apiblaze 0.18.7 → 0.18.8

package/README.md

@@ -1,67 +1,6 @@
 # apiblaze
 
-CLI for [APIblaze](https://apiblaze.com) — Chat with your APIs, Manage your API keys, users and groups through APIblaze's serverless proxy
-
----
-
-## Drop-in API-key widget (React)
-
-Let your users create and manage their API keys on your own site, in ~3 files. Your
-server holds one control-plane key; the browser only ever talks to your own backend —
-no secrets in the client, no cross-domain cookies.
-
-**1. Install**
-
-```bash
-npm install apiblaze react
-```
-
-**2. One backend route** — it holds the key and reads your session (`app/api/apiblaze/keys/route.ts`):
-
-```ts
-import { createApiblazeKeys } from 'apiblaze/server';
-import { auth } from '@/auth'; // NextAuth, Clerk, Auth0 — anything
-
-const keys = createApiblazeKeys({
-  cpKey: process.env.APIBLAZE_CP_KEY!,           // from Dashboard → Developers → "Widget key"
-  getUser: async () => {
-    const s = await auth();
-    if (!s?.user) return null;                   // not logged in → 401
-    return {
-      tenant: s.user.orgId ?? s.user.id,         // the customer COMPANY → isolation
-      userId: s.user.id,                         // the PERSON → owns their keys
-      // Which key types this person may create. Decided HERE, on your server:
-      //   omit → ['call-only'] (default)   list → those (widget shows a picker)   false → no access
-      keyTypes: s.user.isEngineer ? ['manager', 'call-only'] : undefined,
-    };
-  },
-});
-
-export const GET = keys.handler;
-export const POST = keys.handler;
-```
-
-**3. One component** — anywhere in your app:
-
-```tsx
-'use client';
-import { ApiKeyWidget } from 'apiblaze/react';
-
-export default function Settings() {
-  return <ApiKeyWidget theme={{ accent: '#e11d48' }} />;
-}
-```
-
-That's it. The widget calls `/api/apiblaze/keys` (same-origin, your session cookie rides
-along); your route adds the control-plane key and talks to apiblaze server-to-server.
-
-**White-label it.** Every font and color is a `theme` token (`accent`, `surface`,
-`headerBackground`, `text`, `muted`, `border`, `danger`, `success`, `radius`,
-`fontFamily`, `monoFontFamily`) — match any brand without forking the component.
-
-**Security.** Eligibility is decided on your server from your session, never the browser —
-a crafted request can't mint a type the user isn't allowed. Use a **Widget key** (Dashboard
-→ Developers), not a full admin key, so the platform's subset rule is a real backstop.
+CLI for [APIblaze](https://apiblaze.com) — chat with your APIs, run them as serverless proxies, and let your customers self-serve keys, users & groups from your own site.
 
 ---
 
@@ -103,10 +42,44 @@ npx apiblaze tenant
 # Access your localhost through a proxied URL
 npx apiblaze dev 3000
 
+# Route a Next.js app's outbound fetch() through APIblaze
+npx apiblaze sidecar
+
 # Sign in to manage APIs under your team
 npx apiblaze login
 ```
 
+## Embeddable widgets (React)
+
+Let your customers self-serve from **your** site — **API keys** (`<ApiKeyWidget/>`) and
+**users, groups & admins** (`<UsersGroupsWidget/>`). Each is one server route holding your
+**Widget key** (Dashboard → Developers) plus one component; the browser only ever talks to
+your backend — no secrets in the client. One `getUser` maps your session
+(`{ tenant, userId, email }`); **both widgets share the same key**.
+
+```ts
+// app/api/apiblaze/keys/route.ts    → <ApiKeyWidget/>
+import { createApiblazeKeys } from 'apiblaze/server';
+const keys = createApiblazeKeys({ cpKey: process.env.APIBLAZE_CP_KEY!, getUser });
+export const GET = keys.handler, POST = keys.handler;
+
+// app/api/apiblaze/groups/route.ts  → <UsersGroupsWidget/>   (same key)
+import { createApiblazeGroups } from 'apiblaze/server';
+const groups = createApiblazeGroups({ cpKey: process.env.APIBLAZE_CP_KEY!, getUser });
+export const GET = groups.handler, POST = groups.handler;
+```
+
+```tsx
+'use client';
+import { ApiKeyWidget, UsersGroupsWidget } from 'apiblaze/react';
+
+<ApiKeyWidget theme={{ accent: '#7C3AED' }} />;        // keys: create · rotate · revoke
+<UsersGroupsWidget theme={{ accent: '#7C3AED' }} />;   // users · nested groups · co-admins · seen-in-traffic
+```
+
+Every color and font is a `theme` token — white-label to any brand. Eligibility and admin
+rights are decided on **your** server from your session, never the browser.
+
 ## Help
 
 ```bash
@@ -162,6 +135,16 @@ Every chat turn shows its cost.
 | `apiblaze tenant cors --tenant <slug> --origins <a,b>` | Set which websites can call it |
 | `apiblaze tenant list / delete <slug>` | List / delete tenants |
 
+### Producer — users, groups & authorization
+
+| Command | What it does |
+|---|---|
+| `apiblaze group create / list / delete <name>` | Manage a tenant's groups (also `<UsersGroupsWidget/>`) |
+| `apiblaze group add-user / remove-user <user> <group>` | Put a user in a group (or take them out) |
+| `apiblaze group add-group / remove-group <child> <parent>` | Nest a group inside a group |
+| `apiblaze rule "<plain english>" <project> [--enforce]` | Author an object-level access rule in one shot (shadow, then `--enforce`) |
+| `apiblaze agent authz <project>` | Design & turn on authorization interactively (chat) |
+
 ### Producer — change a proxy's config
 
 | Command | What it does |

package/dist/index.js

@@ -703,7 +703,7 @@ var import_commander = require("commander");
 var import_chalk41 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.18.7";
+var version = "0.18.8";
 
 // src/index.ts
 init_types();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.18.7",
+  "version": "0.18.8",
   "description": "APIblaze CLI \u2014 Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",
@@ -90,4 +90,4 @@
       "optional": true
     }
   }
-}
+}