apiblaze 0.17.21 → 0.17.23

package/dist/server/index.js

@@ -20,15 +20,38 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  PlaneError: () => PlaneError,
+  createApiblazeGroups: () => createApiblazeGroups,
   createApiblazeKeys: () => createApiblazeKeys
 });
 module.exports = __toCommonJS(server_exports);
-var YEAR = 365 * 24 * 60 * 60;
-function createApiblazeKeys(cfg) {
-  const base = (cfg.base ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
-  const expiresIn = cfg.keyExpiresInSeconds ?? YEAR;
+
+// src/server/core.ts
+var PlaneError = class extends Error {
+  constructor(status, detail) {
+    super(detail);
+    this.status = status;
+    this.detail = detail;
+  }
+};
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
+}
+function createPlaneCore(cfg) {
+  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
+  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
   const tenantCache = /* @__PURE__ */ new Map();
-  function planeFetch(method, path, user, opts = {}) {
+  const endUserCache = /* @__PURE__ */ new Map();
+  function planeFetch(base, method, path, user, opts = {}) {
     const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
     const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
     if (user.email) headers["X-End-User-Email"] = String(user.email);
@@ -42,26 +65,191 @@ function createApiblazeKeys(cfg) {
   async function resolveTenant(user) {
     const cached = tenantCache.get(user.tenant);
     if (cached) return cached;
-    const res = await planeFetch("POST", "/tenants", user, { body: { ref: user.tenant } });
+    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
     if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
     const { tenant } = await res.json();
     tenantCache.set(user.tenant, tenant);
     return tenant;
   }
+  async function ensureEndUser(user, tenant) {
+    const cacheKey = `${tenant}:${user.userId}`;
+    const cached = endUserCache.get(cacheKey);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
+      body: { tenant, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
+    });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { abz_sub } = await res.json();
+    endUserCache.set(cacheKey, abz_sub);
+    return abz_sub;
+  }
+  return { planeFetch, resolveTenant, ensureEndUser, apikeysBase, iamBase };
+}
+
+// src/server/groups.ts
+function createApiblazeGroups(cfg) {
+  if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId, email }.");
+  const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base, iamBase: cfg.iamBase });
+  const iam = (method, path, user, tenant, body) => core.planeFetch(core.iamBase, method, `/v1/admin${path}`, user, { query: { tenant }, body });
+  async function context(user) {
+    const tenant = await core.resolveTenant(user);
+    await core.ensureEndUser(user, tenant);
+    return { tenant };
+  }
+  async function pass(r) {
+    if (r.status === 204) return { status: 200, data: { ok: true } };
+    return { status: r.status, data: await r.json().catch(() => ({})) };
+  }
   async function run(user, op) {
-    const tenant = await resolveTenant(user);
+    const { tenant } = await context(user);
+    if (op.action === "snapshot") {
+      const [groupsRes, usersRes, observedRes] = await Promise.all([
+        iam("GET", "/groups", user, tenant),
+        iam("GET", "/users", user, tenant),
+        iam("GET", "/observed-identities", user, tenant)
+      ]);
+      if (groupsRes.status === 403) return { status: 200, data: { access: "pending", groups: [], users: [], observed: [] } };
+      if (!groupsRes.ok) return { status: groupsRes.status, data: { error: await safeErr(groupsRes) } };
+      const g = await groupsRes.json();
+      const u = usersRes.ok ? await usersRes.json() : { users: [] };
+      const o = observedRes.ok ? await observedRes.json() : {};
+      return {
+        status: 200,
+        data: { access: "ok", groups: g.groups ?? [], users: u.users ?? [], observed: o.identities ?? o.observed ?? [] }
+      };
+    }
     switch (op.action) {
-      case "list": {
-        const r = await planeFetch("GET", "/apikeys", user, { query: { tenant, limit: "200" } });
-        const d = await r.json();
-        return { status: r.status, data: { keys: d.keys ?? [] } };
+      case "group-detail": {
