text:true}, and screenshot comes
+        // back TRUE. Only the capture object behaves this way — a name-only PATCH
+        // leaves it untouched — so the request as a whole merges and this field
+        // does not.
+        //
+        // --help and the skill both promise "omitted flags are left alone". Sending
+        // the partial object would make `--no-text` silently switch screenshots
+        // back ON for a widget that had them off: the exact harm this feature
+        // exists to prevent, on the pages it was built for.
+        //
+        // Remove once the backend merges (cross-repo prompt, 2026-08-20): then
+        // `patch.capture = capture` stands alone and the extra read disappears.
+        const capture = _captureFrom(flags);
+        if (capture) {
+            patch.capture = capture;
+            try {
+                const current = (await sdkFeedback.listWidgets(config.api_key, orgId)).find(x => x.id === arg);
+                if (current?.capture)
+                    patch.capture = { ...current.capture, ...capture };
+            }
+            catch {
+                // A failed read must not block the change that was asked for. The
+                // operator still gets what they typed, and the resolved state printed
+                // after the call is the truth either way.
+            }
+        }
         if (Object.keys(patch).length === 0) {
-            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label.');
+            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label, --screenshot/--no-screenshot, --text/--no-text.');
         }
         const w = await sdkFeedback.updateWidget(config.api_key, orgId, arg, patch);
         if (flags.json) {
@@ -312,9 +345,13 @@ export async function widget(sub, arg, flags) {
             return;
         }
         success(`Widget ${arg} updated`);
+        // Resolved by the server: both fields, whatever was sent. Print it so the
+        // operator sees what the widget will DO, not what they happened to type.
+        if (w.capture)
+            info(`  capture: ${captureLine(w.capture)}`);
         // The key is unchanged, which is the reason to use this instead of
         // revoke + create — the customer's page does not need editing.
-        info('Same key, so your page needs no change. Route changes reach browsers within ~5 minutes.');
+        info('Same key, so your page needs no change. Route and capture changes reach browsers within ~5 minutes, with no redeploy of your site.');
         return;
     }
     if (sub === 'revoke') {

package/dist/skills/my-auth-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-auth-api
-version: 1.1.0
+version: 1.1.1
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-e6bf7db60560fa6702d7864aaf515a524d3f79cf3eaafe265790005673e3ae29
+checksum: sha256-ef6a4a0c3b6199fe0335d38b51306301f64bc6e293770700daef625f0deacd33
 ---
 
 # MyAuthAPI
@@ -33,7 +33,7 @@ consumed by your app + the JS SDK, **not** the CLI:
 its clients.
 
 - **Tenant** — `auth tenant create` provisions (idempotent) your org's OIDC
-  issuer + hosted login URL. `auth tenant` shows them.
+  issuer + hosted login URL. `auth tenant` (or `auth tenant show`) shows them.
 - **Client** — `auth client create` registers an app. `type spa` is a public
   client (no secret; for browser/SPA/mobile). `type web` is confidential and
   returns a `client_secret` **once** — store it immediately. `--redirect` lists

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.19.0",
+  "version": "2.19.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.19.0"
+    "@myapihq/sdk": "^2.19.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",