apiblaze 0.18.7 → 0.18.10

package/README.md

@@ -1,67 +1,6 @@
 # apiblaze
 
-CLI for [APIblaze](https://apiblaze.com) — Chat with your APIs, Manage your API keys, users and groups through APIblaze's serverless proxy
-
----
-
-## Drop-in API-key widget (React)
-
-Let your users create and manage their API keys on your own site, in ~3 files. Your
-server holds one control-plane key; the browser only ever talks to your own backend —
-no secrets in the client, no cross-domain cookies.
-
-**1. Install**
-
-```bash
-npm install apiblaze react
-```
-
-**2. One backend route** — it holds the key and reads your session (`app/api/apiblaze/keys/route.ts`):
-
-```ts
-import { createApiblazeKeys } from 'apiblaze/server';
-import { auth } from '@/auth'; // NextAuth, Clerk, Auth0 — anything
-
-const keys = createApiblazeKeys({
-  cpKey: process.env.APIBLAZE_CP_KEY!,           // from Dashboard → Developers → "Widget key"
-  getUser: async () => {
-    const s = await auth();
-    if (!s?.user) return null;                   // not logged in → 401
-    return {
-      tenant: s.user.orgId ?? s.user.id,         // the customer COMPANY → isolation
-      userId: s.user.id,                         // the PERSON → owns their keys
-      // Which key types this person may create. Decided HERE, on your server:
-      //   omit → ['call-only'] (default)   list → those (widget shows a picker)   false → no access
-      keyTypes: s.user.isEngineer ? ['manager', 'call-only'] : undefined,
-    };
-  },
-});
-
-export const GET = keys.handler;
-export const POST = keys.handler;
-```
-
-**3. One component** — anywhere in your app:
-
-```tsx
-'use client';
-import { ApiKeyWidget } from 'apiblaze/react';
-
-export default function Settings() {
-  return <ApiKeyWidget theme={{ accent: '#e11d48' }} />;
-}
-```
-
-That's it. The widget calls `/api/apiblaze/keys` (same-origin, your session cookie rides
-along); your route adds the control-plane key and talks to apiblaze server-to-server.
-
-**White-label it.** Every font and color is a `theme` token (`accent`, `surface`,
-`headerBackground`, `text`, `muted`, `border`, `danger`, `success`, `radius`,
-`fontFamily`, `monoFontFamily`) — match any brand without forking the component.
-
-**Security.** Eligibility is decided on your server from your session, never the browser —
-a crafted request can't mint a type the user isn't allowed. Use a **Widget key** (Dashboard
-→ Developers), not a full admin key, so the platform's subset rule is a real backstop.
+CLI for [APIblaze](https://apiblaze.com) — chat with your APIs, run them as serverless proxies, and let your customers self-serve keys, users & groups from your own site.
 
 ---
 
@@ -103,10 +42,44 @@ npx apiblaze tenant
 # Access your localhost through a proxied URL
 npx apiblaze dev 3000
 
+# Route a Next.js app's outbound fetch() through APIblaze
+npx apiblaze sidecar
+
 # Sign in to manage APIs under your team
 npx apiblaze login
 ```
 
+## Embeddable widgets (React)
+
+Let your customers self-serve from **your** site — **API keys** (`<ApiKeyWidget/>`) and
+**users, groups & admins** (`<UsersGroupsWidget/>`). Each is one server route holding your
+**Widget key** (Dashboard → Developers) plus one component; the browser only ever talks to
+your backend — no secrets in the client. One `getUser` maps your session
+(`{ tenant, userId, email }`); **both widgets share the same key**.
+
+```ts
+// app/api/apiblaze/keys/route.ts    → <ApiKeyWidget/>
+import { createApiblazeKeys } from 'apiblaze/server';
+const keys = createApiblazeKeys({ cpKey: process.env.APIBLAZE_CP_KEY!, getUser });
+export const GET = keys.handler, POST = keys.handler;
+
+// app/api/apiblaze/groups/route.ts  → <UsersGroupsWidget/>   (same key)
+import { createApiblazeGroups } from 'apiblaze/server';
+const groups = createApiblazeGroups({ cpKey: process.env.APIBLAZE_CP_KEY!, getUser });
+export const GET = groups.handler, POST = groups.handler;
+```
+
+```tsx
+'use client';
+import { ApiKeyWidget, UsersGroupsWidget } from 'apiblaze/react';
+
+<ApiKeyWidget theme={{ accent: '#7C3AED' }} />;        // keys: create · rotate · revoke
+<UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;   // users · nested groups · co-admins · seen-in-traffic
+```
+
+Every color and font is a `theme` token — white-label to any brand. Eligibility and admin
+rights are decided on **your** server from your session, never the browser.
+
 ## Help
 