+        const [detail, subs] = await Promise.all([
+          iam("GET", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant),
+          iam("GET", `/groups/${encodeURIComponent(op.groupId)}/subgroups`, user, tenant)
+        ]);
+        if (!detail.ok) return pass(detail);
+        const d = await detail.json();
+        const s = subs.ok ? await subs.json() : { subgroups: [] };
+        return { status: 200, data: { ...d, subgroups: s.subgroups ?? [] } };
       }
-      case "create": {
-        const permissions = await cfg.resolveScopes?.(user) ?? ["call"];
-        const r = await planeFetch("POST", "/apikeys", user, { body: { tenant, permissions, environment: "prod", expires_in_seconds: expiresIn } });
-        const d = await r.json();
-        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      case "create-group":
+        return pass(await iam("POST", "/groups", user, tenant, {
+          name: op.name,
+          description: op.description,
+          admins: [await core.ensureEndUser(user, tenant)]
+        }));
+      case "rename-group":
+        return pass(await iam("PATCH", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant, {
+          name: op.name,
+          description: op.description
+        }));
+      case "delete-group":
+        return pass(await iam("DELETE", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant));
+      case "add-member":
+        return pass(await iam("POST", `/groups/${encodeURIComponent(op.groupId)}/members`, user, tenant, {
+          abz_sub: op.abzSub,
+          role: op.role ?? "member"
+        }));
+      case "change-role":
+        return pass(await iam("PATCH", `/groups/${encodeURIComponent(op.groupId)}/members/_`, user, tenant, {
+          abz_sub: op.abzSub,
+          role: op.role
+        }));
+      case "remove-member":
+        return pass(await core.planeFetch(
+          core.iamBase,
+          "DELETE",
+          `/v1/admin/groups/${encodeURIComponent(op.groupId)}/members/_`,
+          user,
+          { query: { tenant, abz_sub: op.abzSub } }
+        ));
+      case "add-subgroup":
+        return pass(await iam("POST", `/groups/${encodeURIComponent(op.groupId)}/subgroups`, user, tenant, {
+          child_group_id: op.childGroupId
+        }));
+      case "remove-subgroup":
+        return pass(await iam("DELETE", `/groups/${encodeURIComponent(op.groupId)}/subgroups/${encodeURIComponent(op.childGroupId)}`, user, tenant));
+      case "provision-observed":
+        return pass(await iam("POST", "/identities/upsert", user, tenant, {
+          consumer_user_id: op.consumerUserId,
+          email: op.email,
+          display_name: op.displayName,
+          groups: op.groups ?? []
+        }));
+    }
+  }
+  async function handler(req) {
+    let user;
+    try {
+      user = await cfg.getUser(req);
+    } catch {
+      user = null;
+    }
+    if (!user || !user.tenant || !user.userId) return json({ error: "Unauthorized" }, 401);
+    let op;
+    if (req.method === "GET") op = { action: "snapshot" };
+    else op = await req.json().catch(() => ({}));
+    if (!op || typeof op.action !== "string") return json({ error: "action required" }, 400);
+    try {
+      const { status, data } = await run(user, op);
+      return json(data, status);
+    } catch (e) {
+      if (e instanceof PlaneError) return json({ error: e.detail }, e.status);
+      return json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  }
+  return { handler, run };
+}
+
+// src/server/index.ts
+function createApiblazeKeys(cfg) {
+  if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId }.");
+  const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base });
+  const base = core.apikeysBase;
+  const expiresIn = cfg.keyExpiresInSeconds;
+  const planeFetch = (method, path, user, opts = {}) => core.planeFetch(base, method, path, user, opts);
+  const resolveTenant = (user) => core.resolveTenant(user);
+  async function allowedTypesFor(user) {
+    const raw = cfg.resolveKeyTypes ? await cfg.resolveKeyTypes(user) : user.keyTypes;
+    if (raw === false) return false;
+    if (Array.isArray(raw)) return raw.length === 0 ? false : raw;
+    return ["call-only"];
+  }
+  async function catalogNames(user, tenant) {
+    const r = await planeFetch("GET", "/key-types", user, { query: { tenant } });
