apiblaze 0.14.0 → 0.15.0

package/dist/index.js

@@ -370,6 +370,354 @@ var init_anon_cred = __esm({
   }
 });
 
+// src/commands/create.ts
+var create_exports = {};
+__export(create_exports, {
+  buildTryItCurl: () => buildTryItCurl,
+  runCreate: () => runCreate
+});
+function normalizeName(raw) {
+  return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isHttpUrl(s) {
+  try {
+    const u = new URL((s || "").trim());
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function stripTenantFromPortal(devPortal) {
+  try {
+    const u = new URL(devPortal);
+    const dot = u.hostname.indexOf(".");
+    if (dot < 0) return devPortal;
+    const product = u.hostname.slice(0, dot).split("-")[0];
+    u.hostname = `${product}${u.hostname.slice(dot)}`;
+    return u.toString();
+  } catch {
+    return devPortal;
+  }
+}
+function fail(message) {
+  console.error(import_chalk6.default.red(`Error: ${message}`));
+  process.exit(1);
+}
+function buildTryItCurl(url, authType, apiKey) {
+  if (authType === "api_key") {
+    if (!apiKey) return null;
+    return `curl ${url} -H "X-API-Key: ${apiKey}"`;
+  }
+  if (authType === "none") return `curl ${url}`;
+  return null;
+}
+function printCurlExample(url, authType, apiKey, devPortal) {
+  const curl = buildTryItCurl(url, authType, apiKey);
+  console.log();
+  if (curl) {
+    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
+    console.log(`    ${import_chalk6.default.cyan(curl)}`);
+  } else if (authType === "oauth") {
+    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
+    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
+  }
+}
+async function runCreate(opts = {}) {
+  const creds = loadCredentials();
+  if (!creds) {
+    await runAnonymousCreate(opts);
+    return;
+  }
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  const auth = (opts.auth ?? "api_key").toLowerCase();
+  if (!VALID_AUTH.includes(auth)) {
+    fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
+  }
+  let teamId = creds.teamId;
+  if (opts.team) {
+    if (opts.team.startsWith("team_")) {
+      teamId = opts.team;
+    } else {
+      const teams = await getTeams().catch(() => []);
+      const match = teams.find(
+        (t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase()
+      );
+      if (!match) {
+        fail(`Team "${opts.team}" not found. Run \`apiblaze team\` to see your teams.`);
+      }
+      teamId = match.teamId;
+    }
+  }
+  if (!opts.json) console.log(import_chalk6.default.bold("\nCreate an API proxy\n"));
+  let name = "";
+  if (opts.name !== void 0) {
+    name = normalizeName(opts.name);
+    if (name.length < 3) fail("Proxy name must be at least 3 characters (letters and digits only).");
+    const check = await checkProxyName(name, teamId, opts.apiversion).catch(() => null);
+    if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
+      fail(`Proxy name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
+    }
+  } else if (interactive) {
+    const { default: inquirer2 } = await import("inquirer");
+    for (; ; ) {
+      const { rawName } = await inquirer2.prompt([{
+        type: "input",
+        name: "rawName",
+        message: "Proxy name (your API will live at <name>.abz.run):",
+        transformer: (v) => normalizeName(v)
+      }]);
+      name = normalizeName(rawName);
+      if (name.length < 3) {
+        console.log(import_chalk6.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
+        continue;
+      }
+      const spinner2 = (0, import_ora4.default)("Checking availability...").start();
+      try {
+        const check = await checkProxyName(name, teamId, opts.apiversion);
+        spinner2.stop();
+        if (!check.canUseProjectName || !check.canUseApiVersion) {
+          console.log(import_chalk6.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
+`));
+          continue;
+        }
+      } catch {
+        spinner2.stop();
+        console.log(import_chalk6.default.dim("  (could not verify availability; continuing)"));
+      }
+      console.log(`${import_chalk6.default.cyan("\u2192")} Your API will live at ${import_chalk6.default.bold(`https://${name}.abz.run`)}
+`);
+      break;
+    }
+  } else {
+    fail("--name is required in non-interactive mode.");
+  }
+  let targetUrl = "";
+  if (opts.target !== void 0) {
+    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+    targetUrl = opts.target.trim();
+  } else if (interactive) {
+    const { default: inquirer2 } = await import("inquirer");
+    for (; ; ) {
+      const { url } = await inquirer2.prompt([{
+        type: "input",
+        name: "url",
+        message: "Target URL to forward requests to (e.g. https://httpbin.org):"
+      }]);
+      if (!isHttpUrl(url)) {
+        console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+        continue;
+      }
+      targetUrl = url.trim();
+      break;
+    }
+  } else {
+    fail("--target is required in non-interactive mode.");
+  }
+  if (interactive && !opts.yes) {
+    const { default: inquirer2 } = await import("inquirer");
+    console.log(`${import_chalk6.default.cyan("\u2192")} Auth: ${import_chalk6.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
+    const { ok } = await inquirer2.prompt([{
+      type: "confirm",
+      name: "ok",
+      message: `Create proxy "${name}" \u2192 ${targetUrl}?`,
+      default: true
+    }]);
+    if (!ok) {
+      console.log(import_chalk6.default.yellow("Cancelled."));
+      return;
+    }
+  }
+  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
+  let result;
+  try {
+    result = await createProxy({ name, target_url: targetUrl, auth_type: auth, team_id: teamId, ...opts.apiversion ? { api_version: opts.apiversion } : {} });
+    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+  } catch (err) {
+    spinner?.fail("Failed to create proxy.");
+    throw err;
+  }
+  const version2 = result.api_version || "1.0.0";
+  const keys = result.api_keys ?? {};
+  const adminKey = keys.dev ?? Object.values(keys)[0];
+  const proxyUrl = `https://${name}.abz.run/${version2}/dev`;
+  const devPortal = result.devPortal ? stripTenantFromPortal(result.devPortal) : void 0;
