apiblaze 0.21.13 → 0.21.14

package/dist/index.js

@@ -978,7 +978,7 @@ async function runAdminsAdd(email, opts) {
     else if (!opts.quiet) {
       console.log(import_chalk15.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
       console.log(import_chalk15.default.dim(`  The widget's admin lane takes a personal key, one per admin \u2014 mint it with:`));
-      console.log(import_chalk15.default.dim(`    npx apiblaze apikeys mint --for ${email} --tenant ${tenant2}`));
+      console.log(import_chalk15.default.dim(`    npx apiblaze apikeys mint --for ${email} --tenant ${tenant2} --admin`));
       console.log(import_chalk15.default.dim("  (a backend/tenant key with X-End-User-Id is refused there: widget_key_must_be_personal)."));
     }
     return out ?? { ok: true };
@@ -1342,7 +1342,7 @@ var import_commander = require("commander");
 var import_chalk64 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.21.13";
+var version = "0.21.14";
 
 // src/index.ts
 init_types();
@@ -4847,17 +4847,18 @@ async function mintConsumerKey(o) {
   if (!tenant2) {
     throw new Error(who ? "--for needs a tenant: add --tenant <slug> (the tenant whose person this key is for)." : `a ${o.holder ?? "backend"} key is a consumer key: add --tenant <slug> (the tenant it calls).`);
   }
-  const environment = (o.env ?? "").trim() || "dev";
+  if (o.admin && !who) throw new Error("--admin needs --for <admin email>: the admin lane only opens for a key issued to that admin.");
+  const environment = (o.env ?? "").trim() || (o.admin ? "prod" : "dev");
   const holder = who ? "person" : o.holder ?? "backend";
-  const permissions = holder === "person" ? void 0 : holderPermissions(holder);
+  const permissions = holder === "person" ? o.admin ? ["call", "manage-access"] : void 0 : holderPermissions(holder);
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, o.team);
   const body = { tenant: tenant2, environment };
   if (o.desc) body.description = o.desc;
   if (o.expiresDays) body.expires_in_seconds = Number(o.expiresDays) * 24 * 60 * 60;
   if (permissions) {
-    body.holder = holder;
     body.permissions = permissions;
+    if (holder !== "person") body.holder = holder;
   }
   const headers = { "Content-Type": "application/json" };
   if (who) {
@@ -4925,6 +4926,7 @@ async function runConsumerKeyMint(opts) {
       team: opts.team,
       desc: opts.desc,
       expiresDays: opts.expiresDays,
+      admin: opts.admin,
       ...kind === "person" ? {} : { holder: kind }
     });
     spinner.succeed(who ? `Key minted for ${who}.` : `${kind === "client" ? "Client" : "Backend"} key minted.`);
@@ -4942,6 +4944,7 @@ async function runConsumerKeyMint(opts) {
   if (out.expiresAt) console.log(`  ${import_chalk14.default.dim("expires:")} ${out.expiresAt}`);
   if (out.holder === "person") {
     console.log(`  ${import_chalk14.default.dim("issued to:")} ${out.person} ${import_chalk14.default.dim("\u2014 calls made with this key count as this person; an X-End-User-Id naming anyone else is refused")}`);
+    if (opts.admin) console.log(`  ${import_chalk14.default.dim("admin key:")} ${import_chalk14.default.dim("manage-access \u2014 put it in APIBLAZE_CP_KEY for the Users & Groups widget, one key per admin")}`);
   } else {
     console.log(`  ${import_chalk14.default.cyan(holderLine(out.holder))}`);
     console.log(import_chalk14.default.dim(out.holder === "backend" ? "  (For a key you ship to users, re-mint with --client; to bind one to a person, --for <email>.)" : "  (For your server, re-mint with --backend; to bind one to a person, --for <email>.)"));
@@ -10341,6 +10344,7 @@ function describe(r) {
     return `set ${a.destination} = ${secret ? "(secret)" : a.value}`;
   }
   if (a.type === "remove") return `remove ${a.field}`;
+  if (a.type === "map") return `map ${a.source} \u2192 ${a.destination}${a.lookup?.mapping_id ? " (through a mapping table)" : ""}`;
   return a.type;
 }
 async function runTransformList(project, opts) {
@@ -10405,6 +10409,66 @@ async function runTransformRemove(project, nameOrId, opts) {
   if (opts.json) console.log(JSON.stringify({ ok: true, removed: rule.id }));
   else console.log(`${import_chalk44.default.green("\u2713")} Removed transform ${import_chalk44.default.bold(rule.name)} from ${t.proj.projectName}.`);
 }
+function tablesBase(t) {
+  return t.base.replace(/\/transforms$/, "/mappings");
+}
+async function listTables(t) {
+  const out = await producer(t.caller, {
+    method: "GET",
+    path: tablesBase(t),
+    summary: `List mapping tables for ${t.proj.projectName}`
+  });
+  return out?.tables ?? [];
+}
+function parseEntries(pairs) {
+  return pairs.map((p) => {
+    const i = p.indexOf("=");
+    if (i <= 0) throw new Error(`"${p}" is not a from=to pair (e.g. FR=EUR).`);
+    return { from: p.slice(0, i), to: p.slice(i + 1) };
+  });
+}
+var FIELD_REF = /^(header|query|param|bodyvar|jwt):.+/;
+async function runTransformMapping(project, table, pairs, opts) {
+  if (!pairs.length) throw new Error("Give at least one from=to pair, e.g. FR=EUR US=USD.");
+  const entries2 = parseEntries(pairs);
+  const t = await target(project, opts);
+  const existing = (await listTables(t)).find((m) => m.name === table);
+  const body = { name: table, entries: entries2, ...opts.secret ? { encrypt_values: true } : {} };
