apiblaze 0.2.0 → 0.3.1

package/README.md

@@ -36,6 +36,9 @@ npx apiblaze dev
 # Or specify a port
 npx apiblaze dev 3000
 
+# Stream full request/response traffic to a file (JSON lines)
+npx apiblaze dev 3000 --capture-file traffic.jsonl
+
 ```
 
 ## Help
@@ -70,6 +73,17 @@ apiblaze help dev
 
 On Ctrl+C the tunnel is cleanly deregistered.
 
+### Zero-setup conveniences
+
+- **No project yet?** If none of your projects point at this machine, `apiblaze dev`
+  offers to spin up a throwaway dev proxy (random name like `braveotter42`) pointed at
+  `http://localhost:<port>` and tunnels it immediately — pick `none` or `api_key` auth.
+- **Server not running yet?** If nothing is listening on the local port, requests aren't
+  dropped: each one is printed in full (headers + body, with API keys/JWTs masked and JWTs
+  decoded) and answered with a friendly synthetic `200`. The moment your dev server comes
+  up, the next request forwards to it automatically. Add `--capture-file <path>` to also
+  stream every request/response to a JSON-lines file.
+
 ## License
 
 MIT

package/dist/index.js

@@ -93,6 +93,7 @@ var init_auth = __esm({
 // src/lib/api.ts
 var api_exports = {};
 __export(api_exports, {
+  agentCall: () => agentCall,
   checkProxyName: () => checkProxyName,
   claimProxy: () => claimProxy,
   createProxy: () => createProxy,
@@ -147,6 +148,20 @@ async function apiFetch(path2, options = {}) {
   }
   return res.json();
 }
+async function agentCall(path2, method, body) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ path: path2, method, body })
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  return { status: res.status, data };
+}
 async function getTeams() {
   const res = await apiFetch("/api/cli/teams");
   const raw = Array.isArray(res) ? res : res?.teams ?? res?.data ?? [];
@@ -203,10 +218,10 @@ var init_api = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk10 = __toESM(require("chalk"));
+var import_chalk14 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.2.0";
+var version = "0.3.1";
 
 // src/index.ts
 init_types();
@@ -327,6 +342,7 @@ ${import_chalk.default.cyan("\u2192")} Team: ${import_chalk.default.bold(teamNam
 }
 
 // src/commands/dev.ts
+var import_fs = __toESM(require("fs"));
 var import_chalk3 = __toESM(require("chalk"));
 var import_ora2 = __toESM(require("ora"));
 var import_inquirer = __toESM(require("inquirer"));
@@ -361,10 +377,217 @@ function colorLatency(latency) {
   if (latency < 500) return import_chalk2.default.yellow(s);
   return import_chalk2.default.red(s);
 }
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toTimeString().slice(0, 8);
+}
 function formatLogLine(entry) {
-  const now = /* @__PURE__ */ new Date();
-  const ts = now.toTimeString().slice(0, 8);
-  return `${import_chalk2.default.gray(`[${ts}]`)} ${colorMethod(entry.method)} ${import_chalk2.default.white(entry.path)} ${import_chalk2.default.gray("\u2192")} ${colorStatus(entry.status)} ${import_chalk2.default.gray(`(${colorLatency(entry.latency)})`)}`;
+  return `${import_chalk2.default.gray(`[${timestamp()}]`)} ${colorMethod(entry.method)} ${import_chalk2.default.white(entry.path)} ${import_chalk2.default.gray("\u2192")} ${colorStatus(entry.status)} ${import_chalk2.default.gray(`(${colorLatency(entry.latency)})`)}`;
+}
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "apikey",
+  "x-auth-token",
+  "x-access-token",
+  "x-refresh-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+var SENSITIVE_QUERY = /* @__PURE__ */ new Set([
+  "api_key",
+  "apikey",
+  "key",
+  "token",
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "secret",
+  "client_secret",
+  "password",
+  "sig",
+  "signature"
+]);
+function maskSecret(value) {
+  const v = value.trim();
+  if (v.length <= 8) return "\u2022\u2022\u2022\u2022";
+  const head = v.slice(0, 4);
+  const tail = v.slice(-4);
+  return `${head}\u2026${tail} ${import_chalk2.default.gray(`(${v.length} chars, masked)`)}`;
+}
+function base64UrlDecode(seg) {
+  try {
+    const pad = seg.length % 4 === 0 ? "" : "=".repeat(4 - seg.length % 4);
+    const b64 = seg.replace(/-/g, "+").replace(/_/g, "/") + pad;
+    return Buffer.from(b64, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function decodeJwt(token) {
+  const parts = token.trim().split(".");
+  if (parts.length !== 3) return null;
+  const headerRaw = base64UrlDecode(parts[0]);
+  const payloadRaw = base64UrlDecode(parts[1]);
+  if (!headerRaw || !payloadRaw) return null;
+  try {
+    const header = JSON.parse(headerRaw);
+    const payload = JSON.parse(payloadRaw);
+    if (!header || typeof header !== "object" || !("alg" in header)) return null;
+    return { header, payload };
+  } catch {
+    return null;