+    if (!r.ok) return [];
+    const d = await r.json();
+    return (d.key_types ?? []).map((t) => t.name).filter((n) => typeof n === "string");
+  }
+  async function run(user, op) {
+    if (op.action === "list") {
+      const allowed = await allowedTypesFor(user);
+      if (allowed === false) return { status: 200, data: { keys: [], keyTypes: [], access: "denied" } };
+      const tenant2 = await resolveTenant(user);
+      const [listRes, catalog] = await Promise.all([
+        planeFetch("GET", "/apikeys", user, { query: { tenant: tenant2, limit: "200" } }),
+        catalogNames(user, tenant2)
+      ]);
+      const d = await listRes.json();
+      const eligible = allowed.filter((t) => catalog.includes(t));
+      return { status: listRes.status, data: { keys: d.keys ?? [], keyTypes: eligible, access: "ok" } };
+    }
+    if (op.action === "create") {
+      const allowed = await allowedTypesFor(user);
+      if (allowed === false) return { status: 403, data: { error: "You do not have API access.", access: "denied" } };
+      const tenant2 = await resolveTenant(user);
+      const catalog = await catalogNames(user, tenant2);
+      const eligible = allowed.filter((t) => catalog.includes(t));
+      if (eligible.length === 0) return { status: 409, data: { error: "No key types are available for your account." } };
+      if (op.keyType && !eligible.includes(op.keyType)) {
+        return { status: 403, data: { error: "You are not allowed to create that key type." } };
       }
+      const chosen = op.keyType ?? (eligible.includes("call-only") ? "call-only" : eligible[0]);
+      const body = { tenant: tenant2, key_type_ids: [chosen], environment: "prod" };
+      if (typeof expiresIn === "number" && expiresIn > 0) body.expires_in_seconds = expiresIn;
+      const r = await planeFetch("POST", "/apikeys", user, { body });
+      const d = await r.json();
+      return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+    }
+    const tenant = await resolveTenant(user);
+    switch (op.action) {
       case "reveal": {
         const r = await planeFetch("GET", `/apikeys/${encodeURIComponent(op.keyId)}/reveal`, user, { query: { tenant } });
         return { status: r.status, data: await r.json().catch(() => ({})) };
@@ -91,7 +279,7 @@ function createApiblazeKeys(cfg) {
       const raw = await req.json().catch(() => ({}));
       const a = raw.action ?? "create";
       if ((a === "reveal" || a === "rotate" || a === "revoke") && !raw.keyId) return json({ error: "keyId required" }, 400);
-      op = { action: a, keyId: raw.keyId };
+      op = { action: a, keyId: raw.keyId, keyType: raw.keyType };
     }
     try {
       const { status, data } = await run(user, op);
@@ -103,25 +291,9 @@ function createApiblazeKeys(cfg) {
   }
   return { handler, run };
 }
-var PlaneError = class extends Error {
-  constructor(status, detail) {
-    super(detail);
-    this.status = status;
-    this.detail = detail;
-  }
-};
-async function safeErr(res) {
-  try {
-    const b = await res.json();
-    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
-  } catch {
-    return `apiblaze ${res.status}`;
-  }
-}
-function json(data, status = 200) {
-  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  PlaneError,
+  createApiblazeGroups,
   createApiblazeKeys
 });

package/dist/server/index.mjs

@@ -1,10 +1,29 @@
-// src/server/index.ts
-var YEAR = 365 * 24 * 60 * 60;
-function createApiblazeKeys(cfg) {
-  const base = (cfg.base ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
-  const expiresIn = cfg.keyExpiresInSeconds ?? YEAR;
+// src/server/core.ts
+var PlaneError = class extends Error {
+  constructor(status, detail) {
+    super(detail);
+    this.status = status;
+    this.detail = detail;
+  }
+};
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
+}
+function createPlaneCore(cfg) {
+  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
+  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
   const tenantCache = /* @__PURE__ */ new Map();
-  function planeFetch(method, path, user, opts = {}) {
+  const endUserCache = /* @__PURE__ */ new Map();
+  function planeFetch(base, method, path, user, opts = {}) {
     const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
