apiblaze 0.17.20 → 0.17.21

package/dist/index.js

@@ -703,7 +703,7 @@ var import_commander = require("commander");
 var import_chalk38 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.17.20";
+var version = "0.17.21";
 
 // src/index.ts
 init_types();
@@ -4021,9 +4021,85 @@ var SETTINGS = [
     type: "string",
     desc: "Team-scoped tag grouping projects in the consumer portal",
     toPatch: (v) => ({ product_slug: v })
+  },
+  // ── Advanced (specs/missing.md): all optional, default-off; null clears ────
+  {
+    key: "ip_access.mode",
+    label: "IP filter mode",
+    group: "Advanced",
+    type: "enum",
+    enum: ["off", "allow", "deny"],
+    desc: "allow = only listed CIDRs may call; deny = listed CIDRs are blocked",
+    read: (cfg) => dig(cfg, "ip_access.mode") ?? "off",
+    toPatch: (v, cfg) => ({ ip_access: { cidrs: [], ...cfg.ip_access ?? {}, mode: v } })
+  },
+  {
+    key: "ip_access.cidrs",
+    label: "IP filter CIDR list",
+    group: "Advanced",
+    type: "json",
+    desc: 'JSON array of CIDRs (max 100), e.g. ["203.0.113.0/24","2001:db8::/32"]',
+    toPatch: (v, cfg) => ({ ip_access: { mode: "off", ...cfg.ip_access ?? {}, cidrs: v } })
+  },
+  {
+    key: "ip_access.reject_status",
+    label: "IP filter reject status",
+    group: "Advanced",
+    type: "enum",
+    enum: ["403", "404"],
+    desc: "403 = explicit denial; 404 = stealth (looks like no such API)",
+    read: (cfg) => dig(cfg, "ip_access.reject_status") ?? 403,
+    toPatch: (v, cfg) => ({ ip_access: { mode: "off", cidrs: [], ...cfg.ip_access ?? {}, reject_status: Number(v) } })
+  },
+  {
+    key: "upstream_policy.timeout_ms",
+    label: "Upstream timeout (ms)",
+    group: "Advanced",
+    type: "number",
+    desc: "Per-attempt wall clock before the proxy answers 504 (1000\u201390000; default 30000)",
+    read: (cfg) => dig(cfg, "upstream_policy.timeout_ms") ?? 3e4,
+    toPatch: (v, cfg) => ({ upstream_policy: { ...cfg.upstream_policy ?? {}, timeout_ms: v } })
+  },
+  {
+    key: "upstream_policy.retries.max",
+    label: "Upstream retries",
+    group: "Advanced",
+    type: "number",
+    desc: "Extra attempts on 502/503/504/timeouts (0\u20133, idempotent methods only; billing counts the request once)",
+    read: (cfg) => dig(cfg, "upstream_policy.retries.max") ?? 0,
+    toPatch: (v, cfg) => ({ upstream_policy: { ...cfg.upstream_policy ?? {}, retries: { ...cfg.upstream_policy?.retries ?? {}, max: v } } })
+  },
+  {
+    key: "upstream_policy.breaker.enabled",
+    label: "Circuit breaker",
+    group: "Advanced",
+    type: "boolean",
+    desc: "Trip to fast 503s when the upstream is failing; auto-probes to recover",
+    read: (cfg) => dig(cfg, "upstream_policy.breaker.enabled") === true,
+    toPatch: (v, cfg) => ({ upstream_policy: { ...cfg.upstream_policy ?? {}, breaker: { ...cfg.upstream_policy?.breaker ?? {}, enabled: v } } })
+  },
+  {
+    key: "request_validation.mode",
+    label: "Request validation",
+    group: "Advanced",
+    type: "enum",
+    enum: ["off", "report", "enforce"],
+    desc: "Validate requests against your OpenAPI spec: report = log only, enforce = reject 422",
+    read: (cfg) => dig(cfg, "request_validation.mode") ?? "off",
+    toPatch: (v, cfg) => ({ request_validation: { ...cfg.request_validation ?? {}, mode: v } })
+  },
+  {
+    key: "request_validation.unknown_routes",
+    label: "Unknown routes",
+    group: "Advanced",
+    type: "enum",
+    enum: ["forward", "reject"],
+    desc: "What to do when a request matches no spec operation (default forward \u2014 traffic-built specs trail reality)",
+    read: (cfg) => dig(cfg, "request_validation.unknown_routes") ?? "forward",
+    toPatch: (v, cfg) => ({ request_validation: { mode: "off", ...cfg.request_validation ?? {}, unknown_routes: v } })
   }
 ];
-var SETTING_GROUPS = ["Basics", "Traffic & limits", "Access & auth", "Portal & MCP"];
+var SETTING_GROUPS = ["Basics", "Traffic & limits", "Access & auth", "Portal & MCP", "Advanced"];
 var FEATURES = [
   { go: "transforms", label: "Transforms", desc: "Rewrite requests/responses (headers, body fields) without touching your upstream" },
   { go: "mappings", label: "Mapping tables", desc: "Reusable value-mapping tables used by map transforms (values can be hidden/encrypted)" },
@@ -5398,7 +5474,7 @@ async function mintDurableProxyKey(teamId, tenant2) {
   const out = await admin({
     method: "POST",
     path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin/keys`,
-    body: { permissions: ["call", "wallet"], environment: "prod" },
+    body: { permissions: ["call", "use-premium"], environment: "prod" },
     // key_model §2: call the API + spend the team wallet; non-expiring service key
     summary: "Mint a durable data-plane key for apichat"
   });