+  }
+}
+function maskPath(path2) {
+  const q = path2.indexOf("?");
+  if (q < 0) return path2;
+  const base = path2.slice(0, q);
+  const query = path2.slice(q + 1);
+  const masked = query.split("&").map((pair) => {
+    const eq = pair.indexOf("=");
+    if (eq < 0) return pair;
+    const name = pair.slice(0, eq);
+    const val = pair.slice(eq + 1);
+    if (val && SENSITIVE_QUERY.has(decodeURIComponent(name).toLowerCase())) {
+      return `${name}=${maskSecret(decodeURIComponent(val))}`;
+    }
+    return pair;
+  }).join("&");
+  return `${base}?${masked}`;
+}
+function formatHeaderLines(name, value) {
+  const lower = name.toLowerCase();
+  if (lower === "authorization" || lower === "proxy-authorization") {
+    const m = /^Bearer\s+(.+)$/i.exec(value.trim());
+    if (m) {
+      const token = m[1];
+      const jwt = decodeJwt(token);
+      if (jwt) {
+        return [
+          `    ${import_chalk2.default.dim(name)}: Bearer ${maskSecret(token)} ${import_chalk2.default.cyan("(JWT)")}`,
+          `      ${import_chalk2.default.gray("\u251C header: ")} ${import_chalk2.default.gray(JSON.stringify(jwt.header))}`,
+          `      ${import_chalk2.default.gray("\u2514 payload:")} ${import_chalk2.default.gray(JSON.stringify(jwt.payload))}`
+        ];
+      }
+      return [`    ${import_chalk2.default.dim(name)}: Bearer ${maskSecret(token)}`];
+    }
+    return [`    ${import_chalk2.default.dim(name)}: ${maskSecret(value)}`];
+  }
+  if (SENSITIVE_HEADERS.has(lower)) {
+    return [`    ${import_chalk2.default.dim(name)}: ${maskSecret(value)}`];
+  }
+  return [`    ${import_chalk2.default.dim(name)}: ${value}`];
+}
+function formatBody(body, contentType) {
+  if (body.length === 0) return import_chalk2.default.gray("    (empty)");
+  if (body.includes(0)) return import_chalk2.default.gray(`    <binary, ${body.length} bytes>`);
+  let text = body.toString("utf8");
+  const ct = (contentType ?? "").toLowerCase();
+  if (ct.includes("json") || /^[[{]/.test(text.trim())) {
+    try {
+      text = JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+    }
+  }
+  const MAX = 4e3;
+  const truncated = text.length > MAX;
+  const shown = truncated ? text.slice(0, MAX) : text;
+  const indented = shown.split("\n").map((l) => `    ${l}`).join("\n");
+  return indented + (truncated ? import_chalk2.default.gray(`
+    \u2026 (${text.length - MAX} more bytes \u2014 see --capture-file for full)`) : "");
+}
+function formatCapturedRequest(req, note) {
+  const headerLines = Object.keys(req.headers).flatMap((name) => formatHeaderLines(name, req.headers[name]));
+  const contentType = Object.keys(req.headers).find((k) => k.toLowerCase() === "content-type");
+  return [
+    `${import_chalk2.default.gray(`[${timestamp()}]`)} ${import_chalk2.default.magenta("\u26B2 CAPTURED")} ${colorMethod(req.method)} ${import_chalk2.default.white(maskPath(req.path))} ${import_chalk2.default.gray(`\u2014 ${note}`)}`,
+    import_chalk2.default.bold("  Headers:"),
+    ...headerLines,
+    import_chalk2.default.bold("  Body:"),
+    formatBody(req.body, contentType ? req.headers[contentType] : void 0),
+    ""
+  ].join("\n");
+}
+
+// src/lib/random-name.ts
+var ADJECTIVES = [
+  "amber",
+  "azure",
+  "brave",
+  "bright",
+  "calm",
+  "clever",
+  "cosmic",
+  "crisp",
+  "eager",
+  "fancy",
+  "gentle",
+  "happy",
+  "jolly",
+  "keen",
+  "lively",
+  "lucky",
+  "mellow",
+  "merry",
+  "nimble",
+  "noble",
+  "plucky",
+  "quiet",
+  "rapid",
+  "shiny",
+  "smooth",
+  "snappy",
+  "sunny",
+  "swift",
+  "tidy",
+  "vivid",
+  "witty",
+  "zesty"
+];
+var NOUNS = [
+  "badger",
+  "beacon",
+  "cedar",
+  "comet",
+  "dolphin",
+  "ember",
+  "falcon",
+  "finch",
+  "harbor",
+  "heron",
+  "koala",
+  "lark",
+  "lemur",
+  "maple",
+  "meadow",
+  "otter",
+  "panda",
+  "pebble",
+  "puffin",
+  "quail",
+  "raccoon",
+  "river",
+  "robin",
+  "sparrow",
+  "spruce",
+  "tiger",
+  "turtle",
+  "walrus",
+  "willow",
+  "wombat",
+  "yak",
+  "zebra"
+];
+function pick(list) {
+  return list[Math.floor(Math.random() * list.length)];
+}
+function randomProxyName() {
+  const digits = String(Math.floor(Math.random() * 100)).padStart(2, "0");
+  return `${pick(ADJECTIVES)}${pick(NOUNS)}${digits}`;
 }
 
 // src/lib/tunnel-client.ts
@@ -372,6 +595,7 @@ var import_ws = __toESM(require("ws"));
 var CHUNK_BYTES = 512 * 1024;
 var PING_INTERVAL_MS = 6e4;
 var MAX_RECONNECT_DELAY_MS = 15e3;
+var OFFLINE_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "EHOSTUNREACH"]);
 var STRIP_HEADERS = /* @__PURE__ */ new Set([
   "host",
   "content-length",
@@ -389,6 +613,10 @@ function stripHeaders(headers) {
   }
   return out;
 }
+function encodeBody(buf) {