     const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
     if (user.email) headers["X-End-User-Email"] = String(user.email);
@@ -18,26 +37,191 @@ function createApiblazeKeys(cfg) {
   async function resolveTenant(user) {
     const cached = tenantCache.get(user.tenant);
     if (cached) return cached;
-    const res = await planeFetch("POST", "/tenants", user, { body: { ref: user.tenant } });
+    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
     if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
     const { tenant } = await res.json();
     tenantCache.set(user.tenant, tenant);
     return tenant;
   }
+  async function ensureEndUser(user, tenant) {
+    const cacheKey = `${tenant}:${user.userId}`;
+    const cached = endUserCache.get(cacheKey);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
+      body: { tenant, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
+    });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { abz_sub } = await res.json();
+    endUserCache.set(cacheKey, abz_sub);
+    return abz_sub;
+  }
+  return { planeFetch, resolveTenant, ensureEndUser, apikeysBase, iamBase };
+}
+
+// src/server/groups.ts
+function createApiblazeGroups(cfg) {
+  if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId, email }.");
+  const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base, iamBase: cfg.iamBase });
+  const iam = (method, path, user, tenant, body) => core.planeFetch(core.iamBase, method, `/v1/admin${path}`, user, { query: { tenant }, body });
+  async function context(user) {
+    const tenant = await core.resolveTenant(user);
+    await core.ensureEndUser(user, tenant);
+    return { tenant };
+  }
+  async function pass(r) {
+    if (r.status === 204) return { status: 200, data: { ok: true } };
+    return { status: r.status, data: await r.json().catch(() => ({})) };
+  }
   async function run(user, op) {
-    const tenant = await resolveTenant(user);
+    const { tenant } = await context(user);
+    if (op.action === "snapshot") {
+      const [groupsRes, usersRes, observedRes] = await Promise.all([
+        iam("GET", "/groups", user, tenant),
+        iam("GET", "/users", user, tenant),
+        iam("GET", "/observed-identities", user, tenant)
+      ]);
+      if (groupsRes.status === 403) return { status: 200, data: { access: "pending", groups: [], users: [], observed: [] } };
+      if (!groupsRes.ok) return { status: groupsRes.status, data: { error: await safeErr(groupsRes) } };
+      const g = await groupsRes.json();
+      const u = usersRes.ok ? await usersRes.json() : { users: [] };
+      const o = observedRes.ok ? await observedRes.json() : {};
+      return {
+        status: 200,
+        data: { access: "ok", groups: g.groups ?? [], users: u.users ?? [], observed: o.identities ?? o.observed ?? [] }
+      };
+    }
     switch (op.action) {
-      case "list": {
-        const r = await planeFetch("GET", "/apikeys", user, { query: { tenant, limit: "200" } });
-        const d = await r.json();
-        return { status: r.status, data: { keys: d.keys ?? [] } };
+      case "group-detail": {
+        const [detail, subs] = await Promise.all([
+          iam("GET", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant),
+          iam("GET", `/groups/${encodeURIComponent(op.groupId)}/subgroups`, user, tenant)
+        ]);
+        if (!detail.ok) return pass(detail);
+        const d = await detail.json();
+        const s = subs.ok ? await subs.json() : { subgroups: [] };
+        return { status: 200, data: { ...d, subgroups: s.subgroups ?? [] } };
       }
-      case "create": {
-        const permissions = await cfg.resolveScopes?.(user) ?? ["call"];
-        const r = await planeFetch("POST", "/apikeys", user, { body: { tenant, permissions, environment: "prod", expires_in_seconds: expiresIn } });
-        const d = await r.json();
-        return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+      case "create-group":
+        return pass(await iam("POST", "/groups", user, tenant, {
+          name: op.name,
+          description: op.description,
+          admins: [await core.ensureEndUser(user, tenant)]
+        }));
+      case "rename-group":
+        return pass(await iam("PATCH", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant, {