package/dist/react/index.d.mts

@@ -0,0 +1,32 @@
+import * as React from 'react';
+
+/**
+ * apiblaze/react — <ApiKeyWidget/>. Drop it into resiresi.com; it talks ONLY to your
+ * own backend route (which holds the CP key). Shows the logged-in user their API key
+ * with reveal + regenerate up front and full self-service in an advanced drawer.
+ *
+ *   import { ApiKeyWidget } from 'apiblaze/react';
+ *   <ApiKeyWidget theme={{ accent: '#e11d48' }} />
+ *
+ * `endpoint` defaults to /api/apiblaze/keys (where you mounted createApiblazeKeys().handler).
+ */
+
+interface ApiKeyWidgetTheme {
+    accent?: string;
+    background?: string;
+    surface?: string;
+    text?: string;
+    muted?: string;
+    border?: string;
+    radius?: string;
+}
+interface ApiKeyWidgetProps {
+    endpoint?: string;
+    theme?: ApiKeyWidgetTheme;
+    /** Show the advanced (multi-key) drawer. Default true. */
+    advanced?: boolean;
+    className?: string;
+}
+declare function ApiKeyWidget({ endpoint, theme, advanced, className }: ApiKeyWidgetProps): React.JSX.Element;
+
+export { ApiKeyWidget, type ApiKeyWidgetProps, type ApiKeyWidgetTheme, ApiKeyWidget as default };

package/dist/react/index.d.ts

@@ -0,0 +1,32 @@
+import * as React from 'react';
+
+/**
+ * apiblaze/react — <ApiKeyWidget/>. Drop it into resiresi.com; it talks ONLY to your
+ * own backend route (which holds the CP key). Shows the logged-in user their API key
+ * with reveal + regenerate up front and full self-service in an advanced drawer.
+ *
+ *   import { ApiKeyWidget } from 'apiblaze/react';
+ *   <ApiKeyWidget theme={{ accent: '#e11d48' }} />
+ *
+ * `endpoint` defaults to /api/apiblaze/keys (where you mounted createApiblazeKeys().handler).
+ */
+
+interface ApiKeyWidgetTheme {
+    accent?: string;
+    background?: string;
+    surface?: string;
+    text?: string;
+    muted?: string;
+    border?: string;
+    radius?: string;
+}
+interface ApiKeyWidgetProps {
+    endpoint?: string;
+    theme?: ApiKeyWidgetTheme;
+    /** Show the advanced (multi-key) drawer. Default true. */
+    advanced?: boolean;
+    className?: string;
+}
+declare function ApiKeyWidget({ endpoint, theme, advanced, className }: ApiKeyWidgetProps): React.JSX.Element;
+
+export { ApiKeyWidget, type ApiKeyWidgetProps, type ApiKeyWidgetTheme, ApiKeyWidget as default };