+  if (buf.includes(0)) return { value: buf.toString("base64"), encoding: "base64" };
+  return { value: buf.toString("utf8"), encoding: "utf8" };
+}
 function startTunnelClient(opts) {
   const target = `http://127.0.0.1:${opts.localPort}`;
   const inflight = /* @__PURE__ */ new Map();
@@ -396,6 +624,7 @@ function startTunnelClient(opts) {
   let closed = false;
   let reconnects = 0;
   let pingTimer;
+  let capturing = false;
   function connect() {
     const url = `${opts.connectUrl}?project=${encodeURIComponent(opts.projectId)}&token=${encodeURIComponent(opts.token)}`;
     const socket = new import_ws.default(url);
@@ -455,30 +684,80 @@ function startTunnelClient(opts) {
     inflight.delete(id);
     void forward(socket, id, f);
   }
+  function sendResponse(socket, id, status, headers, body) {
+    send(socket, { id, type: "res", status, headers, bodyLen: body.length });
+    if (body.length === 0) {
+      send(socket, { id, type: "chunk", seq: 0, data: "", final: true });
+      return;
+    }
+    for (let off = 0, seq = 0; off < body.length; off += CHUNK_BYTES) {
+      const slice = body.subarray(off, Math.min(off + CHUNK_BYTES, body.length));
+      send(socket, { id, type: "chunk", seq: seq++, data: slice.toString("base64"), final: off + CHUNK_BYTES >= body.length });
+    }
+  }
+  function record(f, reqBody, status, captured, resHeaders, resBody) {
+    if (!opts.onRecord) return;
+    const req = encodeBody(reqBody);
+    const res = resBody ? encodeBody(resBody) : void 0;
+    opts.onRecord({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      projectId: opts.projectId,
+      captured,
+      method: f.method,
+      path: f.path,
+      requestHeaders: f.headers,
+      requestBody: reqBody.length ? req.value : void 0,
+      requestBodyEncoding: reqBody.length ? req.encoding : void 0,
+      status,
+      responseHeaders: resHeaders,
+      responseBody: res?.value,
+      responseBodyEncoding: res?.encoding,
+      latencyMs: Date.now() - f.start
+    });
+  }
   async function forward(socket, id, f) {
     const body = Buffer.concat(f.chunks);
     const init = { method: f.method, headers: stripHeaders(f.headers) };
     if (body.length) init.body = body;
-    let status = 502;
     try {
       const resp = await fetch(target + f.path, init);
-      status = resp.status;
+      const status = resp.status;
       const buf = Buffer.from(await resp.arrayBuffer());
       const headers = {};
       resp.headers.forEach((value, key) => {
         if (!STRIP_HEADERS.has(key.toLowerCase())) headers[key] = value;
       });
-      send(socket, { id, type: "res", status, headers, bodyLen: buf.length });
-      for (let off = 0, seq = 0; off < buf.length; off += CHUNK_BYTES) {
-        const slice = buf.subarray(off, Math.min(off + CHUNK_BYTES, buf.length));
-        send(socket, { id, type: "chunk", seq: seq++, data: slice.toString("base64"), final: off + CHUNK_BYTES >= buf.length });
+      if (capturing) {
+        capturing = false;
+        opts.onResume?.();
       }
+      sendResponse(socket, id, status, headers, buf);
+      opts.onEntry({ method: f.method, path: f.path, status, latency: Date.now() - f.start });
+      record(f, body, status, false, headers, buf);
     } catch (err) {
       const code = err?.cause?.code;
-      const message = code === "ECONNREFUSED" || code === "ECONNRESET" || code === "ENOTFOUND" || code === "EHOSTUNREACH" ? `No local server reachable at ${target} \u2014 is your dev server running on port ${opts.localPort}?` : err?.cause?.message || err?.message || String(err);
+      if (OFFLINE_CODES.has(code)) {
+        if (!capturing) {
+          capturing = true;
+          opts.onCaptureStart?.();
+        }
+        const note = `no local server on port ${opts.localPort}`;
+        const payload = Buffer.from(JSON.stringify({
+          apiblaze_dev: "captured",
+          message: `No local server on port ${opts.localPort} \u2014 request captured by \`apiblaze dev\`. Start your server and resend to forward it.`,
+          request: { method: f.method, path: f.path }
+        }, null, 2));
+        const headers = { "content-type": "application/json", "x-apiblaze-dev": "captured" };
+        sendResponse(socket, id, 200, headers, payload);
+        opts.onCapture?.({ method: f.method, path: f.path, headers: f.headers, body }, note);
+        record(f, body, 200, true, headers, payload);
+        return;
+      }
+      const message = err?.cause?.message || err?.message || String(err);
       send(socket, { id, type: "err", message });
+      opts.onEntry({ method: f.method, path: f.path, status: 502, latency: Date.now() - f.start });
+      record(f, body, 502, false);
     }