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({
+      project_id: result.project_id,
+      api_version: version2,
+      proxy_url: proxyUrl,
+      dev_portal: devPortal,
+      api_key: adminKey,
+      api_keys: keys,
+      team_id: teamId
+    }) + "\n");
+    return;
+  }
+  console.log();
+  console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(proxyUrl)}`);
+  if (devPortal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(devPortal)}`);
+  if (adminKey) {
+    console.log();
+    console.log(`  ${import_chalk6.default.dim("Consumer admin API key (dev):")}`);
+    console.log(`    ${import_chalk6.default.bold.green(adminKey)}`);
+    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+    const otherEnvs = Object.keys(keys).filter((e) => e !== "dev");
+    if (otherEnvs.length) {
+      console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
+    }
+  }
+  printCurlExample(proxyUrl, auth, adminKey, devPortal);
+  console.log();
+}
+async function runAnonymousCreate(opts) {
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  if (!opts.json) {
+    console.log(import_chalk6.default.bold("\nCreate an API proxy"));
+    console.log(import_chalk6.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
+  }
+  let body = {};
+  if (opts.config) {
+    let raw = "";
+    try {
+      raw = import_fs2.default.readFileSync(opts.config, "utf8");
+    } catch {
+      fail(`Cannot read --config file: ${opts.config}`);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      fail(`--config is not valid JSON: ${opts.config}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--config must be a JSON object.");
+    body = parsed;
+  }
+  let name = opts.name !== void 0 ? normalizeName(opts.name) : typeof body.name === "string" ? body.name : void 0;
+  if (opts.name !== void 0 && name.length < 3) {
+    fail("Proxy name must be at least 3 characters (letters and digits only).");
+  }
+  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+  let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
+  const hasOtherSource = !!(body.openapi || body.github);
+  if (!target && !hasOtherSource) {
+    if (interactive) {
+      const { default: inquirer2 } = await import("inquirer");
+      if (name === void 0) {
+        const { rawName } = await inquirer2.prompt([{
+          type: "input",
+          name: "rawName",
+          message: "Proxy name (leave blank to auto-generate):",
+          transformer: (v) => normalizeName(v)
+        }]);
+        const n = normalizeName(rawName);
+        name = n.length >= 3 ? n : void 0;
+      }
+      for (; ; ) {
+        const { url } = await inquirer2.prompt([{
+          type: "input",
+          name: "url",
+          message: "Target URL to forward requests to (e.g. https://httpbin.org):"
+        }]);
+        if (!isHttpUrl(url)) {
+          console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+          continue;
+        }
+        target = url.trim();
+        break;
+      }
+    } else {
+      fail("A source is required: pass --target, or target/openapi/github in --config.");
+    }
+  }
+  if (target) {
+    body.target = target;
+    body.target_url = target;
+  }
+  if (name) {
+    body.name = name;
+    body.subdomain = name;
+  }
+  if (opts.subdomain) body.subdomain = normalizeName(opts.subdomain);
+  if (opts.tenant) body.tenant = normalizeName(opts.tenant);
+  if (opts.product) body.product_slug = normalizeName(opts.product);
+  if (opts.displayName) body.display_name = opts.displayName;
+  if (opts.apiversion) body.api_version = opts.apiversion;
+  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
+  const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
+  if (opts.newSession) clearAnonCred2();
+  const cred = loadAnonCred2();
+  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
+  let result;
+  try {
+    if (cred) {
+      result = await cpFetch2(cred.cp_key, "/projects", { method: "POST", body: JSON.stringify(body) });
+      if (Array.isArray(result.endpoints)) {
+        result.endpoints = result.endpoints.map((e) => e.replace(/:\/\/[^/]+/, `://${result.project_id}.tryabz.run`));
+      }
+    } else {
+      result = await createProxyAnonymous(body);
+      if (result.cp_key && result.team_id) {
+        saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
+      }
+    }
+    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+  } catch (err) {
+    spinner?.fail("Failed to create proxy.");
+    throw err;
+  }
+  const version2 = result.api_version || "1.0.0";
+  const keys = result.api_keys ?? {};
+  const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
+  const prodEndpoint = (result.endpoints || []).find((e) => e.endsWith("/prod")) || (result.endpoints || [])[0];
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({
+      project_id: result.project_id,
+      api_version: version2,
+      endpoints: result.endpoints,
+      api_key: apiKey,
+      api_keys: keys,
+      claim_url: result.claim_url,
+      anonymous: true
+    }) + "\n");
+    return;
+  }
+  console.log();
+  if (prodEndpoint) console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(prodEndpoint)}`);
+  if (result.portal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(result.portal)}`);
+  if (apiKey) {
+    console.log();
+    console.log(`  ${import_chalk6.default.dim("API key:")}`);
+    console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
+    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+  }
+  if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
+  const claimCode = result.claim_code || cred?.claim_code;
+  if (claimCode) {
+    console.log();
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} Everything you create`);
+    console.log(`    with the CP key shares ONE workspace. To keep it all in one shot:`);
+    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}   ${import_chalk6.default.dim("(prompts to claim your workspace into your account)")}`);
+    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${claimCode}  (add --team <name> to merge into an existing team)`));
+  } else if (result.claim_url) {
+    console.log();