package/dist/react/index.js

@@ -0,0 +1,181 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/react/index.tsx
+var react_exports = {};
+__export(react_exports, {
+  ApiKeyWidget: () => ApiKeyWidget,
+  default: () => react_default
+});
+module.exports = __toCommonJS(react_exports);
+var React = __toESM(require("react"));
+var import_jsx_runtime = require("react/jsx-runtime");
+var DEFAULTS = {
+  accent: "#4f46e5",
+  background: "transparent",
+  surface: "#ffffff",
+  text: "#111827",
+  muted: "#6b7280",
+  border: "#e5e7eb",
+  radius: "12px"
+};
+function ApiKeyWidget({ endpoint = "/api/apiblaze/keys", theme, advanced = true, className }) {
+  const t = { ...DEFAULTS, ...theme ?? {} };
+  const [keys, setKeys] = React.useState(null);
+  const [secret, setSecret] = React.useState(null);
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+  const [open, setOpen] = React.useState(false);
+  const [copied, setCopied] = React.useState(false);
+  const call = React.useCallback(async (body) => {
+    setErr(null);
+    const res = await fetch(endpoint, body ? { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) } : { cache: "no-store" });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Error ${res.status}`);
+    return data;
+  }, [endpoint]);
+  const load = React.useCallback(async () => {
+    try {
+      const d = await call();
+      setKeys(d.keys ?? []);
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "load failed");
+      setKeys([]);
+    }
+  }, [call]);
+  React.useEffect(() => {
+    load();
+  }, [load]);
+  async function create() {
+    setBusy(true);
+    try {
+      const d = await call({ action: "create" });
+      if (d.key) setSecret(d.key);
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "create failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function reveal(keyId) {
+    setBusy(true);
+    try {
+      const d = await call({ action: "reveal", keyId });
+      if (d.key) setSecret(d.key);
+      else setErr("Key not revealable (expired reveal window).");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "reveal failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function rotate(keyId) {
+    setBusy(true);
+    try {
+      const d = await call({ action: "rotate", keyId });
+      if (d.key) setSecret(d.key);
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "regenerate failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function revoke(keyId) {
+    setBusy(true);
+    try {
+      await call({ action: "revoke", keyId });
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "revoke failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  function copy(v) {
+    navigator.clipboard?.writeText(v);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
+  }
+  const vars = {
+    // @ts-expect-error CSS custom props
+    "--abz-accent": t.accent,
+    "--abz-surface": t.surface,
+    "--abz-text": t.text,
+    "--abz-muted": t.muted,
+    "--abz-border": t.border,
+    "--abz-radius": t.radius,
+    background: t.background,
+    color: t.text,
+    fontFamily: "ui-sans-serif, system-ui, sans-serif",
+    fontSize: 14
+  };
+  const card = { background: t.surface, border: `1px solid ${t.border}`, borderRadius: t.radius, padding: 16 };
+  const btn = (primary2 = false) => ({ cursor: busy ? "default" : "pointer", opacity: busy ? 0.6 : 1, border: `1px solid ${primary2 ? t.accent : t.border}`, background: primary2 ? t.accent : "transparent", color: primary2 ? "#fff" : t.text, borderRadius: 8, padding: "8px 14px", fontWeight: 600, fontSize: 13 });
+  const mask = (k) => `${k.key_prefix ?? "\u2022\u2022\u2022"}${"\u2022".repeat(8)}${k.key_suffix ?? "\u2022\u2022\u2022"}`;
+  const primary = (keys ?? []).find((k) => !k.disabled) ?? null;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className, style: vars, children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: card, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 12 }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { style: { fontSize: 15 }, children: "Your API key" }),
+      advanced && (keys?.length ?? 0) > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12 }, onClick: () => setOpen((o) => !o), children: open ? "Hide" : "Advanced" })
+    ] }),
+    err && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: { color: "#b91c1c", fontSize: 13, marginBottom: 10 }, children: err }),
+    secret && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { marginBottom: 12, padding: 12, borderRadius: 8, border: `1px solid ${t.accent}`, background: "rgba(79,70,229,0.06)" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: { fontSize: 12, color: t.muted, marginBottom: 6 }, children: "Copy it now \u2014 it won\u2019t be shown in full again." }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 8, alignItems: "center" }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { style: { flex: 1, wordBreak: "break-all", fontSize: 13 }, children: secret }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn(true), onClick: () => copy(secret), children: copied ? "Copied" : "Copy" })
+      ] })
+    ] }),
+    keys === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: { color: t.muted }, children: "Loading\u2026" }) : primary ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 8, alignItems: "center", flexWrap: "wrap" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { style: { flex: 1, minWidth: 160, color: t.muted }, children: mask(primary) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn(), disabled: busy, onClick: () => reveal(primary.key_id), children: "Reveal" }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn(true), disabled: busy, onClick: () => rotate(primary.key_id), children: "Regenerate" })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn(true), disabled: busy, onClick: create, children: "Generate your API key" }),
+    advanced && open && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { marginTop: 16, borderTop: `1px solid ${t.border}`, paddingTop: 12 }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 8 }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { fontSize: 13, color: t.muted }, children: "All keys" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn(), disabled: busy, onClick: create, children: "+ New key" })
+      ] }),
+      (keys ?? []).length === 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: { color: t.muted, fontSize: 13 }, children: "No keys yet." }),
+      (keys ?? []).map((k) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 8, alignItems: "center", padding: "8px 0", borderBottom: `1px solid ${t.border}` }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { style: { flex: 1, fontSize: 12, color: t.muted }, children: mask(k) }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { fontSize: 11, color: t.muted }, children: k.last_used ? "used" : "unused" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12 }, disabled: busy, onClick: () => reveal(k.key_id), children: "Reveal" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12, borderColor: "#ef4444", color: "#ef4444" }, disabled: busy, onClick: () => revoke(k.key_id), children: "Revoke" })
+      ] }, k.key_id))
+    ] })
+  ] }) });
+}
+var react_default = ApiKeyWidget;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ApiKeyWidget
+});