-    opts.onEntry({ method: f.method, path: f.path, status, latency: Date.now() - f.start });
   }
   function send(socket, frame) {
     try {
@@ -500,6 +779,76 @@ function startTunnelClient(opts) {
 }
 
 // src/commands/dev.ts
+async function offerAutoCreate(teamId, port) {
+  if (!process.stdin.isTTY) {
+    console.log(import_chalk3.default.yellow("No projects found with an internal target."));
+    console.log("Point a project at localhost in the dashboard, or run `apiblaze dev` in an interactive terminal to create one automatically.");
+    return null;
+  }
+  const { create } = await import_inquirer.default.prompt([{
+    type: "confirm",
+    name: "create",
+    message: `No project points at this machine. Create a quick dev proxy \u2192 ${import_chalk3.default.bold(`http://localhost:${port}`)} and tunnel it?`,
+    default: true
+  }]);
+  if (!create) return null;
+  const { auth } = await import_inquirer.default.prompt([{
+    type: "list",
+    name: "auth",
+    message: "How should callers authenticate to the new proxy?",
+    choices: [
+      { name: "none \u2014 open to anyone with the URL (simplest)", value: "none" },
+      { name: "api_key \u2014 callers must send an X-API-Key header", value: "api_key" }
+    ],
+    default: "none"
+  }]);
+  let name = randomProxyName();
+  for (let i = 0; i < 8; i++) {
+    const check = await checkProxyName(name, teamId).catch(() => null);
+    if (!check || check.canUseProjectName && check.canUseApiVersion) break;
+    name = randomProxyName();
+  }
+  const spinner = (0, import_ora2.default)(`Creating dev proxy "${name}"...`).start();
+  let result;
+  try {
+    result = await createProxy({ name, target_url: `http://localhost:${port}`, auth_type: auth, team_id: teamId });
+    spinner.succeed(import_chalk3.default.green(`Created dev proxy "${name}".`));
+  } catch (err) {
+    spinner.fail("Failed to create the dev proxy.");
+    throw err;
+  }
+  const version2 = result.api_version || "1.0.0";
+  const endpoint = `https://${name}.apiblaze.com/${version2}/dev`;
+  console.log(`  ${import_chalk3.default.dim("Endpoint:")} ${import_chalk3.default.bold(endpoint)}`);
+  if (auth === "api_key") {
+    const key = result.api_keys?.dev ?? Object.values(result.api_keys ?? {})[0];
+    if (key) {
+      console.log(`  ${import_chalk3.default.dim("API key (dev):")} ${import_chalk3.default.bold.green(key)}`);
+      console.log(import_chalk3.default.dim("  Send it as the X-API-Key header. It may not be shown again."));
+    }
+  }
+  const targets = await getLocalhostTargets(teamId).catch(() => []);
+  const created = targets.find((t) => t.projectId === result.project_id);
+  if (!created) {
+    console.log(import_chalk3.default.yellow("  Proxy created, but it did not appear as a localhost target \u2014 try `apiblaze dev` again."));
+    return null;
+  }
+  return created;
+}
+async function probeLocalServer(port) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1500);
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { method: "HEAD", signal: controller.signal });
+    return true;
+  } catch (err) {
+    if (err?.name === "AbortError") return true;
+    const code = err?.cause?.code;
+    return !(code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH");
+  } finally {
+    clearTimeout(timer);
+  }
+}
 async function runDev(options) {
   const creds = loadCredentials();
   if (!creds) {
@@ -540,13 +889,15 @@ async function runDev(options) {
       throw err;
     }
   }
-  if (targets.length === 0) {
-    console.log(import_chalk3.default.yellow("No projects found with an internal target."));
-    console.log("Set a project's upstream target to localhost or a private IP in your APIblaze dashboard, then try again.");
-    process.exit(0);
-  }
   let selectedTargets;
-  if (targets.length === 1) {
+  if (targets.length === 0) {
+    const created = await offerAutoCreate(teamId, options.port);
+    if (!created) {
+      console.log("Set a project's upstream target to localhost or a private IP, then try again.");
+      process.exit(0);
+    }
+    selectedTargets = [created];
+  } else if (targets.length === 1) {
     const { confirmed } = await import_inquirer.default.prompt([{
       type: "confirm",
       name: "confirmed",
@@ -580,6 +931,14 @@ async function runDev(options) {
 Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
 `)
   );
+  let recordSink;
+  let captureStream;
+  if (options.captureFile) {
+    captureStream = import_fs.default.createWriteStream(options.captureFile, { flags: "a" });
+    recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
+    console.log(import_chalk3.default.gray(`Streaming full traffic to ${options.captureFile}
+`));
+  }
   let restore = [];