 ```bash
@@ -162,6 +135,16 @@ Every chat turn shows its cost.
 | `apiblaze tenant cors --tenant <slug> --origins <a,b>` | Set which websites can call it |
 | `apiblaze tenant list / delete <slug>` | List / delete tenants |
 
+### Producer — users, groups & authorization
+
+| Command | What it does |
+|---|---|
+| `apiblaze group create / list / delete <name>` | Manage a tenant's groups (also `<UsersGroupsWidget/>`) |
+| `apiblaze group add-user / remove-user <user> <group>` | Put a user in a group (or take them out) |
+| `apiblaze group add-group / remove-group <child> <parent>` | Nest a group inside a group |
+| `apiblaze rule "<plain english>" <project> [--enforce]` | Author an object-level access rule in one shot (shadow, then `--enforce`) |
+| `apiblaze agent authz <project>` | Design & turn on authorization interactively (chat) |
+
 ### Producer — change a proxy's config
 
 | Command | What it does |

package/dist/index.js

@@ -703,7 +703,7 @@ var import_commander = require("commander");
 var import_chalk41 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.18.7";
+var version = "0.18.10";
 
 // src/index.ts
 init_types();
@@ -2427,6 +2427,35 @@ async function runAgentChatRepl(opts) {
 // src/lib/authz-apply.ts
 var import_chalk15 = __toESM(require("chalk"));
 init_api();
+async function gatherSampleIds(projectId, apiVersion, cap = 50) {
+  try {
+    const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
+    const routes = routesRes?.data?.routes ?? [];
+    const total = routes.reduce((n, r) => n + (Number(r.total) || 0), 0);
+    if (!routes.length || total === 0) return { ids: [], total: 0 };
+    const ordered = routes.filter((r) => r.route_hash).sort((a, b) => (Number(b.total) || 0) - (Number(a.total) || 0)).slice(0, 20);
+    const ids = [];
+    for (const r of ordered) {
+      if (ids.length >= cap) break;
+      const sRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes/${encodeURIComponent(r.route_hash)}/samples`, "GET");
+      for (const s of sRes?.data?.samples ?? []) {
+        if (ids.length >= cap) break;
+        if (s.sample_id) ids.push(s.sample_id);
+      }
+    }
+    return { ids, total };
+  } catch {
+    return { ids: [], total: 0 };
+  }
+}
+function maybeWarnNoTraffic(total, projectArg) {
+  if (total >= 3) return;
+  console.log(import_chalk15.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
+  console.log(import_chalk15.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
+  console.log(import_chalk15.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
+  console.log(import_chalk15.default.dim(`    curl a few endpoints, or `) + import_chalk15.default.cyan("npx apiblaze dev") + import_chalk15.default.dim(` \u2014 then re-run.
+`));
+}
 async function applyProposal(opts) {
   const log = opts.log ?? ((s) => console.log(s));
   const { projectId, apiVersion, tenant: tenant2, proposal, enable } = opts;
@@ -2499,11 +2528,13 @@ async function runAuthz(projectArg, apiVersionArg) {
 `));
     }
   }
+  const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
+  maybeWarnNoTraffic(sampleTotal, projectArg);
   await runAgentChatRepl({
     title: `Authorization assistant \u2014 ${projectId} ${apiVersion}`,
-    subtitle: `tenant ${tenant2} \xB7 discuss what authorization fits this API, then make it official.`,
+    subtitle: sampleIds.length ? `tenant ${tenant2} \xB7 ${sampleIds.length} traffic sample(s) \xB7 discuss what fits, then make it official.` : `tenant ${tenant2} \xB7 discuss what authorization fits this API, then make it official.`,
     endpoint: `/projects/${projectId}/${apiVersion}/authz/chat`,
-    buildBody: () => ({ included_sample_ids: [], existing_model: null, existing_routes: [] }),
+    buildBody: () => ({ included_sample_ids: sampleIds, existing_model: null, existing_routes: [] }),
     seedPrompt: "Analyze this API and tell me what authorization is feasible. If it is read-only, say so plainly. Then propose options \u2014 do not generate rules yet.",
     summarizeProposal: (data) => {
       const proposal = data.proposal;
@@ -2538,7 +2569,9 @@ async function runRule(ruleText, projectArg, opts) {