package/dist/react/index.mjs

@@ -0,0 +1,146 @@
+// src/react/index.tsx
+import * as React from "react";
+import { jsx, jsxs } from "react/jsx-runtime";
+var DEFAULTS = {
+  accent: "#4f46e5",
+  background: "transparent",
+  surface: "#ffffff",
+  text: "#111827",
+  muted: "#6b7280",
+  border: "#e5e7eb",
+  radius: "12px"
+};
+function ApiKeyWidget({ endpoint = "/api/apiblaze/keys", theme, advanced = true, className }) {
+  const t = { ...DEFAULTS, ...theme ?? {} };
+  const [keys, setKeys] = React.useState(null);
+  const [secret, setSecret] = React.useState(null);
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+  const [open, setOpen] = React.useState(false);
+  const [copied, setCopied] = React.useState(false);
+  const call = React.useCallback(async (body) => {
+    setErr(null);
+    const res = await fetch(endpoint, body ? { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) } : { cache: "no-store" });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Error ${res.status}`);
+    return data;
+  }, [endpoint]);
+  const load = React.useCallback(async () => {
+    try {
+      const d = await call();
+      setKeys(d.keys ?? []);
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "load failed");
+      setKeys([]);
+    }
+  }, [call]);
+  React.useEffect(() => {
+    load();
+  }, [load]);
+  async function create() {
+    setBusy(true);
+    try {
+      const d = await call({ action: "create" });
+      if (d.key) setSecret(d.key);
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "create failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function reveal(keyId) {
+    setBusy(true);
+    try {
+      const d = await call({ action: "reveal", keyId });
+      if (d.key) setSecret(d.key);
+      else setErr("Key not revealable (expired reveal window).");
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "reveal failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function rotate(keyId) {
+    setBusy(true);
+    try {
+      const d = await call({ action: "rotate", keyId });
+      if (d.key) setSecret(d.key);
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "regenerate failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function revoke(keyId) {
+    setBusy(true);
+    try {
+      await call({ action: "revoke", keyId });
+      await load();
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : "revoke failed");
+    } finally {
+      setBusy(false);
+    }
+  }
+  function copy(v) {
+    navigator.clipboard?.writeText(v);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
+  }
+  const vars = {
+    // @ts-expect-error CSS custom props
+    "--abz-accent": t.accent,
+    "--abz-surface": t.surface,
+    "--abz-text": t.text,
+    "--abz-muted": t.muted,
+    "--abz-border": t.border,
+    "--abz-radius": t.radius,
+    background: t.background,
+    color: t.text,
+    fontFamily: "ui-sans-serif, system-ui, sans-serif",
+    fontSize: 14
+  };
+  const card = { background: t.surface, border: `1px solid ${t.border}`, borderRadius: t.radius, padding: 16 };
+  const btn = (primary2 = false) => ({ cursor: busy ? "default" : "pointer", opacity: busy ? 0.6 : 1, border: `1px solid ${primary2 ? t.accent : t.border}`, background: primary2 ? t.accent : "transparent", color: primary2 ? "#fff" : t.text, borderRadius: 8, padding: "8px 14px", fontWeight: 600, fontSize: 13 });
+  const mask = (k) => `${k.key_prefix ?? "\u2022\u2022\u2022"}${"\u2022".repeat(8)}${k.key_suffix ?? "\u2022\u2022\u2022"}`;
+  const primary = (keys ?? []).find((k) => !k.disabled) ?? null;