+          name: op.name,
+          description: op.description
+        }));
+      case "delete-group":
+        return pass(await iam("DELETE", `/groups/${encodeURIComponent(op.groupId)}`, user, tenant));
+      case "add-member":
+        return pass(await iam("POST", `/groups/${encodeURIComponent(op.groupId)}/members`, user, tenant, {
+          abz_sub: op.abzSub,
+          role: op.role ?? "member"
+        }));
+      case "change-role":
+        return pass(await iam("PATCH", `/groups/${encodeURIComponent(op.groupId)}/members/_`, user, tenant, {
+          abz_sub: op.abzSub,
+          role: op.role
+        }));
+      case "remove-member":
+        return pass(await core.planeFetch(
+          core.iamBase,
+          "DELETE",
+          `/v1/admin/groups/${encodeURIComponent(op.groupId)}/members/_`,
+          user,
+          { query: { tenant, abz_sub: op.abzSub } }
+        ));
+      case "add-subgroup":
+        return pass(await iam("POST", `/groups/${encodeURIComponent(op.groupId)}/subgroups`, user, tenant, {
+          child_group_id: op.childGroupId
+        }));
+      case "remove-subgroup":
+        return pass(await iam("DELETE", `/groups/${encodeURIComponent(op.groupId)}/subgroups/${encodeURIComponent(op.childGroupId)}`, user, tenant));
+      case "provision-observed":
+        return pass(await iam("POST", "/identities/upsert", user, tenant, {
+          consumer_user_id: op.consumerUserId,
+          email: op.email,
+          display_name: op.displayName,
+          groups: op.groups ?? []
+        }));
+    }
+  }
+  async function handler(req) {
+    let user;
+    try {
+      user = await cfg.getUser(req);
+    } catch {
+      user = null;
+    }
+    if (!user || !user.tenant || !user.userId) return json({ error: "Unauthorized" }, 401);
+    let op;
+    if (req.method === "GET") op = { action: "snapshot" };
+    else op = await req.json().catch(() => ({}));
+    if (!op || typeof op.action !== "string") return json({ error: "action required" }, 400);
+    try {
+      const { status, data } = await run(user, op);
+      return json(data, status);
+    } catch (e) {
+      if (e instanceof PlaneError) return json({ error: e.detail }, e.status);
+      return json({ error: e instanceof Error ? e.message : "Unknown error" }, 500);
+    }
+  }
+  return { handler, run };
+}
+
+// src/server/index.ts
+function createApiblazeKeys(cfg) {
+  if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId }.");
+  const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base });
+  const base = core.apikeysBase;
+  const expiresIn = cfg.keyExpiresInSeconds;
+  const planeFetch = (method, path, user, opts = {}) => core.planeFetch(base, method, path, user, opts);
+  const resolveTenant = (user) => core.resolveTenant(user);
+  async function allowedTypesFor(user) {
+    const raw = cfg.resolveKeyTypes ? await cfg.resolveKeyTypes(user) : user.keyTypes;
+    if (raw === false) return false;
+    if (Array.isArray(raw)) return raw.length === 0 ? false : raw;
+    return ["call-only"];
+  }
+  async function catalogNames(user, tenant) {
+    const r = await planeFetch("GET", "/key-types", user, { query: { tenant } });
+    if (!r.ok) return [];
+    const d = await r.json();
+    return (d.key_types ?? []).map((t) => t.name).filter((n) => typeof n === "string");
+  }
+  async function run(user, op) {
+    if (op.action === "list") {
+      const allowed = await allowedTypesFor(user);
+      if (allowed === false) return { status: 200, data: { keys: [], keyTypes: [], access: "denied" } };
+      const tenant2 = await resolveTenant(user);
+      const [listRes, catalog] = await Promise.all([
+        planeFetch("GET", "/apikeys", user, { query: { tenant: tenant2, limit: "200" } }),
+        catalogNames(user, tenant2)
+      ]);
+      const d = await listRes.json();
+      const eligible = allowed.filter((t) => catalog.includes(t));
+      return { status: listRes.status, data: { keys: d.keys ?? [], keyTypes: eligible, access: "ok" } };
+    }
+    if (op.action === "create") {
+      const allowed = await allowedTypesFor(user);
+      if (allowed === false) return { status: 403, data: { error: "You do not have API access.", access: "denied" } };
+      const tenant2 = await resolveTenant(user);