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
+    console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
+  }
+  console.log();
+}
+var import_fs2, import_chalk6, import_ora4, VALID_AUTH;
+var init_create = __esm({
+  "src/commands/create.ts"() {
+    "use strict";
+    import_fs2 = __toESM(require("fs"));
+    import_chalk6 = __toESM(require("chalk"));
+    import_ora4 = __toESM(require("ora"));
+    init_auth();
+    init_api();
+    VALID_AUTH = ["api_key", "none", "oauth"];
+  }
+});
+
 // src/lib/trace.ts
 function setVerbose(v) {
   verbose = v;
@@ -529,22 +877,39 @@ async function pickTenant(teamId, opts = {}) {
       q = String(nq ?? "").trim();
       continue;
     }
-    return picked;
+    return picked;
+  }
+}
+async function createTenantInline(teamId) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const { name } = await inquirer2.prompt([{
+      type: "input",
+      name: "name",
+      message: `Tenant name ${import_chalk22.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
+    }]);
+    const slugInput = name.trim();
+    try {
+      const out = await admin({
+        method: "POST",
+        path: `/teams/${encodeURIComponent(teamId)}/tenants`,
+        body: { tenant_name: slugInput, display_name: slugInput },
+        summary: `Create tenant "${slugInput}"`
+      });
+      const slug = out?.tenant_name ?? out?.tenant?.tenant_name ?? slugInput;
+      console.log(import_chalk22.default.green(`  Tenant ${import_chalk22.default.bold(slug)} created.`));
+      return slug;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
+        console.log(import_chalk22.default.yellow(`  "${slugInput}" is not available (tenant names are global): ${msg}`));
+        continue;
+      }
+      throw err;
+    }
   }
 }
-async function createTenantInline(teamId) {
-  const { default: inquirer2 } = await import("inquirer");
-  const { display } = await inquirer2.prompt([{ type: "input", name: "display", message: "Display name for the new tenant:", validate: (s) => !!s.trim() || "required" }]);
-  const out = await admin({
-    method: "POST",
-    path: `/teams/${encodeURIComponent(teamId)}/tenants`,
-    body: { display_name: display.trim() },
-    summary: `Create tenant "${display.trim()}"`
-  });
-  const slug = out?.tenant_name ?? out?.tenant?.tenant_name;
-  console.log(import_chalk22.default.green(`  Tenant ${import_chalk22.default.bold(slug)} created.`));
-  return slug;
-}
 var import_chalk22, import_ora8, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
@@ -562,7 +927,7 @@ var import_commander = require("commander");
 var import_chalk34 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.14.0";
+var version = "0.15.0";
 
 // src/index.ts
 init_types();
@@ -1217,590 +1582,256 @@ async function offerAutoCreate(teamId, port) {
       console.log(import_chalk4.default.dim("  Send it as the X-API-Key header. It may not be shown again."));
     }
   }
-  const targets = await getLocalhostTargets(teamId).catch(() => []);
-  const created = targets.find((t) => t.projectId === result.project_id);
-  if (!created) {
-    console.log(import_chalk4.default.yellow("  Proxy created, but it did not appear as a localhost target \u2014 try `apiblaze dev` again."));
-    return null;
-  }
-  return created;
-}
-function isInternalTarget(url) {
-  if (!url) return false;
-  try {
-    const h = new URL(url).hostname.toLowerCase();
-    return h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "0.0.0.0" || /^127\./.test(h) || /^10\./.test(h) || /^192\.168\./.test(h) || /^169\.254\./.test(h) || /^172\.(1[6-9]|2\d|3[01])\./.test(h);
-  } catch {
-    return false;
-  }
-}
-function printTunnelEndpoints(restore, targets) {
-  if (restore.length === 0) return;
-  console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
-  for (const r of restore) {
-    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
-    console.log(`
-  ${import_chalk4.default.bold(label2)}`);
-    const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
-    const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
-    for (const env of envs) {
-      console.log(`    ${import_chalk4.default.dim("API: ")} ${import_chalk4.default.cyan(`https://${r.projectId}.abz.run/${r.apiVersion}/${env}/`)}`);
-    }
-    if (r.tenant) {
-      console.log(`    ${import_chalk4.default.dim("Portal:")} ${import_chalk4.default.cyan(`https://${r.tenant}.portal.apiblaze.com/${r.apiVersion}`)}`);
-    }
-  }
-}
-async function probeLocalServer(port) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 1500);
-  try {
-    await fetch(`http://127.0.0.1:${port}/`, { method: "HEAD", signal: controller.signal });
-    return true;
-  } catch (err) {
-    if (err?.name === "AbortError") return true;
-    const code = err?.cause?.code;
-    return !(code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH");
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function runDev(options) {
-  const creds = await ensureLoggedIn(!!process.stdin.isTTY);
-  const linked = await resolveLinkedTeam({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
-  if (!linked) {
-    console.error(import_chalk4.default.red("No team available. Run `apiblaze login` to set up your team."));
-    process.exit(1);
-  }
-  const teamId = linked.teamId;
-  if (linked.teamId !== creds.teamId || linked.teamName !== creds.teamName) {
-    saveCredentials({ ...creds, teamId: linked.teamId, teamName: linked.teamName });
-  }
-  if (linked.teamName) {
-    console.log(`${import_chalk4.default.cyan("\u2192")} Team: ${import_chalk4.default.bold(linked.teamName)}`);
-  }
-  let targets;
-  {
-    const spinner = (0, import_ora2.default)("Fetching your localhost projects...").start();
-    try {
-      targets = await getLocalhostTargets(teamId);
-      spinner.stop();
-    } catch (err) {
-      spinner.fail("Failed to fetch projects.");
-      throw err;
-    }
-  }
-  let selectedTargets;
-  if (targets.length === 0) {
-    const created = await offerAutoCreate(teamId, options.port);
-    if (!created) {
-      console.log("Set a project's upstream target to localhost or a private IP, then try again.");