   let connect;
   {
@@ -603,11 +962,27 @@ Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
       projectId,
       localPort: options.port,
       onEntry: (entry) => console.log(formatLogLine(entry)),
-      onStatus: (status) => console.log(import_chalk3.default.gray(`[${projectId}] ${status}`))
+      onStatus: (status) => console.log(import_chalk3.default.gray(`[${projectId}] ${status}`)),
+      onCapture: (req, note) => console.log(formatCapturedRequest(req, note)),
+      onCaptureStart: () => console.log(
+        import_chalk3.default.magenta(`
+\u26B2 No local server on port ${options.port} yet \u2014 capturing requests below. Start your server and they'll forward automatically.
+`)
+      ),
+      onResume: () => console.log(
+        import_chalk3.default.green(`
+\u2713 Local server detected on port ${options.port} \u2014 forwarding resumed.
+`)
+      ),
+      onRecord: recordSink
     })
   );
+  const localUp = await probeLocalServer(options.port);
   console.log("\n" + import_chalk3.default.gray("\u2500".repeat(60)));
   console.log(import_chalk3.default.bold("Live traffic") + import_chalk3.default.gray(" (Ctrl+C to stop)"));
+  console.log(
+    localUp ? import_chalk3.default.green(`\u2713 Local server detected on port ${options.port} \u2014 forwarding live.`) : import_chalk3.default.magenta(`\u26B2 Nothing listening on port ${options.port} yet \u2014 requests will be captured until your server starts.`)
+  );
   console.log(import_chalk3.default.gray("\u2500".repeat(60)) + "\n");
   let isCleaningUp = false;
   async function cleanup() {
@@ -615,6 +990,7 @@ Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
     isCleaningUp = true;
     console.log(import_chalk3.default.gray("\n\nShutting down..."));
     for (const client of clients) client.close();
+    captureStream?.end();
     await deleteDevTunnel(restore).catch(() => {
     });
     console.log(import_chalk3.default.green("Tunnel stopped."));
@@ -687,7 +1063,7 @@ ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 }
 
 // src/commands/create.ts
-var import_fs = __toESM(require("fs"));
+var import_fs2 = __toESM(require("fs"));
 var import_chalk5 = __toESM(require("chalk"));
 var import_ora4 = __toESM(require("ora"));
 init_auth();
@@ -922,7 +1298,7 @@ async function runAnonymousCreate(opts) {
   if (opts.config) {
     let raw = "";
     try {
-      raw = import_fs.default.readFileSync(opts.config, "utf8");
+      raw = import_fs2.default.readFileSync(opts.config, "utf8");
     } catch {
       fail(`Cannot read --config file: ${opts.config}`);
     }
@@ -1200,6 +1576,290 @@ async function runTeam(arg) {
 \u2714 Active team: ${import_chalk9.default.bold(chosen.name)}`));
 }
 
+// src/commands/authz.ts
+var import_chalk11 = __toESM(require("chalk"));
+init_auth();
+init_api();
+
+// src/lib/agent-chat.ts
+var import_readline = __toESM(require("readline"));
+var import_chalk10 = __toESM(require("chalk"));
+init_api();
+async function runAgentChatRepl(opts) {
+  const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
+  console.log("\n" + import_chalk10.default.cyan.bold(title));
+  if (subtitle) console.log(import_chalk10.default.dim(subtitle));
+  const messages = [];
+  const ctx = { proposal: null, lastData: null, log: (s) => console.log(s) };
+  const cmdByName = new Map(commands.map((c) => [c.name, c]));
+  const footer = () => {
+    const parts = [
+      import_chalk10.default.dim("type to chat/refine"),
+      ...commands.map((c) => import_chalk10.default.dim(`/${c.name} ${c.describe}`)),
+      import_chalk10.default.dim("/show"),
+      import_chalk10.default.dim("/drop discard & exit")
+    ];
+    return "  " + import_chalk10.default.dim("[ ") + parts.join(import_chalk10.default.dim(" \xB7 ")) + import_chalk10.default.dim(" ]");
+  };
+  async function turn(content) {
+    messages.push({ role: "user", content });
+    process.stdout.write(import_chalk10.default.dim("  \u2026thinking\n"));
+    const { status, data } = await agentCall(endpoint, "POST", { messages, ...buildBody(messages) });
+    if (status === 402) {
+      console.log(import_chalk10.default.red("  Insufficient credits \u2014 top up to keep using the agents.\n"));
+      messages.pop();
+      return;
+    }
+    if (status >= 400 || !data) {
+      console.log(import_chalk10.default.red(`  Error (${status}): ${(data && data.error) ?? "request failed"}
+`));
+      messages.pop();
+      return;
+    }
+    ctx.lastData = data;
+    const reply = data.reply ?? data.message ?? "(no reply)";
+    messages.push({ role: "assistant", content: reply });
+    console.log("\n" + import_chalk10.default.cyan("agent \u203A ") + reply + "\n");
+    if (data.proposal) {
+      ctx.proposal = data.proposal;
