apiblaze 0.19.18 → 0.19.20

package/dist/index.js

@@ -932,7 +932,7 @@ var import_commander = require("commander");
 var import_chalk44 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.18";
+var version = "0.19.20";
 
 // src/index.ts
 init_types();
@@ -1689,6 +1689,9 @@ async function probeLocalServer(port) {
   }
 }
 async function runDev(options) {
+  if (options.newSession && !(loadCredentials() && Date.now() < loadCredentials().expiresAt)) {
+    clearAnonCred();
+  }
   let auth = resolveDevAuth();
   let keyAuth = auth.mode === "key" ? { apiKey: auth.apiKey } : void 0;
   let teamId = "";
@@ -1933,6 +1936,7 @@ ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 
 // src/commands/create.ts
 var import_fs2 = __toESM(require("fs"));
+var import_yaml = require("yaml");
 var import_chalk10 = __toESM(require("chalk"));
 var import_ora5 = __toESM(require("ora"));
 init_auth();
@@ -1964,8 +1968,22 @@ async function loadOpenapiSource(ref) {
     }
   }
   if (!text.trim()) fail(`The OpenAPI spec is empty: ${ref}`);
-  if (!/["']?(openapi|swagger|paths)["']?\s*:/i.test(text)) {
-    fail(`That does not look like an OpenAPI/Swagger document (no openapi/swagger/paths): ${ref}`);
+  let parsed;
+  try {
+    parsed = text.trimStart().startsWith("{") ? JSON.parse(text) : (0, import_yaml.parse)(text);
+  } catch (err) {
+    fail(`Could not parse the OpenAPI spec at ${ref} as JSON or YAML \u2014 ${err.message}`);
+  }
+  const doc = parsed;
+  if (!doc || typeof doc !== "object") {
+    fail(`${ref} is not an OpenAPI/Swagger document.
+       If that link opens a web page, use the raw file URL instead.`);
+  }
+  if (typeof doc.openapi !== "string" && typeof doc.swagger !== "string") {
+    fail(
+      `${ref} has no "openapi" or "swagger" version field, so it is not a usable API description.
+       If the file looks right otherwise, check its first line \u2014 the copy at that URL may be damaged.`
+    );
   }
   return text;
 }
@@ -5752,7 +5770,7 @@ var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
 var import_chalk39 = __toESM(require("chalk"));
 var import_ora21 = __toESM(require("ora"));
-var import_yaml = require("yaml");
+var import_yaml2 = require("yaml");
 init_auth();
 init_anon_cred();
 init_api();
@@ -5855,7 +5873,7 @@ function parseSpec(text) {
     parsed = JSON.parse(text);
   } catch {
     try {
-      parsed = (0, import_yaml.parse)(text);
+      parsed = (0, import_yaml2.parse)(text);
     } catch {
       fail4("Could not parse the spec as JSON or YAML.");
     }
@@ -6036,6 +6054,68 @@ async function captureTargetSecret(auth, opts) {
   if (!secret) fail4("No credential entered.");
   return secret;
 }
+async function dataPlaneAuth(p) {
+  if (!p.consumerAuth) {
+    if (!p.dpKey) throw new Error("No API key for this proxy.");
+    return { "X-API-Key": p.dpKey };
+  }
+  const stored = loadConsumer();
+  if (!stored) {
+    throw new Error("Consumer login required \u2014 run `apiblaze apichat` again to sign in.");
+  }
+  const fresh = await validConsumerToken(stored) ?? stored;
+  if (fresh.accessToken !== stored.accessToken) saveConsumer(fresh);
+  return { Authorization: `Bearer ${fresh.accessToken}` };
+}
+async function ensureConsumerLogin(teamId, tenant2) {
+  const existing = loadConsumer();
+  if (existing && existing.tenant === tenant2) {
+    const fresh = await validConsumerToken(existing);
+    if (fresh) {
+      if (fresh.accessToken !== existing.accessToken) saveConsumer(fresh);
+      console.log(import_chalk39.default.dim(`  Using your consumer session on ${import_chalk39.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      return fresh;
+    }
+  }
+  const spinner = (0, import_ora21.default)(`Finding the login app for ${tenant2}...`).start();
+  const clients = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`,
+    summary: `List app clients for ${tenant2}`
+  }).catch(() => []);
+  spinner.stop();
+  const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
+  const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
+  if (!pick2) {
+    throw new Error(
+      `Tenant "${tenant2}" has no login app configured, so there is no way to sign in as a consumer. Add one in the dashboard (Tenants \u2192 app clients).`
+    );
+  }
+  const clientId = pick2.client_id ?? pick2.clientId;