-      process.exit(0);
-    }
-    selectedTargets = [created];
-  } else if (targets.length === 1) {
-    const { confirmed } = await import_inquirer.default.prompt([{
-      type: "confirm",
-      name: "confirmed",
-      message: `Found 1 project with an internal target \u2014 tunnel "${import_chalk4.default.bold(targets[0].projectName)}" (${targets[0].tenantName})?`,
-      default: true
-    }]);
-    if (!confirmed) {
-      console.log("Aborted.");
-      process.exit(0);
-    }
-    selectedTargets = targets;
-  } else {
-    const ALL = "__all__";
-    const { chosen } = await import_inquirer.default.prompt([{
-      type: "list",
-      name: "chosen",
-      message: `Found ${targets.length} projects with an internal target \u2014 pick one to tunnel:`,
-      choices: [
-        ...targets.map((t) => ({
-          name: `${import_chalk4.default.bold(t.projectName)} (${t.tenantName}) \u2014 ${t.target}`,
-          value: t
-        })),
-        new import_inquirer.default.Separator(),
-        { name: `Tunnel all ${targets.length}`, value: ALL }
-      ]
-    }]);
-    selectedTargets = chosen === ALL ? targets : [chosen];
-  }
-  console.log(
-    import_chalk4.default.green(`
-Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
-`)
-  );
-  let recordSink;
-  let captureStream;
-  if (options.captureFile) {
-    captureStream = import_fs.default.createWriteStream(options.captureFile, { flags: "a" });
-    recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
-    console.log(import_chalk4.default.gray(`Streaming full traffic to ${options.captureFile}
-`));
-  }
-  let restore = [];
-  let connect;
-  {
-    const spinner = (0, import_ora2.default)("Registering tunnel with APIblaze...").start();
-    try {
-      const result = await putDevTunnel({
-        targets: selectedTargets.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId }))
-      });
-      restore = result.restore ?? [];
-      connect = result.connect;
-      spinner.succeed("Tunnel registered.");
-    } catch (err) {
-      spinner.fail("Failed to register tunnel.");
-      throw err;
-    }
-  }
-  printTunnelEndpoints(restore, selectedTargets);
-  const clients = connect.projects.map(
-    (projectId) => startTunnelClient({
-      connectUrl: connect.url,
-      token: connect.token,
-      projectId,
-      localPort: options.port,
-      onEntry: (entry) => console.log(formatLogLine(entry)),
-      onStatus: (status) => console.log(import_chalk4.default.gray(`[${projectId}] ${status}`)),
-      onCapture: (req, note) => console.log(formatCapturedRequest(req, note)),
-      onCaptureStart: () => console.log(
-        import_chalk4.default.magenta(`
-\u26B2 No local server on port ${options.port} yet \u2014 capturing requests below. Start your server and they'll forward automatically.
-`)
-      ),
-      onResume: () => console.log(
-        import_chalk4.default.green(`
-\u2713 Local server detected on port ${options.port} \u2014 forwarding resumed.
-`)
-      ),
-      onRecord: recordSink
-    })
-  );
-  const localUp = await probeLocalServer(options.port);
-  console.log("\n" + import_chalk4.default.gray("\u2500".repeat(60)));
-  console.log(import_chalk4.default.bold("Live traffic") + import_chalk4.default.gray(" (Ctrl+C to stop)"));
-  console.log(
-    localUp ? import_chalk4.default.green(`\u2713 Local server detected on port ${options.port} \u2014 forwarding live.`) : import_chalk4.default.magenta(`\u26B2 Nothing listening on port ${options.port} yet \u2014 requests will be captured until your server starts.`)
-  );
-  console.log(import_chalk4.default.gray("\u2500".repeat(60)) + "\n");
-  let isCleaningUp = false;
-  async function cleanup() {
-    if (isCleaningUp) return;
-    isCleaningUp = true;
-    console.log(import_chalk4.default.gray("\n\nShutting down..."));
-    for (const client of clients) client.close();
-    captureStream?.end();
-    await deleteDevTunnel(restore).catch(() => {
-    });
-    console.log(import_chalk4.default.green("Tunnel stopped."));
-    process.exit(0);
-  }
-  process.on("SIGINT", () => void cleanup());
-  process.on("SIGTERM", () => void cleanup());
-  await new Promise(() => {
-  });
-}
-
-// src/commands/projects.ts
-var import_chalk5 = __toESM(require("chalk"));
-var import_ora3 = __toESM(require("ora"));
-init_auth();
-init_api();
-async function runProjects() {
-  const creds = loadCredentials();
-  if (!creds) {
-    console.error(import_chalk5.default.red("Not logged in. Run `apiblaze login` first."));
-    process.exit(1);
-  }
-  if (creds.githubHandle) {
-    console.log(`${import_chalk5.default.cyan("\u2192")} Logged in as ${import_chalk5.default.bold("@" + creds.githubHandle)}`);
-  }
-  let teamId = creds.teamId;
-  let teamName = creds.teamName;
-  if (!teamId) {
-    const teams = await getTeams().catch(() => []);
-    if (teams.length === 1) {
-      teamId = teams[0].teamId;
-      teamName = teams[0].name;
-    } else if (teams.length > 1) {
-      const { default: inquirer2 } = await import("inquirer");
-      const { chosen } = await inquirer2.prompt([{
-        type: "list",
-        name: "chosen",
-        message: "Which team do you want to use?",
-        choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
-      }]);
-      teamId = chosen;
-      teamName = teams.find((t) => t.teamId === chosen)?.name;
-    }
-  }
-  if (!teamId) {
-    console.error(import_chalk5.default.red("No team found. Run `apiblaze login` to set up your team."));
-    process.exit(1);
-  }
-  console.log(`${import_chalk5.default.cyan("\u2192")} Team: ${import_chalk5.default.bold(teamName ?? teamId)}
-`);
-  const spinner = (0, import_ora3.default)("Fetching projects...").start();
-  let projects;
-  try {
-    projects = await getProjects(teamId);
-    spinner.stop();
-  } catch (err) {
-    spinner.fail("Failed to fetch projects.");
-    throw err;
-  }
-  if (projects.length === 0) {
-    console.log(import_chalk5.default.yellow("No projects found for this team."));
-    return;
-  }
-  const width = Math.max(...projects.map((p) => p.projectName.length));
-  for (const p of projects) {