+      const summary = summarizeProposal?.(data);
+      if (summary) console.log(import_chalk10.default.yellow("  " + summary));
+      const ready = commands.filter((c) => c.needsProposal).map((c) => `/${c.name}`).join(" or ");
+      if (ready) console.log(import_chalk10.default.dim(`  Ready \u2014 ${ready} to make it official, or keep refining.`));
+      console.log();
+    }
+    const llm = data.llm;
+    if (llm) {
+      const credits = data.credits_remaining;
+      const left = typeof credits === "number" ? ` \xB7 $${(credits / 100).toFixed(2)} credit left` : "";
+      console.log(import_chalk10.default.dim(`  ~$${(llm.cost_estimate ?? 0).toFixed(4)} \xB7 ${llm.model ?? "?"}${left}`));
+    }
+  }
+  const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
+  const ask = (q) => new Promise((res) => rl.question(q, res));
+  await turn(seedPrompt);
+  for (; ; ) {
+    console.log(footer());
+    const line = (await ask(import_chalk10.default.green("you \u203A "))).trim();
+    if (!line) continue;
+    if (line === "/drop" || line === "/exit" || line === "/quit") {
+      console.log(import_chalk10.default.dim("  Dropped \u2014 nothing applied.\n"));
+      break;
+    }
+    if (line === "/show") {
+      if (!ctx.proposal) console.log(import_chalk10.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
+      else console.log("\n" + JSON.stringify(ctx.proposal, null, 2) + "\n");
+      continue;
+    }
+    if (line.startsWith("/")) {
+      const cmd = cmdByName.get(line.slice(1));
+      if (!cmd) {
+        console.log(import_chalk10.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
+`));
+        continue;
+      }
+      if (cmd.needsProposal && !ctx.proposal) {
+        console.log(import_chalk10.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
+        continue;
+      }
+      await cmd.run(ctx);
+      continue;
+    }
+    await turn(line);
+  }
+  rl.close();
+}
+
+// src/commands/authz.ts
+async function runAuthz(projectArg, apiVersionArg) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const teamId = creds.teamId ?? "";
+  const projects = await getProjects(teamId);
+  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
+  if (!match) {
+    throw new Error(`Project "${projectArg}" not found in your active team (${creds.teamName ?? teamId}). Run \`apiblaze projects\`.`);
+  }
+  const projectId = match.projectId;
+  const apiVersion = apiVersionArg || match.apiVersion;
+  const tenant = match.tenant || projectId;
+  async function apply(ctx, enable) {
+    const proposal = ctx.proposal;
+    if (!enable) {
+      const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant)}`, "POST", proposal.model);
+      if (m.status === 404) {
+        ctx.log(import_chalk11.default.red("  Authorization store not provisioned yet. Open the dashboard Authorization tab for this project once (it auto-provisions the store), then re-run.\n"));
+        return;
+      }
+      if (m.status >= 400) {
+        ctx.log(import_chalk11.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
+`));
+        return;
+      }
+    }
+    let ok = 0;
+    let fail4 = 0;
+    for (const r of proposal.routes) {
+      const resource = "/" + String(r.resource || "").replace(/^\/+/, "");
+      const policiesBody = {
+        rule_mode: r.rule_mode === "list" ? "list" : "check-write",
+        on_request_read: Array.isArray(r.on_request_read) ? r.on_request_read : [],
+        post_response_write: Array.isArray(r.post_response_write) ? r.post_response_write : [],
+        list_objects_read: r.list_objects_read ?? null,
+        authentication_config: { require_authentication: true },
+        authorization_enabled: enable
+      };
+      const encoded = resource.replace(/\{/g, "%7B").replace(/\}/g, "%7D");
+      const putPath = `/projects/${projectId}/${apiVersion}/policies/route/${r.method.toUpperCase()}${encoded}`;
+      let res = await agentCall(putPath, "PUT", { ...policiesBody, resource });
+      if (res.status === 404) {
+        res = await agentCall(`/projects/${projectId}/${apiVersion}/policies/route`, "POST", { method: r.method.toUpperCase(), resource, ...policiesBody });
+      }
+      if (res.status >= 200 && res.status < 300) ok++;
+      else fail4++;
+    }
+    if (enable) {
+      const e = await agentCall(`/${projectId}/${apiVersion}/config`, "PATCH", { authorization: { enforce_authorization: true }, tenant });
+      if (e.status >= 400) {
+        ctx.log(import_chalk11.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
+`));
+        return;
+      }
+      ctx.log(import_chalk11.default.green(`  \u2713 Enforcement ON \u2014 ${ok} route(s) + project switch on${fail4 ? `, ${fail4} failed` : ""}.