+  console.log(`${import_chalk39.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk39.default.bold(tenant2)}...`);
+  const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
+    console.log(`
+  Open: ${import_chalk39.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk39.default.bold(userCode)}
+`);
+    console.log(import_chalk39.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+  }, `https://${tenant2}.portal.apiblaze.com/1.0.0`);
+  const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
+  const creds = {
+    tenant: tenant2,
+    clientId,
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    idToken: result.idToken,
+    expiresAt: Date.now() + (result.expiresIn ?? 3600) * 1e3,
+    scope: result.scope,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    obtainedAt: Date.now()
+  };
+  saveConsumer(creds);
+  console.log(`  ${import_chalk39.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk39.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  return creds;
+}
 async function cpPost(anon, path8, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
@@ -6217,7 +6297,7 @@ async function publishMcp(p, spec2) {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json", "X-API-Key": p.dpKey },
+      headers: { "Content-Type": "application/json", ...await dataPlaneAuth(p) },
       body: JSON.stringify({ openapi: spec2, environment: p.environment })
     });
     const out = await res.json().catch(() => null);
@@ -6245,15 +6325,16 @@ function maskKey(k) {
   return k.length <= 8 ? "****" : `${k.slice(0, 4)}\u2026${k.slice(-4)}`;
 }
 var revealAuth = false;
-function renderToolEvents(events, dpKey) {
+function renderToolEvents(events, cred) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
     const mark = ok ? import_chalk39.default.green("\u2713") : import_chalk39.default.red("\u2717");
     console.log(`  ${mark} ${import_chalk39.default.cyan(e.name)} ${import_chalk39.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk39.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
-      if (dpKey) {
-        const keyLine = `        -H 'X-API-Key: ${revealAuth ? dpKey : maskKey(dpKey)}'`;
+      console.log(import_chalk39.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
+      if (cred) {
+        const shown = revealAuth ? cred.value : maskKey(cred.value);
+        const keyLine = `        -H '${cred.header}: ${shown}'`;
         const hint = revealAuth ? "" : import_chalk39.default.yellow("  \u2190 /showauth will reveal this");
         console.log(import_chalk39.default.dim(keyLine) + hint);
       }
@@ -6309,7 +6390,7 @@ async function replTurn(p, messages, userText) {
     try {
       res = await fetch(chatUrl(p), {
         method: "POST",
-        headers: { "Content-Type": "application/json", "X-API-Key": p.dpKey },
+        headers: { "Content-Type": "application/json", ...await dataPlaneAuth(p) },
         body: JSON.stringify(body)
       });
     } catch (err) {
@@ -6341,7 +6422,13 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (Array.isArray(data.delta)) {
-      renderToolEvents(data.tool_events, p.dpKey);
+      renderToolEvents(
+        data.tool_events,
+        p.consumerAuth ? (() => {
+          const t = loadConsumer()?.accessToken;
+          return t ? { header: "Authorization", value: `Bearer ${t}` } : void 0;
+        })() : p.dpKey ? { header: "X-API-Key", value: p.dpKey } : void 0
+      );
       for (const m of data.delta) messages.push(m);
       printAssistant(data.delta);
     }
@@ -6429,24 +6516,50 @@ async function mintDurableProxyKey(teamId, tenant2) {
   if (!out?.key) throw new Error("key mint returned no key");
   return out.key;
 }
+async function fetchAcceptedMethods(project) {
+  try {
+    const listing = await admin({
+      method: "GET",
+      path: `/projects?team_id=${encodeURIComponent(project.teamId)}`,
+      summary: `Read the access policy for ${project.projectName}`
+    });
+    const rows = listing?.projects ?? [];
+    const row = rows.find((r) => r.project_id === project.projectId && r.api_version === project.apiVersion) ?? rows.find((r) => r.project_id === project.projectId);
+    const policy = row?.config?.requests_policy;
+    if (!policy || policy.mode !== "authenticate") return null;
+    return Array.isArray(policy.methods) && policy.methods.length ? policy.methods : null;