-    console.log(`  ${import_chalk5.default.bold(p.projectName.padEnd(width))}   ${import_chalk5.default.dim("v" + p.apiVersion)}`);
-  }
-  console.log(import_chalk5.default.dim(`
-${projects.length} project${projects.length === 1 ? "" : "s"}`));
-}
-
-// src/commands/create.ts
-var import_fs2 = __toESM(require("fs"));
-var import_chalk6 = __toESM(require("chalk"));
-var import_ora4 = __toESM(require("ora"));
-init_auth();
-init_api();
-function normalizeName(raw) {
-  return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
-}
-function isHttpUrl(s) {
-  try {
-    const u = new URL((s || "").trim());
-    return u.protocol === "http:" || u.protocol === "https:";
-  } catch {
-    return false;
+  const targets = await getLocalhostTargets(teamId).catch(() => []);
+  const created = targets.find((t) => t.projectId === result.project_id);
+  if (!created) {
+    console.log(import_chalk4.default.yellow("  Proxy created, but it did not appear as a localhost target \u2014 try `apiblaze dev` again."));
+    return null;
   }
+  return created;
 }
-function stripTenantFromPortal(devPortal) {
+function isInternalTarget(url) {
+  if (!url) return false;
   try {
-    const u = new URL(devPortal);
-    const dot = u.hostname.indexOf(".");
-    if (dot < 0) return devPortal;
-    const product = u.hostname.slice(0, dot).split("-")[0];
-    u.hostname = `${product}${u.hostname.slice(dot)}`;
-    return u.toString();
+    const h = new URL(url).hostname.toLowerCase();
+    return h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "0.0.0.0" || /^127\./.test(h) || /^10\./.test(h) || /^192\.168\./.test(h) || /^169\.254\./.test(h) || /^172\.(1[6-9]|2\d|3[01])\./.test(h);
   } catch {
-    return devPortal;
+    return false;
   }
 }
-function fail(message) {
-  console.error(import_chalk6.default.red(`Error: ${message}`));
-  process.exit(1);
-}
-function buildTryItCurl(url, authType, apiKey) {
-  if (authType === "api_key") {
-    if (!apiKey) return null;
-    return `curl ${url} -H "X-API-Key: ${apiKey}"`;
+function printTunnelEndpoints(restore, targets) {
+  if (restore.length === 0) return;
+  console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
+  for (const r of restore) {
+    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
+    console.log(`
+  ${import_chalk4.default.bold(label2)}`);
+    const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
+    const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
+    for (const env of envs) {
+      console.log(`    ${import_chalk4.default.dim("API: ")} ${import_chalk4.default.cyan(`https://${r.projectId}.abz.run/${r.apiVersion}/${env}/`)}`);
+    }
+    if (r.tenant) {
+      console.log(`    ${import_chalk4.default.dim("Portal:")} ${import_chalk4.default.cyan(`https://${r.tenant}.portal.apiblaze.com/${r.apiVersion}`)}`);
+    }
   }
-  if (authType === "none") return `curl ${url}`;
-  return null;
 }
-function printCurlExample(url, authType, apiKey, devPortal) {
-  const curl = buildTryItCurl(url, authType, apiKey);
-  console.log();
-  if (curl) {
-    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
-    console.log(`    ${import_chalk6.default.cyan(curl)}`);
-  } else if (authType === "oauth") {
-    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
-    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
+async function probeLocalServer(port) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1500);
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { method: "HEAD", signal: controller.signal });
+    return true;
+  } catch (err) {
+    if (err?.name === "AbortError") return true;
+    const code = err?.cause?.code;
+    return !(code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH");
+  } finally {
+    clearTimeout(timer);
   }
 }
-var VALID_AUTH = ["api_key", "none", "oauth"];
-async function runCreate(opts = {}) {
-  const creds = loadCredentials();
-  if (!creds) {
-    await runAnonymousCreate(opts);
-    return;
+async function runDev(options) {
+  const creds = await ensureLoggedIn(!!process.stdin.isTTY);
+  const linked = await resolveLinkedTeam({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
+  if (!linked) {
+    console.error(import_chalk4.default.red("No team available. Run `apiblaze login` to set up your team."));
+    process.exit(1);
   }
-  const interactive = !!process.stdin.isTTY && !opts.json;
-  const auth = (opts.auth ?? "api_key").toLowerCase();
-  if (!VALID_AUTH.includes(auth)) {
-    fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
+  const teamId = linked.teamId;
+  if (linked.teamId !== creds.teamId || linked.teamName !== creds.teamName) {
+    saveCredentials({ ...creds, teamId: linked.teamId, teamName: linked.teamName });
   }
-  let teamId = creds.teamId;
-  if (opts.team) {
-    if (opts.team.startsWith("team_")) {
-      teamId = opts.team;
-    } else {
-      const teams = await getTeams().catch(() => []);
-      const match = teams.find(
-        (t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase()
-      );
-      if (!match) {
-        fail(`Team "${opts.team}" not found. Run \`apiblaze team\` to see your teams.`);
-      }
-      teamId = match.teamId;
-    }
+  if (linked.teamName) {
+    console.log(`${import_chalk4.default.cyan("\u2192")} Team: ${import_chalk4.default.bold(linked.teamName)}`);
   }
-  if (!opts.json) console.log(import_chalk6.default.bold("\nCreate an API proxy\n"));
-  let name = "";
-  if (opts.name !== void 0) {
-    name = normalizeName(opts.name);
-    if (name.length < 3) fail("Proxy name must be at least 3 characters (letters and digits only).");
-    const check = await checkProxyName(name, teamId, opts.apiversion).catch(() => null);
-    if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
-      fail(`Proxy name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
-    }
-  } else if (interactive) {
-    const { default: inquirer2 } = await import("inquirer");
-    for (; ; ) {
-      const { rawName } = await inquirer2.prompt([{
-        type: "input",
-        name: "rawName",
-        message: "Proxy name (your API will live at <name>.abz.run):",
-        transformer: (v) => normalizeName(v)
-      }]);