   const projectId = match.projectId;
   const apiVersion = opts.apiversion || match.apiVersion;
   const tenant2 = match.tenant || projectId;
-  const spinner = (0, import_ora5.default)("Designing the rule\u2026").start();
+  const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
+  maybeWarnNoTraffic(sampleTotal, projectArg);
+  const spinner = (0, import_ora5.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
   const messages = [{
     role: "user",
     content: `Author this authorization rule and generate the COMPLETE proposal (OpenFGA model + per-route rules) NOW for every affected route. Do not ask clarifying questions; make reasonable assumptions and state them briefly. Rule: "${rule}"`
@@ -2546,7 +2579,7 @@ async function runRule(ruleText, projectArg, opts) {
   const { status, data } = await agentCall(
     `/projects/${projectId}/${apiVersion}/authz/chat`,
     "POST",
-    { messages, included_sample_ids: [], existing_model: null, existing_routes: [] }
+    { messages, included_sample_ids: sampleIds, existing_model: null, existing_routes: [] }
   );
   if (status >= 400) {
     spinner.fail(`Authorization agent error (${status}): ${data?.error ?? ""}`);
@@ -5626,7 +5659,7 @@ function freeBudgetWarning(billing, anon) {
   if (typeof billing.free_turns_remaining === "number") {
     const left2 = billing.free_turns_remaining;
     if (left2 <= 0) return import_chalk36.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk36.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left`);
+    return import_chalk36.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof billing.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(billing.cents || 0, 0.02);
@@ -5715,7 +5748,7 @@ function renderUpsell(p, upsell) {
   console.log("\n" + import_chalk36.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "PAUSED") {
     if (!loggedIn) {
-      console.log(import_chalk36.default.dim("  Options: `/login` for free login credit and higher limits, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk36.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
       console.log(import_chalk36.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
@@ -5961,7 +5994,7 @@ async function runRepl(p, initialMessages) {
   const llm2 = loadLlmConfig();
   console.log(
     import_chalk36.default.dim(
-      llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for credit \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
+      llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
@@ -5980,8 +6013,14 @@ async function runRepl(p, initialMessages) {
     }
     if (text === "/claim") {
       if (!loadCredentials()) {
-        console.log(import_chalk36.default.yellow("  Log in first: `/login`, then `/claim`."));
-        continue;
+        console.log(import_chalk36.default.dim("  Logging in to claim your workspace\u2026"));
+        try {
+          await runLogin();
+        } catch (err) {
+          console.log(import_chalk36.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          continue;
+        }
+        if (!loadCredentials()) continue;
       }
       try {
         await runClaim(void 0, {});
@@ -6062,7 +6101,7 @@ async function runApichat(opts) {
   if (p.proxyUrl) console.log(`  ${import_chalk36.default.green("\u2713")} proxy  ${import_chalk36.default.bold(p.proxyUrl)}`);
   if (mcpUrl) console.log(`  ${import_chalk36.default.green("\u2713")} mcp    ${import_chalk36.default.bold(mcpUrl)}`);
   if (p.anon) {
-    console.log(import_chalk36.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat (after /login) to keep it beyond 30 days."));
+    console.log(import_chalk36.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
   await runRepl(p);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "apiblaze",
-  "version": "0.18.7",
-  "description": "APIblaze CLI \u2014 Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
+  "version": "0.18.10",
+  "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",
     "dev-tunnel",
@@ -90,4 +90,4 @@
       "optional": true
     }
   }
-}
+}