+  return /* @__PURE__ */ jsx("div", { className, style: vars, children: /* @__PURE__ */ jsxs("div", { style: card, children: [
+    /* @__PURE__ */ jsxs("div", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 12 }, children: [
+      /* @__PURE__ */ jsx("strong", { style: { fontSize: 15 }, children: "Your API key" }),
+      advanced && (keys?.length ?? 0) > 0 && /* @__PURE__ */ jsx("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12 }, onClick: () => setOpen((o) => !o), children: open ? "Hide" : "Advanced" })
+    ] }),
+    err && /* @__PURE__ */ jsx("div", { style: { color: "#b91c1c", fontSize: 13, marginBottom: 10 }, children: err }),
+    secret && /* @__PURE__ */ jsxs("div", { style: { marginBottom: 12, padding: 12, borderRadius: 8, border: `1px solid ${t.accent}`, background: "rgba(79,70,229,0.06)" }, children: [
+      /* @__PURE__ */ jsx("div", { style: { fontSize: 12, color: t.muted, marginBottom: 6 }, children: "Copy it now \u2014 it won\u2019t be shown in full again." }),
+      /* @__PURE__ */ jsxs("div", { style: { display: "flex", gap: 8, alignItems: "center" }, children: [
+        /* @__PURE__ */ jsx("code", { style: { flex: 1, wordBreak: "break-all", fontSize: 13 }, children: secret }),
+        /* @__PURE__ */ jsx("button", { style: btn(true), onClick: () => copy(secret), children: copied ? "Copied" : "Copy" })
+      ] })
+    ] }),
+    keys === null ? /* @__PURE__ */ jsx("div", { style: { color: t.muted }, children: "Loading\u2026" }) : primary ? /* @__PURE__ */ jsxs("div", { style: { display: "flex", gap: 8, alignItems: "center", flexWrap: "wrap" }, children: [
+      /* @__PURE__ */ jsx("code", { style: { flex: 1, minWidth: 160, color: t.muted }, children: mask(primary) }),
+      /* @__PURE__ */ jsx("button", { style: btn(), disabled: busy, onClick: () => reveal(primary.key_id), children: "Reveal" }),
+      /* @__PURE__ */ jsx("button", { style: btn(true), disabled: busy, onClick: () => rotate(primary.key_id), children: "Regenerate" })
+    ] }) : /* @__PURE__ */ jsx("button", { style: btn(true), disabled: busy, onClick: create, children: "Generate your API key" }),
+    advanced && open && /* @__PURE__ */ jsxs("div", { style: { marginTop: 16, borderTop: `1px solid ${t.border}`, paddingTop: 12 }, children: [
+      /* @__PURE__ */ jsxs("div", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 8 }, children: [
+        /* @__PURE__ */ jsx("span", { style: { fontSize: 13, color: t.muted }, children: "All keys" }),
+        /* @__PURE__ */ jsx("button", { style: btn(), disabled: busy, onClick: create, children: "+ New key" })
+      ] }),
+      (keys ?? []).length === 0 && /* @__PURE__ */ jsx("div", { style: { color: t.muted, fontSize: 13 }, children: "No keys yet." }),
+      (keys ?? []).map((k) => /* @__PURE__ */ jsxs("div", { style: { display: "flex", gap: 8, alignItems: "center", padding: "8px 0", borderBottom: `1px solid ${t.border}` }, children: [
+        /* @__PURE__ */ jsx("code", { style: { flex: 1, fontSize: 12, color: t.muted }, children: mask(k) }),
+        /* @__PURE__ */ jsx("span", { style: { fontSize: 11, color: t.muted }, children: k.last_used ? "used" : "unused" }),
+        /* @__PURE__ */ jsx("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12 }, disabled: busy, onClick: () => reveal(k.key_id), children: "Reveal" }),
+        /* @__PURE__ */ jsx("button", { style: { ...btn(), padding: "4px 8px", fontSize: 12, borderColor: "#ef4444", color: "#ef4444" }, disabled: busy, onClick: () => revoke(k.key_id), children: "Revoke" })
+      ] }, k.key_id))
+    ] })
+  ] }) });
+}
+var react_default = ApiKeyWidget;
+export {
+  ApiKeyWidget,
+  react_default as default
+};