-      name = normalizeName(rawName);
-      if (name.length < 3) {
-        console.log(import_chalk6.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
-        continue;
-      }
-      const spinner2 = (0, import_ora4.default)("Checking availability...").start();
-      try {
-        const check = await checkProxyName(name, teamId, opts.apiversion);
-        spinner2.stop();
-        if (!check.canUseProjectName || !check.canUseApiVersion) {
-          console.log(import_chalk6.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
-`));
-          continue;
-        }
-      } catch {
-        spinner2.stop();
-        console.log(import_chalk6.default.dim("  (could not verify availability; continuing)"));
-      }
-      console.log(`${import_chalk6.default.cyan("\u2192")} Your API will live at ${import_chalk6.default.bold(`https://${name}.abz.run`)}
-`);
-      break;
+  let targets;
+  {
+    const spinner = (0, import_ora2.default)("Fetching your localhost projects...").start();
+    try {
+      targets = await getLocalhostTargets(teamId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail("Failed to fetch projects.");
+      throw err;
     }
-  } else {
-    fail("--name is required in non-interactive mode.");
   }
-  let targetUrl = "";
-  if (opts.target !== void 0) {
-    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
-    targetUrl = opts.target.trim();
-  } else if (interactive) {
-    const { default: inquirer2 } = await import("inquirer");
-    for (; ; ) {
-      const { url } = await inquirer2.prompt([{
-        type: "input",
-        name: "url",
-        message: "Target URL to forward requests to (e.g. https://httpbin.org):"
-      }]);
-      if (!isHttpUrl(url)) {
-        console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
-        continue;
-      }
-      targetUrl = url.trim();
-      break;
+  let selectedTargets;
+  if (targets.length === 0) {
+    const created = await offerAutoCreate(teamId, options.port);
+    if (!created) {
+      console.log("Set a project's upstream target to localhost or a private IP, then try again.");
+      process.exit(0);
     }
-  } else {
-    fail("--target is required in non-interactive mode.");
-  }
-  if (interactive && !opts.yes) {
-    const { default: inquirer2 } = await import("inquirer");
-    console.log(`${import_chalk6.default.cyan("\u2192")} Auth: ${import_chalk6.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
-    const { ok } = await inquirer2.prompt([{
+    selectedTargets = [created];
+  } else if (targets.length === 1) {
+    const { confirmed } = await import_inquirer.default.prompt([{
       type: "confirm",
-      name: "ok",
-      message: `Create proxy "${name}" \u2192 ${targetUrl}?`,
+      name: "confirmed",
+      message: `Found 1 project with an internal target \u2014 tunnel "${import_chalk4.default.bold(targets[0].projectName)}" (${targets[0].tenantName})?`,
       default: true
     }]);
-    if (!ok) {
-      console.log(import_chalk6.default.yellow("Cancelled."));
-      return;
-    }
-  }
-  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
-  let result;
-  try {
-    result = await createProxy({ name, target_url: targetUrl, auth_type: auth, team_id: teamId, ...opts.apiversion ? { api_version: opts.apiversion } : {} });
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
-  } catch (err) {
-    spinner?.fail("Failed to create proxy.");
-    throw err;
-  }
-  const version2 = result.api_version || "1.0.0";
-  const keys = result.api_keys ?? {};
-  const adminKey = keys.dev ?? Object.values(keys)[0];
-  const proxyUrl = `https://${name}.abz.run/${version2}/dev`;
-  const devPortal = result.devPortal ? stripTenantFromPortal(result.devPortal) : void 0;
-  if (opts.json) {
-    process.stdout.write(JSON.stringify({
-      project_id: result.project_id,
-      api_version: version2,
-      proxy_url: proxyUrl,
-      dev_portal: devPortal,
-      api_key: adminKey,
-      api_keys: keys,
-      team_id: teamId
-    }) + "\n");
-    return;
-  }
-  console.log();
-  console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(proxyUrl)}`);
-  if (devPortal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(devPortal)}`);
-  if (adminKey) {
-    console.log();
-    console.log(`  ${import_chalk6.default.dim("Consumer admin API key (dev):")}`);
-    console.log(`    ${import_chalk6.default.bold.green(adminKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
-    const otherEnvs = Object.keys(keys).filter((e) => e !== "dev");
-    if (otherEnvs.length) {
-      console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
+    if (!confirmed) {
+      console.log("Aborted.");
+      process.exit(0);
     }
+    selectedTargets = targets;
+  } else {
+    const ALL = "__all__";
+    const { chosen } = await import_inquirer.default.prompt([{
+      type: "list",
+      name: "chosen",
+      message: `Found ${targets.length} projects with an internal target \u2014 pick one to tunnel:`,
+      choices: [
+        ...targets.map((t) => ({
+          name: `${import_chalk4.default.bold(t.projectName)} (${t.tenantName}) \u2014 ${t.target}`,
+          value: t
+        })),
+        new import_inquirer.default.Separator(),
+        { name: `Tunnel all ${targets.length}`, value: ALL }
+      ]
+    }]);
+    selectedTargets = chosen === ALL ? targets : [chosen];
   }
-  printCurlExample(proxyUrl, auth, adminKey, devPortal);
-  console.log();
-}
-async function runAnonymousCreate(opts) {
-  const interactive = !!process.stdin.isTTY && !opts.json;
-  if (!opts.json) {
-    console.log(import_chalk6.default.bold("\nCreate an API proxy"));
-    console.log(import_chalk6.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
+  console.log(
+    import_chalk4.default.green(`
+Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
+`)
+  );
+  let recordSink;
+  let captureStream;
+  if (options.captureFile) {
+    captureStream = import_fs.default.createWriteStream(options.captureFile, { flags: "a" });
+    recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
+    console.log(import_chalk4.default.gray(`Streaming full traffic to ${options.captureFile}
+`));
   }