+`));
+    } else {
+      ctx.log(import_chalk11.default.green(`  \u2713 Published (shadow): model + ${ok} route(s)${fail4 ? `, ${fail4} failed` : ""}. Review, then /enable.
+`));
+    }
+  }
+  await runAgentChatRepl({
+    title: `Authorization assistant \u2014 ${projectId} ${apiVersion}`,
+    subtitle: `tenant ${tenant} \xB7 discuss what authorization fits this API, then make it official.`,
+    endpoint: `/projects/${projectId}/${apiVersion}/authz/chat`,
+    buildBody: () => ({ included_sample_ids: [], existing_model: null, existing_routes: [] }),
+    seedPrompt: "Analyze this API and tell me what authorization is feasible. If it is read-only, say so plainly. Then propose options \u2014 do not generate rules yet.",
+    summarizeProposal: (data) => {
+      const proposal = data.proposal;
+      const sim = data.simulation;
+      const cov = sim ? `, ${sim.routes_covered ?? 0} covered by rules` : "";
+      const warn = sim?.blocked_without_backfill ? ` \u26A0 ${sim.blocked_without_backfill} currently-OK request(s) would be denied until tuples exist.` : "";
+      return `Proposal ready: ${proposal.routes.length} route(s)${cov}.${warn}`;
+    },
+    commands: [
+      { name: "publish", describe: "save in shadow mode", needsProposal: true, run: (ctx) => apply(ctx, false) },
+      { name: "enable", describe: "turn on enforcement", needsProposal: true, run: (ctx) => apply(ctx, true) }
+    ]
+  });
+}
+
+// src/commands/openapi.ts
+var import_chalk12 = __toESM(require("chalk"));
+init_auth();
+init_api();
+async function runOpenapi(projectArg, apiVersionArg) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const projects = await getProjects(creds.teamId ?? "");
+  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
+  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
+  const projectId = match.projectId;
+  const apiVersion = apiVersionArg || match.apiVersion;
+  console.log(import_chalk12.default.dim("Gathering captured traffic samples\u2026"));
+  const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
+  if (routesRes.status >= 400) {
+    console.log(import_chalk12.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
+    return;
+  }
+  const routes = routesRes.data?.routes ?? (Array.isArray(routesRes.data) ? routesRes.data : []);
+  const hashes = routes.map((r) => r.route_hash).filter((h) => !!h);
+  const ids = /* @__PURE__ */ new Set();
+  for (const h of hashes) {
+    const s = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes/${encodeURIComponent(h)}/samples`, "GET");
+    const arr = s.data?.samples ?? [];
+    for (const x of arr) if (x.sample_id) ids.add(x.sample_id);
+  }
+  const sampleIds = [...ids];
+  if (sampleIds.length === 0) {
+    console.log(import_chalk12.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
+    return;
+  }
+  async function publish(ctx) {
+    const patch = ctx.proposal.patch;
+    if (!Array.isArray(patch) || patch.length === 0) {
+      ctx.log(import_chalk12.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
+      return;
+    }
+    const specSource = ctx.lastData?.spec_source ?? "unknown";
+    const endpoint = specSource === "github" ? "open-pr" : "publish-openapi";
+    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/samples/${endpoint}`, "POST", { patch, sample_ids_used: sampleIds });
+    if (pub.status >= 400) {
+      ctx.log(import_chalk12.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+`));
+      return;
+    }
+    const prUrl = pub.data?.pr_url;
+    ctx.log(import_chalk12.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
+` : "  \u2713 Published updated OpenAPI spec.\n"));
+  }
+  await runAgentChatRepl({
+    title: `API-docs assistant \u2014 ${projectId} ${apiVersion}`,
+    subtitle: `${sampleIds.length} captured sample(s) \xB7 discuss what to document, then make it official.`,
+    endpoint: `/projects/${projectId}/${apiVersion}/openapi/chat`,
+    buildBody: () => ({ included_sample_ids: sampleIds }),
+    seedPrompt: "Compare the captured samples against the current spec and tell me what's missing or wrong. List the changes you'd make \u2014 don't produce a patch yet.",
+    summarizeProposal: (data) => {
+      const patch = data.proposal.patch;
+      const n = Array.isArray(patch) ? patch.length : 0;
+      return n === 0 ? "The spec already covers the observed traffic \u2014 nothing to publish." : `Patch ready: ${n} additive change(s) to the OpenAPI spec.`;
+    },
+    commands: [
+      { name: "publish", describe: "publish / open PR", needsProposal: true, run: publish }
+    ]
+  });
+}
+
+// src/commands/mcp.ts
+var import_chalk13 = __toESM(require("chalk"));
+init_auth();
+init_api();
+async function runMcp(projectArg, apiVersionArg, opts) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const projects = await getProjects(creds.teamId ?? "");
+  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
+  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
+  const projectId = match.projectId;
+  const apiVersion = apiVersionArg || match.apiVersion;
+  const environment = opts.environment || "prod";
+  async function publish(ctx) {
+    const spec = ctx.proposal;
+    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec });
+    if (pub.status >= 400) {
+      ctx.log(import_chalk13.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+`));
+      return;
+    }
+    ctx.log(import_chalk13.default.green(`  \u2713 Published MCP server \u2014 ${projectId}.mcp.apiblaze.com/${apiVersion}/${environment}.