package/dist/server/index.d.mts

@@ -0,0 +1,74 @@
+/**
+ * apiblaze/server — the server-side half of the API-key widget.
+ *
+ * Holds the producer's CP key (server-only, never shipped to the browser) and turns
+ * a logged-in user into API-key operations against apiblaze.com. The browser widget
+ * (`apiblaze/react`) talks ONLY to your own backend; your backend talks to apiblaze —
+ * so there are no cross-domain cookies, no secrets in the client, and no auth wiring
+ * beyond "read my session."
+ *
+ * Usage (Next.js App Router — app/api/apiblaze/keys/route.ts):
+ *
+ *   import { createApiblazeKeys } from 'apiblaze/server';
+ *   import { auth } from '@/auth';                       // NextAuth, Clerk, anything
+ *
+ *   const keys = createApiblazeKeys({
+ *     cpKey: process.env.APIBLAZE_CP_KEY!,
+ *     getUser: async () => {
+ *       const s = await auth();
+ *       if (!s?.user) return null;
+ *       return { tenant: s.user.orgId ?? s.user.id, userId: s.user.id, email: s.user.email ?? undefined, label: s.user.name ?? undefined };
+ *     },
+ *     resolveScopes: (u) => u.isEngineer ? ['call', 'use-premium'] : ['call'],   // optional
+ *   });
+ *   export const GET = keys.handler;
+ *   export const POST = keys.handler;
+ */
+interface AppUser {
+    /** The producer's stable id for the consumer COMPANY — becomes the tenant (isolation). */
+    tenant: string;
+    /** The producer's stable id for the PERSON — the key creator/owner (list scope). */
+    userId: string;
+    /** Optional, stored now for possible future portal parity. */
+    email?: string;
+    /** Optional display name (cosmetic). */
+    label?: string;
+    /** Any extra fields your resolveScopes wants (e.g. isEngineer). */
+    [k: string]: unknown;
+}
+interface ApiblazeKeysConfig {
+    /** The producer CP key from the apiblaze dashboard Developers section. Server-only. */
+    cpKey: string;
+    /** Return the logged-in user from the request/session, or null if unauthenticated. */
+    getUser: (req: Request) => Promise<AppUser | null> | AppUser | null;
+    /** Permission set to mint for a user. Default ['call']. Server-side only, so a browser
+     *  can never escalate — return more for your own engineers here. */
+    resolveScopes?: (user: AppUser) => string[] | Promise<string[]>;
+    /** Default expiry for minted keys (seconds); enables re-reveal. Default 1 year. */
+    keyExpiresInSeconds?: number;
+    /** Override the apiblaze base (tests/self-host). Default https://apikeys.apiblaze.com */
+    base?: string;
+}
+type Action = {
+    action: 'list';
+} | {
+    action: 'create';
+} | {
+    action: 'reveal';
+    keyId: string;
+} | {
+    action: 'rotate';
+    keyId: string;
+} | {
+    action: 'revoke';
+    keyId: string;
+};
+declare function createApiblazeKeys(cfg: ApiblazeKeysConfig): {
+    handler: (req: Request) => Promise<Response>;
+    run: (user: AppUser, op: Action) => Promise<{
+        status: number;
+        data: unknown;
+    }>;
+};
+
+export { type ApiblazeKeysConfig, type AppUser, createApiblazeKeys };

package/dist/server/index.d.ts

@@ -0,0 +1,74 @@
+/**
+ * apiblaze/server — the server-side half of the API-key widget.
+ *
+ * Holds the producer's CP key (server-only, never shipped to the browser) and turns
+ * a logged-in user into API-key operations against apiblaze.com. The browser widget
+ * (`apiblaze/react`) talks ONLY to your own backend; your backend talks to apiblaze —
+ * so there are no cross-domain cookies, no secrets in the client, and no auth wiring
+ * beyond "read my session."
+ *
+ * Usage (Next.js App Router — app/api/apiblaze/keys/route.ts):
+ *
+ *   import { createApiblazeKeys } from 'apiblaze/server';
+ *   import { auth } from '@/auth';                       // NextAuth, Clerk, anything
+ *
+ *   const keys = createApiblazeKeys({
+ *     cpKey: process.env.APIBLAZE_CP_KEY!,
+ *     getUser: async () => {
+ *       const s = await auth();
+ *       if (!s?.user) return null;
+ *       return { tenant: s.user.orgId ?? s.user.id, userId: s.user.id, email: s.user.email ?? undefined, label: s.user.name ?? undefined };
+ *     },
+ *     resolveScopes: (u) => u.isEngineer ? ['call', 'use-premium'] : ['call'],   // optional
+ *   });
+ *   export const GET = keys.handler;
+ *   export const POST = keys.handler;
+ */
+interface AppUser {
+    /** The producer's stable id for the consumer COMPANY — becomes the tenant (isolation). */
+    tenant: string;
+    /** The producer's stable id for the PERSON — the key creator/owner (list scope). */
+    userId: string;
+    /** Optional, stored now for possible future portal parity. */
+    email?: string;
+    /** Optional display name (cosmetic). */
+    label?: string;
+    /** Any extra fields your resolveScopes wants (e.g. isEngineer). */
+    [k: string]: unknown;
+}
+interface ApiblazeKeysConfig {
+    /** The producer CP key from the apiblaze dashboard Developers section. Server-only. */
+    cpKey: string;
+    /** Return the logged-in user from the request/session, or null if unauthenticated. */
+    getUser: (req: Request) => Promise<AppUser | null> | AppUser | null;
+    /** Permission set to mint for a user. Default ['call']. Server-side only, so a browser
+     *  can never escalate — return more for your own engineers here. */
+    resolveScopes?: (user: AppUser) => string[] | Promise<string[]>;
+    /** Default expiry for minted keys (seconds); enables re-reveal. Default 1 year. */
+    keyExpiresInSeconds?: number;
+    /** Override the apiblaze base (tests/self-host). Default https://apikeys.apiblaze.com */
+    base?: string;
+}
+type Action = {
+    action: 'list';
+} | {
+    action: 'create';
+} | {
+    action: 'reveal';
+    keyId: string;
+} | {
+    action: 'rotate';
+    keyId: string;
+} | {
+    action: 'revoke';
+    keyId: string;
+};
+declare function createApiblazeKeys(cfg: ApiblazeKeysConfig): {
+    handler: (req: Request) => Promise<Response>;
+    run: (user: AppUser, op: Action) => Promise<{
+        status: number;
+        data: unknown;
+    }>;
+};
+
+export { type ApiblazeKeysConfig, type AppUser, createApiblazeKeys };