+  const summary = `${existing ? "Replace" : "Create"} mapping table "${table}" (${entries2.length} entr${entries2.length === 1 ? "y" : "ies"})`;
+  const out = await producer(t.caller, existing ? { method: "PUT", path: `${tablesBase(t)}/${encodeURIComponent(existing.id)}`, body, summary } : { method: "POST", path: tablesBase(t), body, summary });
+  if (opts.json) {
+    console.log(JSON.stringify(out ?? { ok: true }));
+    return;
+  }
+  console.log(`${import_chalk44.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
+  for (const e of entries2) console.log(import_chalk44.default.dim(`    ${e.from} \u2192 ${opts.secret ? "(secret)" : e.to}`));
+}
+async function runTransformMap(project, source, destination, opts) {
+  if (!FIELD_REF.test(source)) throw new Error(`Source "${source}" must look like header:X-Country, query:country or bodyvar:order.country.`);
+  if (!/^(header|query|bodyvar):.+/.test(destination)) throw new Error(`Destination "${destination}" must look like header:X-Currency, query:currency or bodyvar:order.currency.`);
+  if (!opts.table) throw new Error("--table <name> is required: the mapping table to look the value up in (create it with `transform mapping`).");
+  const onNoMatch = opts.onNoMatch ?? "skip";
+  if (!["skip", "fail", "passthrough"].includes(onNoMatch)) throw new Error("--on-no-match is skip, fail or passthrough.");
+  const t = await target(project, opts);
+  const table = (await listTables(t)).find((m) => m.name === opts.table);
+  if (!table) throw new Error(`No mapping table "${opts.table}" on ${t.proj.projectName}. Create it: npx apiblaze transform mapping ${project} ${opts.table} FR=EUR \u2026`);
+  const name = `map ${source} to ${destination}`;
+  const action2 = {
+    type: "map",
+    source,
+    destination,
+    lookup: { mapping_id: table.id, on_no_match: onNoMatch }
+  };
+  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
+  const summary = `${existing ? "Update" : "Add"} transform: ${source} \u2192 ${destination} through "${table.name}"`;
+  const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action: action2, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action: action2, phase: "request", enabled: true }, summary });
+  if (opts.json) {
+    console.log(JSON.stringify(out ?? { ok: true }));
+    return;
+  }
+  console.log(`${import_chalk44.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
+  console.log(import_chalk44.default.dim(`  A value not in the table: ${onNoMatch === "skip" ? "nothing is written" : onNoMatch === "fail" ? "the call is refused" : "it is copied as-is"}.`));
+}
 
 // src/commands/config-browse.ts
 var import_chalk53 = __toESM(require("chalk"));
@@ -14771,6 +14835,11 @@ transform.command("set-header").description("Send a header with a fixed value to
 Example \u2014 lock your backend to the proxy:
   export TARGET_SERVER_SECRET=$(openssl rand -hex 24)   # also give it to your backend
   apiblaze transform set-header shop x-target-api-key --value-env TARGET_SERVER_SECRET --secret`).action(action((project, header, opts) => runTransformSetHeader(project, header, opts)));
+transform.command("mapping").description("Create or replace a lookup table for map transforms, e.g. country code \u2192 currency").argument("<project>", "Project name or id").argument("<table>", "Table name, e.g. currencies").argument("<pairs...>", "from=to pairs, e.g. FR=EUR US=USD GB=GBP").option("--secret", "Store the values encrypted and never show them again").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, table, pairs, opts) => runTransformMapping(project, table, pairs, opts)));
+transform.command("map").description("Rewrite a value through a mapping table on its way to the backend, e.g. header:X-Country \u2192 header:X-Currency").argument("<project>", "Project name or id").argument("<source>", "Where to read: header:X-Country \xB7 query:country \xB7 bodyvar:order.country").argument("<destination>", "Where to write: header:X-Currency \xB7 query:currency \xB7 bodyvar:order.currency").requiredOption("--table <name>", "The mapping table to look the value up in").option("--on-no-match <mode>", "skip (default) \xB7 fail \xB7 passthrough").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").addHelpText("after", `
+Example \u2014 the backend wants a currency, callers send a country:
+  apiblaze transform mapping shop currencies FR=EUR US=USD GB=GBP
+  apiblaze transform map shop header:X-Country header:X-Currency --table currencies`).action(action((project, source, destination, opts) => runTransformMap(project, source, destination, opts)));
 transform.command("remove").description("Remove a transform by name, id, or header name").argument("<project>", "Project name or id").argument("<rule>", "Rule name, id, or the header a set-header rule sets").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, rule, opts) => runTransformRemove(project, rule, opts)));
 program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
 var domain = program.command("domain").description("Use your own domain for your API, MCP server, developer portal or login pages (billed monthly)");
@@ -14814,7 +14883,7 @@ program.command("iam").description("Turn users & groups on/off for a proxy's ten
 program.command("identified").description("Require calls to identify their end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