+  } catch {
+    return null;
+  }
+}
 async function openServerProxy(project) {
   const version2 = project.apiVersion || "1.0.0";
   const environment = "prod";
   const mcpHost = `${project.projectId}.mcp.abz.run`;
   const tenant2 = project.tenant || project.projectId;
   const me = loadCredentials()?.apiblazeUserId;
-  const prior = loadApichats().find((a) => a.projectId === project.projectId && a.dpKey);
+  const prior = loadApichats().find((a) => a.projectId === project.projectId);
+  const acceptedMethods = await fetchAcceptedMethods(project);
+  const acceptsApiKey = acceptedMethods === null || acceptedMethods.includes("api_key");
   let dpKey = prior?.dpKey;
-  if (!dpKey) {
-    console.log(import_chalk39.default.dim(`  Minting an API key for tenant ${import_chalk39.default.bold(tenant2)} to query project ${import_chalk39.default.bold(project.projectName)}\u2026`));
-    dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-    console.log(`  ${import_chalk39.default.green("\u2714")} API key: ${import_chalk39.default.dim(maskKey(dpKey))}`);
+  let consumerAuth = false;
+  if (acceptsApiKey) {
+    if (!dpKey) {
+      console.log(import_chalk39.default.dim(`  Minting an API key for tenant ${import_chalk39.default.bold(tenant2)} to query project ${import_chalk39.default.bold(project.projectName)}\u2026`));
+      dpKey = await mintDurableProxyKey(project.teamId, tenant2);
+      console.log(`  ${import_chalk39.default.green("\u2714")} API key: ${import_chalk39.default.dim(maskKey(dpKey))}`);
+    }
+  } else {
+    consumerAuth = true;
+    dpKey = void 0;
+    await ensureConsumerLogin(project.teamId, tenant2);
   }
   const p = {
     projectId: project.projectId,
     version: version2,
     environment,
     dpKey,
+    consumerAuth,
     mcpHost,
     proxyUrl: `https://${project.projectId}.abz.run/${version2}/${environment}`,
     anon: false,
@@ -6479,6 +6592,7 @@ async function openServerProxy(project) {
     environment,
     mcpHost,
     dpKey,
+    consumerAuth,
     anon: false,
     ownerUserId: me,
     createdAt: prior?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -6561,6 +6675,9 @@ async function noArgsMenu(opts) {
       version: a.version,
       environment: a.environment,
       dpKey: a.dpKey,
+      // Carry the door forward — resuming an OAuth-only chat must not fall back to
+      // looking for a key that was never minted.
+      consumerAuth: a.consumerAuth,
       mcpHost: a.mcpHost,
       proxyUrl: void 0,
       anon: a.anon,
@@ -6703,6 +6820,7 @@ async function runApichat(opts) {
     environment: p.environment,
     mcpHost: p.mcpHost,
     dpKey: p.dpKey,
+    consumerAuth: p.consumerAuth,
     anon: p.anon,
     ownerUserId: loadCredentials()?.apiblazeUserId,
     // undefined while anon
@@ -7505,14 +7623,14 @@ withSetupOptions(sidecar.command("setup").description("Wire a Next.js app to rou
 sidecar.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
 sidecar.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
 sidecar.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
-program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("--project <nameOrId>", "Tunnel this specific project (skips the picker \u2014 for scripts)").option("-y, --yes", "Skip confirmation prompts (non-interactive)").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
+program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("--project <nameOrId>", "Tunnel this specific project (skips the picker \u2014 for scripts)").option("-y, --yes", "Skip confirmation prompts (non-interactive)").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").option("--new-session", "Logged-out only: start a fresh anonymous workspace instead of reusing this machine's (each run = a throwaway proxy)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
       console.error(import_chalk44.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
-    await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile });
+    await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile, newSession: opts.newSession });
   } catch (err) {
     await printError(err);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.19.18",
+  "version": "0.19.20",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",