package/dist/server/index.js

@@ -0,0 +1,127 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  createApiblazeKeys: () => createApiblazeKeys
+});
+module.exports = __toCommonJS(server_exports);
+var YEAR = 365 * 24 * 60 * 60;
+function createApiblazeKeys(cfg) {
+  const base = (cfg.base ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const expiresIn = cfg.keyExpiresInSeconds ?? YEAR;
+  const tenantCache = /* @__PURE__ */ new Map();
+  function planeFetch(method, path, user, opts = {}) {
+    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
+    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
+    if (user.email) headers["X-End-User-Email"] = String(user.email);
+    let body;
+    if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    return fetch(`${base}${path}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+  }
+  async function resolveTenant(user) {
+    const cached = tenantCache.get(user.tenant);
+    if (cached) return cached;
+    const res = await planeFetch("POST", "/tenants", user, { body: { ref: user.tenant } });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { tenant } = await res.json();
+    tenantCache.set(user.tenant, tenant);
+    return tenant;
+  }
+  async function run(user, op) {
+    const tenant = await resolveTenant(user);
+    switch (op.action) {
+      case "list": {
+        const r = await planeFetch("GET", "/apikeys", user, { query: { tenant, limit: "200" } });
+        const d = await r.json();
+        return { status: r.status, data: { keys: d.keys ?? [] } };
+      }
+      case "create": {
+        const permissions = await cfg.resolveScopes?.(user) ?? ["call"];
+        const r = await planeFetch("POST", "/apikeys", user, { body: { tenant, permissions, environment: "prod", expires_in_seconds: expiresIn } });
+        const d = await r.json();
+        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      }
+      case "reveal": {
+        const r = await planeFetch("GET", `/apikeys/${encodeURIComponent(op.keyId)}/reveal`, user, { query: { tenant } });
+        return { status: r.status, data: await r.json().catch(() => ({})) };
+      }
+      case "rotate": {
+        const r = await planeFetch("POST", `/apikeys/${encodeURIComponent(op.keyId)}/rotate`, user, { body: { tenant } });
+        const d = await r.json();
+        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      }
+      case "revoke": {
+        const r = await planeFetch("DELETE", `/apikeys/${encodeURIComponent(op.keyId)}`, user, { query: { tenant } });
+        return { status: r.status, data: r.status < 300 ? { ok: true } : await r.json().catch(() => ({})) };
+      }
+    }
+  }
+  async function handler(req) {
+    let user;
+    try {
+      user = await cfg.getUser(req);
+    } catch {
+      user = null;
+    }
+    if (!user || !user.tenant || !user.userId) return json({ error: "Unauthorized" }, 401);
+    let op;
+    if (req.method === "GET") op = { action: "list" };
+    else {
+      const raw = await req.json().catch(() => ({}));
+      const a = raw.action ?? "create";
+      if ((a === "reveal" || a === "rotate" || a === "revoke") && !raw.keyId) return json({ error: "keyId required" }, 400);
+      op = { action: a, keyId: raw.keyId };
+    }
+    try {
+      const { status, data } = await run(user, op);
+      return json(data, status >= 400 ? status : op.action === "create" ? 201 : 200);
+    } catch (e) {
+      if (e instanceof PlaneError) return json({ error: e.detail }, e.status);
+      return json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  }
+  return { handler, run };
+}
+var PlaneError = class extends Error {
+  constructor(status, detail) {
+    super(detail);
+    this.status = status;
+    this.detail = detail;
+  }
+};
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createApiblazeKeys
+});