+`));
+  }
+  await runAgentChatRepl({
+    title: `MCP builder \u2014 ${projectId} ${apiVersion} (${environment})`,
+    subtitle: "discuss which routes to expose as tools, then make the catalogue official.",
+    endpoint: `/projects/${projectId}/${apiVersion}/mcp/chat`,
+    buildBody: () => ({ environment, included_sample_ids: [] }),
+    seedPrompt: "Look at this API's routes and recommend which should become MCP tools, with good names and descriptions. Don't finalize yet \u2014 explain first.",
+    summarizeProposal: (data) => {
+      const spec = data.proposal;
+      const tools = Array.isArray(spec.tools) ? spec.tools : [];
+      const names = tools.slice(0, 12).map((t) => t.name ?? "(unnamed)").join(", ");
+      return `Catalogue ready: ${tools.length} tool(s)${names ? ` \u2014 ${names}${tools.length > 12 ? ", \u2026" : ""}` : ""}.`;
+    },
+    commands: [
+      { name: "publish", describe: `to ${projectId}.mcp.apiblaze.com`, needsProposal: true, run: publish }
+    ]
+  });
+}
+
 // src/index.ts
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version);
@@ -1259,14 +1919,38 @@ program.command("projects").description("List the projects in your team").action
     process.exit(1);
   }
 });
-program.command("dev").description("Start a dev tunnel for your localhost projects").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").action(async (port, opts) => {
+program.command("authz").description("Design API authorization interactively (chat), then publish + enable it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").action(async (project, apiVersion) => {
+  try {
+    await runAuthz(project, apiVersion);
+  } catch (err) {
+    printError(err);
+    process.exit(1);
+  }
+});
+program.command("openapi").description("Design your OpenAPI spec from captured traffic interactively (chat), then publish it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").action(async (project, apiVersion) => {
+  try {
+    await runOpenapi(project, apiVersion);
+  } catch (err) {
+    printError(err);
+    process.exit(1);
+  }
+});
+program.command("mcp").description("Design an MCP server from the spec + traffic interactively (chat), then publish it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").option("--environment <env>", "Environment to publish (default: prod)").action(async (project, apiVersion, opts) => {
+  try {
+    await runMcp(project, apiVersion, opts);
+  } catch (err) {
+    printError(err);
+    process.exit(1);
+  }
+});
+program.command("dev").description("Start a dev tunnel for your localhost projects").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk10.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk14.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
-    await runDev({ port: resolved });
+    await runDev({ port: resolved, captureFile: opts.captureFile });
   } catch (err) {
     printError(err);
     process.exit(1);
@@ -1286,23 +1970,27 @@ Examples:
   $ npx apiblaze login
   $ npx apiblaze create --name myapi --target https://api.example.com --auth api_key
 
+  # Dev tunnel \u2014 auto-creates a proxy if none point here, and captures
+  # traffic (full headers + body, secrets masked) until your server is up:
+  $ npx apiblaze dev 3000
+  $ npx apiblaze dev 3000 --capture-file traffic.jsonl
+
   # Manage:
   $ npx apiblaze whoami
   $ npx apiblaze projects
   $ npx apiblaze team
-  $ npx apiblaze dev 3000
   $ npx apiblaze logout
 `
 );
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk10.default.red(`
+    console.error(import_chalk14.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk10.default.red(`
+    console.error(import_chalk14.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk10.default.red("\nUnknown error"));
+    console.error(import_chalk14.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
   "keywords": [
     "apiblaze",