fix(cli): always send domains in sso update PUT body to match Go (CLI-1981)

[Coly010]

What changed

sso update now always sends domains in the PUT body, matching the Go CLI.

Go's internal/sso/update/update.go:82-109 looks gated — if len(Domains) != 0 { … } else if params.AddDomains != nil || params.RemoveDomains != nil { merge existing → body.Domains } — but cmd/sso.go:171-172 declares --add-domains/--remove-domains with a non-nil []string{} default and passes them unconditionally, so AddDomains != nil is always true from the CLI. Every Go sso update therefore enters the fetch-and-merge branch and sets body.Domains (the recomputed existing set, or []). UpdateProviderBody.Domains is a non-nil *[]string under json:"domains,omitempty", and omitempty never omits a non-nil pointer, so even the empty set serializes as "domains":[].

The TS handler gated the merge on addDomains.length > 0 || removeDomains.length > 0 and omitted domains entirely when no domain flags were passed — a different request shape (sso update <id> --metadata-url X: Go sends {"domains":[…existing],"metadata_url":"X"}, TS sent {"metadata_url":"X"}) with potential server-side domain-state drift.

• update.handler.ts — the merge branch is now the unconditional else of the --domains replace branch.
• mergeDomains seed filter relaxed from domain.length > 0 to typeof domain === "string" — Go's seed check is nil-ness only (domain.Domain != nil, update.go:89), so an empty-string domain from the GET response is kept.
• SIDE_EFFECTS.md — PUT body documents domains as always present.
• Integration tests: PUT-body assertions for all flag combinations, including no-flags → recomputed existing set, no-flags + provider without domains → literal "domains":[], GET response missing domains entirely, explicit empty --domains= falling into the merge, and empty-string-domain retention. All five fail without the fix.

Verification level for the Go body shape: live-captured

Built the Go binary from apps/cli-go and ran it against a local HTTP recorder (SUPABASE_PROFILE YAML pointing api_url at the recorder). Captured raw PUT bodies:

Scenario	Go PUT body (verbatim bytes)
no flags, provider has old1.com,old2.com	{"domains":["old1.com","old2.com"]}
no flags, provider has no domains	{"domains":[]}
--metadata-url only (issue repro)	{"domains":["old1.com","old2.com"],"metadata_url":"https://example.com"}
explicit empty --domains=	{"domains":["old2.com","old1.com"]} (merge branch; map-iteration order is nondeterministic)

Go's own update_test.go additionally pins body.Domains non-nil for the --domains and --add/--remove-domains paths.

Review notes (deliberately left open)

• sso add has the same gate class (create.go:60 gates on != nil, TS gates on .length > 0), so sso add --domains= diverges — that is audit §3.10's separate sso add item, intentionally not touched here.
• The GET→PUT read-modify-write window (concurrent domain edits overwritten by the resent snapshot) is inherent to Go's design; parity is the bar.

Fixes CLI-1981
https://linear.app/supabase/issue/CLI-1981/sso-update-omits-domains-from-the-put-body-where-go-always-sends-it

[Coly010]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 8c21d8de5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@8c21d8de5af36b97bcc599dd39ac6225924af1d9

Preview package for commit 8c21d8d.