package/dist/server/index.mjs

@@ -0,0 +1,102 @@
+// src/server/index.ts
+var YEAR = 365 * 24 * 60 * 60;
+function createApiblazeKeys(cfg) {
+  const base = (cfg.base ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const expiresIn = cfg.keyExpiresInSeconds ?? YEAR;
+  const tenantCache = /* @__PURE__ */ new Map();
+  function planeFetch(method, path, user, opts = {}) {
+    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
+    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
+    if (user.email) headers["X-End-User-Email"] = String(user.email);
+    let body;
+    if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    return fetch(`${base}${path}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+  }
+  async function resolveTenant(user) {
+    const cached = tenantCache.get(user.tenant);
+    if (cached) return cached;
+    const res = await planeFetch("POST", "/tenants", user, { body: { ref: user.tenant } });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { tenant } = await res.json();
+    tenantCache.set(user.tenant, tenant);
+    return tenant;
+  }
+  async function run(user, op) {
+    const tenant = await resolveTenant(user);
+    switch (op.action) {
+      case "list": {
+        const r = await planeFetch("GET", "/apikeys", user, { query: { tenant, limit: "200" } });
+        const d = await r.json();
+        return { status: r.status, data: { keys: d.keys ?? [] } };
+      }
+      case "create": {
+        const permissions = await cfg.resolveScopes?.(user) ?? ["call"];
+        const r = await planeFetch("POST", "/apikeys", user, { body: { tenant, permissions, environment: "prod", expires_in_seconds: expiresIn } });
+        const d = await r.json();
+        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      }
+      case "reveal": {
+        const r = await planeFetch("GET", `/apikeys/${encodeURIComponent(op.keyId)}/reveal`, user, { query: { tenant } });
+        return { status: r.status, data: await r.json().catch(() => ({})) };
+      }
+      case "rotate": {
+        const r = await planeFetch("POST", `/apikeys/${encodeURIComponent(op.keyId)}/rotate`, user, { body: { tenant } });
+        const d = await r.json();
+        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      }
+      case "revoke": {
+        const r = await planeFetch("DELETE", `/apikeys/${encodeURIComponent(op.keyId)}`, user, { query: { tenant } });
+        return { status: r.status, data: r.status < 300 ? { ok: true } : await r.json().catch(() => ({})) };
+      }
+    }
+  }
+  async function handler(req) {
+    let user;
+    try {
+      user = await cfg.getUser(req);
+    } catch {
+      user = null;
+    }
+    if (!user || !user.tenant || !user.userId) return json({ error: "Unauthorized" }, 401);
+    let op;
+    if (req.method === "GET") op = { action: "list" };
+    else {
+      const raw = await req.json().catch(() => ({}));
+      const a = raw.action ?? "create";
+      if ((a === "reveal" || a === "rotate" || a === "revoke") && !raw.keyId) return json({ error: "keyId required" }, 400);
+      op = { action: a, keyId: raw.keyId };
+    }
+    try {
+      const { status, data } = await run(user, op);
+      return json(data, status >= 400 ? status : op.action === "create" ? 201 : 200);
+    } catch (e) {
+      if (e instanceof PlaneError) return json({ error: e.detail }, e.status);
+      return json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  }
+  return { handler, run };
+}
+var PlaneError = class extends Error {
+  constructor(status, detail) {
+    super(detail);
+    this.status = status;
+    this.detail = detail;
+  }
+};
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
+}
+export {
+  createApiblazeKeys
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "apiblaze",
-  "version": "0.17.20",
-  "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
+  "version": "0.17.21",
+  "description": "APIblaze CLI \u2014 Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",
     "dev-tunnel",
@@ -25,6 +25,18 @@
       "import": "./dist/sidecar/index.mjs",
       "require": "./dist/sidecar/index.js",
       "default": "./dist/sidecar/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.mjs",
+      "require": "./dist/server/index.js",
+      "default": "./dist/server/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.mjs",
+      "require": "./dist/react/index.js",
+      "default": "./dist/react/index.js"
     }
   },
   "files": [
@@ -54,6 +66,16 @@
     "@types/node": "^20.0.0",
     "@types/ws": "^8.5.10",
     "tsup": "^8.0.0",
-    "typescript": "^5.4.0"
+    "typescript": "^5.4.0",
+    "@types/react": "^18.2.0",
+    "react": "^18.2.0"
+  },
+  "peerDependencies": {
+    "react": ">=17"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
   }
 }