-  let body = {};
-  if (opts.config) {
-    let raw = "";
-    try {
-      raw = import_fs2.default.readFileSync(opts.config, "utf8");
-    } catch {
-      fail(`Cannot read --config file: ${opts.config}`);
-    }
-    let parsed;
+  let restore = [];
+  let connect;
+  {
+    const spinner = (0, import_ora2.default)("Registering tunnel with APIblaze...").start();
     try {
-      parsed = JSON.parse(raw);
-    } catch {
-      fail(`--config is not valid JSON: ${opts.config}`);
+      const result = await putDevTunnel({
+        targets: selectedTargets.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId }))
+      });
+      restore = result.restore ?? [];
+      connect = result.connect;
+      spinner.succeed("Tunnel registered.");
+    } catch (err) {
+      spinner.fail("Failed to register tunnel.");
+      throw err;
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--config must be a JSON object.");
-    body = parsed;
   }
-  let name = opts.name !== void 0 ? normalizeName(opts.name) : typeof body.name === "string" ? body.name : void 0;
-  if (opts.name !== void 0 && name.length < 3) {
-    fail("Proxy name must be at least 3 characters (letters and digits only).");
+  printTunnelEndpoints(restore, selectedTargets);
+  const clients = connect.projects.map(
+    (projectId) => startTunnelClient({
+      connectUrl: connect.url,
+      token: connect.token,
+      projectId,
+      localPort: options.port,
+      onEntry: (entry) => console.log(formatLogLine(entry)),
+      onStatus: (status) => console.log(import_chalk4.default.gray(`[${projectId}] ${status}`)),
+      onCapture: (req, note) => console.log(formatCapturedRequest(req, note)),
+      onCaptureStart: () => console.log(
+        import_chalk4.default.magenta(`
+\u26B2 No local server on port ${options.port} yet \u2014 capturing requests below. Start your server and they'll forward automatically.
+`)
+      ),
+      onResume: () => console.log(
+        import_chalk4.default.green(`
+\u2713 Local server detected on port ${options.port} \u2014 forwarding resumed.
+`)
+      ),
+      onRecord: recordSink
+    })
+  );
+  const localUp = await probeLocalServer(options.port);
+  console.log("\n" + import_chalk4.default.gray("\u2500".repeat(60)));
+  console.log(import_chalk4.default.bold("Live traffic") + import_chalk4.default.gray(" (Ctrl+C to stop)"));
+  console.log(
+    localUp ? import_chalk4.default.green(`\u2713 Local server detected on port ${options.port} \u2014 forwarding live.`) : import_chalk4.default.magenta(`\u26B2 Nothing listening on port ${options.port} yet \u2014 requests will be captured until your server starts.`)
+  );
+  console.log(import_chalk4.default.gray("\u2500".repeat(60)) + "\n");
+  let isCleaningUp = false;
+  async function cleanup() {
+    if (isCleaningUp) return;
+    isCleaningUp = true;
+    console.log(import_chalk4.default.gray("\n\nShutting down..."));
+    for (const client of clients) client.close();
+    captureStream?.end();
+    await deleteDevTunnel(restore).catch(() => {
+    });
+    console.log(import_chalk4.default.green("Tunnel stopped."));
+    process.exit(0);
   }
-  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
-  let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
-  const hasOtherSource = !!(body.openapi || body.github);
-  if (!target && !hasOtherSource) {
-    if (interactive) {
+  process.on("SIGINT", () => void cleanup());
+  process.on("SIGTERM", () => void cleanup());
+  await new Promise(() => {
+  });
+}
+
+// src/commands/projects.ts
+var import_chalk5 = __toESM(require("chalk"));
+var import_ora3 = __toESM(require("ora"));
+init_auth();
+init_api();
+async function runProjects() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error(import_chalk5.default.red("Not logged in. Run `apiblaze login` first."));
+    process.exit(1);
+  }
+  if (creds.githubHandle) {
+    console.log(`${import_chalk5.default.cyan("\u2192")} Logged in as ${import_chalk5.default.bold("@" + creds.githubHandle)}`);
+  }
+  let teamId = creds.teamId;
+  let teamName = creds.teamName;
+  if (!teamId) {
+    const teams = await getTeams().catch(() => []);
+    if (teams.length === 1) {
+      teamId = teams[0].teamId;
+      teamName = teams[0].name;
+    } else if (teams.length > 1) {
       const { default: inquirer2 } = await import("inquirer");
-      if (name === void 0) {
-        const { rawName } = await inquirer2.prompt([{
-          type: "input",
-          name: "rawName",
-          message: "Proxy name (leave blank to auto-generate):",
-          transformer: (v) => normalizeName(v)
-        }]);
-        const n = normalizeName(rawName);
-        name = n.length >= 3 ? n : void 0;
-      }
-      for (; ; ) {
-        const { url } = await inquirer2.prompt([{
-          type: "input",
-          name: "url",
-          message: "Target URL to forward requests to (e.g. https://httpbin.org):"
-        }]);
-        if (!isHttpUrl(url)) {
-          console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
-          continue;
-        }
-        target = url.trim();
-        break;
-      }
-    } else {
-      fail("A source is required: pass --target, or target/openapi/github in --config.");
+      const { chosen } = await inquirer2.prompt([{
+        type: "list",
+        name: "chosen",
+        message: "Which team do you want to use?",
+        choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
+      }]);
+      teamId = chosen;
+      teamName = teams.find((t) => t.teamId === chosen)?.name;
     }
   }
-  if (target) {
-    body.target = target;
-    body.target_url = target;
-  }
-  if (name) {
-    body.name = name;
-    body.subdomain = name;
+  if (!teamId) {
+    console.error(import_chalk5.default.red("No team found. Run `apiblaze login` to set up your team."));
+    process.exit(1);
   }
-  if (opts.subdomain) body.subdomain = normalizeName(opts.subdomain);
-  if (opts.tenant) body.tenant = normalizeName(opts.tenant);
-  if (opts.product) body.product_slug = normalizeName(opts.product);
-  if (opts.displayName) body.display_name = opts.displayName;
-  if (opts.apiversion) body.api_version = opts.apiversion;