+      const catalog = await catalogNames(user, tenant2);
+      const eligible = allowed.filter((t) => catalog.includes(t));
+      if (eligible.length === 0) return { status: 409, data: { error: "No key types are available for your account." } };
+      if (op.keyType && !eligible.includes(op.keyType)) {
+        return { status: 403, data: { error: "You are not allowed to create that key type." } };
       }
+      const chosen = op.keyType ?? (eligible.includes("call-only") ? "call-only" : eligible[0]);
+      const body = { tenant: tenant2, key_type_ids: [chosen], environment: "prod" };
+      if (typeof expiresIn === "number" && expiresIn > 0) body.expires_in_seconds = expiresIn;
+      const r = await planeFetch("POST", "/apikeys", user, { body });
+      const d = await r.json();
+      return { status: r.status, data: { key: d.key, key_id: d.metadata?.key_id } };
+    }
+    const tenant = await resolveTenant(user);
+    switch (op.action) {
       case "reveal": {
         const r = await planeFetch("GET", `/apikeys/${encodeURIComponent(op.keyId)}/reveal`, user, { query: { tenant } });
         return { status: r.status, data: await r.json().catch(() => ({})) };
@@ -67,7 +251,7 @@ function createApiblazeKeys(cfg) {
       const raw = await req.json().catch(() => ({}));
       const a = raw.action ?? "create";
       if ((a === "reveal" || a === "rotate" || a === "revoke") && !raw.keyId) return json({ error: "keyId required" }, 400);
-      op = { action: a, keyId: raw.keyId };
+      op = { action: a, keyId: raw.keyId, keyType: raw.keyType };
     }
     try {
       const { status, data } = await run(user, op);
@@ -79,24 +263,8 @@ function createApiblazeKeys(cfg) {
   }
   return { handler, run };
 }
-var PlaneError = class extends Error {
-  constructor(status, detail) {
-    super(detail);
-    this.status = status;
-    this.detail = detail;
-  }
-};
-async function safeErr(res) {
-  try {
-    const b = await res.json();
-    return typeof b.error === "string" ? b.error : b.error?.message ?? `apiblaze ${res.status}`;
-  } catch {
-    return `apiblaze ${res.status}`;
-  }
-}
-function json(data, status = 200) {
-  return new Response(JSON.stringify(data), { status, headers: { "Content-Type": "application/json" } });
-}
 export {
+  PlaneError,
+  createApiblazeGroups,
   createApiblazeKeys
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "apiblaze",
-  "version": "0.17.21",
-  "description": "APIblaze CLI \u2014 Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
+  "version": "0.17.23",
+  "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",
     "dev-tunnel",
@@ -21,24 +21,37 @@
   "exports": {
     ".": "./dist/index.js",
     "./sidecar": {
-      "types": "./dist/sidecar/index.d.ts",
-      "import": "./dist/sidecar/index.mjs",
-      "require": "./dist/sidecar/index.js",
-      "default": "./dist/sidecar/index.js"
+      "import": {
+        "types": "./dist/sidecar/index.d.mts",
+        "default": "./dist/sidecar/index.mjs"
+      },
+      "require": {
+        "types": "./dist/sidecar/index.d.ts",
+        "default": "./dist/sidecar/index.js"
+      }
     },
     "./server": {
-      "types": "./dist/server/index.d.ts",
-      "import": "./dist/server/index.mjs",
-      "require": "./dist/server/index.js",
-      "default": "./dist/server/index.js"
+      "import": {
+        "types": "./dist/server/index.d.mts",
+        "default": "./dist/server/index.mjs"
+      },
+      "require": {
+        "types": "./dist/server/index.d.ts",
+        "default": "./dist/server/index.js"
+      }
     },
     "./react": {
-      "types": "./dist/react/index.d.ts",
-      "import": "./dist/react/index.mjs",
-      "require": "./dist/react/index.js",
-      "default": "./dist/react/index.js"
+      "import": {
+        "types": "./dist/react/index.d.mts",
+        "default": "./dist/react/index.mjs"
+      },
+      "require": {
+        "types": "./dist/react/index.d.ts",
+        "default": "./dist/react/index.js"
+      }
     }
   },
+  "sideEffects": false,
   "files": [
     "dist/",
     "README.md"
@@ -67,8 +80,7 @@
     "@types/ws": "^8.5.10",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
-    "@types/react": "^18.2.0",
-    "react": "^18.2.0"
+    "@types/react": "^18.2.0"
   },
   "peerDependencies": {
     "react": ">=17"