 var apikeys = new import_commander.Command("apikeys").description("API keys \u2014 for your team (control plane), or with `mint --tenant` for your API's callers: a backend key, a client key (--client) or a key bound to one person (--for)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
 apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyList({ ...cmd.parent?.opts(), ...opts })));
-apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant: a backend key (default), a client key (--client) or a person-bound key (--for)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--backend", `Backend key (default). ${HOLDER_HELP.backend}`).option("--client", `Client key. ${HOLDER_HELP.client} Needs --tenant.`).option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. The Users & Groups widget's admin lane accepts only such a key, one per admin. Needs --tenant.").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
+apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant: a backend key (default), a client key (--client) or a person-bound key (--for)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--backend", `Backend key (default). ${HOLDER_HELP.backend}`).option("--client", `Client key. ${HOLDER_HELP.client} Needs --tenant.`).option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. The Users & Groups widget's admin lane accepts only such a key, one per admin. Needs --tenant.").option("--admin", "With --for: the key a tenant admin uses in the Users & Groups widget (adds manage-access; env defaults to prod)").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev, prod with --admin)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
 apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts, cmd) => runKeyRevoke(keyId, { ...cmd.parent?.opts(), ...opts })));
 program.addCommand(apikeys);
 var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "latency | billing | mark | credits | residue | sweep | test | perf (omit for the menu)").argument("[view]", "for `latency`: slow | llm | compare | grades \xB7 for `billing`: doors | meter \xB7 for `mark`: the change name, quoted").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").option("--hours <n>", "Look-back window in hours (default 1)").option("--team <id>", "Filter to one team").option("--only <ids>", "for `test`: comma-separated spec/gut ids or prefixes").option("--group <name>", "for `test`: only specs whose group matches").option("--skip-guts", "for `test`: contract specs only").option("--guts-only", "for `test`: server-side gut checks only").option("--fail-fast", "for `test`: stop at the first failure").option("--timeout <s>", "for `test`: seconds to wait per check (default 150)").option("--perf", "for `test`: run the performance gate instead of the suite (fixed-rate load on a sandbox proxy)").option("--consumer", "for `test`: probe the data plane with the stored `consumer login` token instead of the suite").option("--path <p>", "for `test --consumer`: request path on the proxy (default /get)").option("--proxy <name@version>", "for `test --consumer`: the OAuth-door proxy to knock on (default: the sandbox proxy for a sandbox-tenant session)").option("--rps <n>", "for `test --perf`: requests per second (default 100, max 300)").option("--seconds <n>", "for `test --perf`: how long to send for (default 60, max 300)").option("--url <url>", "for `test --perf`: load this fixture URL instead of provisioning one (with --key; nothing is torn down)").option("--max-p50 <ms>", "for `test --perf`: client p50 threshold (default 250)").option("--max-p95 <ms>", "for `test --perf`: client p95 threshold (default 800)").option("--max-error-rate <pct>", "for `test --perf`: error-rate threshold in percent (default 0.5)").option("--max-gateway-p50 <ms>", "for `test --perf`: apiblaze-overhead p50 threshold (default 60)").option("--max-gateway-p95 <ms>", "for `test --perf`: apiblaze-overhead p95 threshold (default 250)").option("--project <name>", "Filter to one proxy").option("--api-version <v>", "Filter to one API version").option("--tenant <name>", "Filter to one tenant").option("--route <path>", "Filter to one route").option("--environment <env>", "Filter to one environment").option("--status-class <c>", "Filter to a status class (2xx/4xx/5xx)").option("--min-ms <n>", "For `latency slow`: minimum duration (default 1000)").option("--days <n>", "For `latency grades`: how many days back (default 7)").option("--excellent <ms>", "Grade threshold: under this is excellent (default 250)").option("--okay <ms>", "Grade threshold: under this is okay (default 500)").option("--bad <ms>", "Grade threshold: under this is bad, at/over is terrible (default 1000)").option("--key <key>", "For `billing meter`: a data-plane API key for the sandbox proxy (without it the served-request checks are SKIPPED) \xB7 for `test --perf --url`: the fixture's API key").option("--count <n>", "For `billing meter`: requests per check (default 3, max 10)").option("--mcp-host <host>", "For `billing meter`: an MCP host to check tools/call is charged once").action(action((sub, view, opts) => runOp(sub, opts, view))).addHelpText("after", () => `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.13",
+  "version": "0.21.14",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",