-  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
-  const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
-  if (opts.newSession) clearAnonCred2();
-  const cred = loadAnonCred2();
-  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
-  let result;
+  console.log(`${import_chalk5.default.cyan("\u2192")} Team: ${import_chalk5.default.bold(teamName ?? teamId)}
+`);
+  const spinner = (0, import_ora3.default)("Fetching projects...").start();
+  let projects;
   try {
-    if (cred) {
-      result = await cpFetch2(cred.cp_key, "/projects", { method: "POST", body: JSON.stringify(body) });
-      if (Array.isArray(result.endpoints)) {
-        result.endpoints = result.endpoints.map((e) => e.replace(/:\/\/[^/]+/, `://${result.project_id}.tryabz.run`));
-      }
-    } else {
-      result = await createProxyAnonymous(body);
-      if (result.cp_key && result.team_id) {
-        saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
-      }
-    }
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+    projects = await getProjects(teamId);
+    spinner.stop();
   } catch (err) {
-    spinner?.fail("Failed to create proxy.");
+    spinner.fail("Failed to fetch projects.");
     throw err;
   }
-  const version2 = result.api_version || "1.0.0";
-  const keys = result.api_keys ?? {};
-  const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
-  const prodEndpoint = (result.endpoints || []).find((e) => e.endsWith("/prod")) || (result.endpoints || [])[0];
-  if (opts.json) {
-    process.stdout.write(JSON.stringify({
-      project_id: result.project_id,
-      api_version: version2,
-      endpoints: result.endpoints,
-      api_key: apiKey,
-      api_keys: keys,
-      claim_url: result.claim_url,
-      anonymous: true
-    }) + "\n");
+  if (projects.length === 0) {
+    console.log(import_chalk5.default.yellow("No projects found for this team."));
     return;
   }
-  console.log();
-  if (prodEndpoint) console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(prodEndpoint)}`);
-  if (result.portal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(result.portal)}`);
-  if (apiKey) {
-    console.log();
-    console.log(`  ${import_chalk6.default.dim("API key:")}`);
-    console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
-  }
-  if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
-  const claimCode = result.claim_code || cred?.claim_code;
-  if (claimCode) {
-    console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} Everything you create`);
-    console.log(`    with the CP key shares ONE workspace. To keep it all in one shot:`);
-    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}   ${import_chalk6.default.dim("(prompts to claim your workspace into your account)")}`);
-    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${claimCode}  (add --team <name> to merge into an existing team)`));
-  } else if (result.claim_url) {
-    console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
-    console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
+  const width = Math.max(...projects.map((p) => p.projectName.length));
+  for (const p of projects) {
+    console.log(`  ${import_chalk5.default.bold(p.projectName.padEnd(width))}   ${import_chalk5.default.dim("v" + p.apiVersion)}`);
   }
-  console.log();
+  console.log(import_chalk5.default.dim(`
+${projects.length} project${projects.length === 1 ? "" : "s"}`));
 }
 
+// src/index.ts
+init_create();
+
 // src/commands/claim.ts
 var import_chalk7 = __toESM(require("chalk"));
 init_auth();
@@ -3135,10 +3166,20 @@ async function clientsMenu(teamId, tenant2, base) {
     }]);
     if (pick2 === " back") return;
     if (pick2 === " create") {
-      const projects = await getProjects(teamId).catch(() => []);
+      let projects = await getProjects(teamId).catch(() => []);
       if (!projects.length) {
-        console.log(import_chalk24.default.yellow("  No projects in this team \u2014 create a proxy first."));
-        continue;
+        console.log(import_chalk24.default.yellow("\n  An app client needs a proxy to derive its token identity (iss/aud), and this team has none yet."));
+        const { make } = await inquirer2.prompt([{
+          type: "confirm",
+          name: "make",
+          default: true,
+          message: "Create a proxy now (interactive)?"
+        }]);
+        if (!make) continue;
+        const { runCreate: runCreate2 } = await Promise.resolve().then(() => (init_create(), create_exports));
+        await runCreate2({});
+        projects = await getProjects(teamId).catch(() => []);
+        if (!projects.length) continue;
       }
       const a = await inquirer2.prompt([
         { type: "input", name: "name", message: "Client name:", validate: (s) => !!s.trim() || "required" },
@@ -3404,6 +3445,7 @@ init_auth();
 var import_chalk26 = __toESM(require("chalk"));
 init_admin();
 init_api();
+init_create();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -5350,7 +5392,7 @@ var tenant = program.command("tenant").description("Manage tenants \u2014 bare c
 tenant.command("manage").description("Browse & edit one tenant: settings, login app clients, providers, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
 tenant.command("list").description("List tenants in your team (--q searches server-side)").option("--q <search>", "Filter by tenant name or display name").option("--limit <n>", "Page size (max 200)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
-tenant.command("create").description("Create a tenant in your team").requiredOption("--name <display>", "Display name").option("--slug <tenant_name>", "Explicit tenant slug (generated if omitted)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
+tenant.command("create").description("Create a tenant in your team (tenant names are lowercase alphanumeric and globally unique)").requiredOption("--name <name>", "Tenant name \u2014 becomes the slug ({name}.portal.apiblaze.com) unless --slug overrides; also the display label").option("--slug <tenant_name>", "Explicit tenant slug when it should differ from --name").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",