apiblaze 0.21.15 → 0.21.17

package/dist/index.js

@@ -1347,12 +1347,12 @@ var init_tenant_pick = __esm({
 });
 
 // src/index.ts
-var import_fs5 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_commander = require("commander");
 var import_chalk67 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.21.15";
+var version = "0.21.17";
 
 // src/index.ts
 init_types();
@@ -6736,6 +6736,7 @@ var CP_TOOLS = [
 function skillMarkdown() {
   const P = B.product;
   const cli = B.cli;
+  const LIB = "apiblaze";
   const other = BRAND === "mcpblaze" ? "APIblaze" : "MCPblaze";
   const doors = BRAND === "mcpblaze" ? `${P} ships your code to agents (an MCP server); ${other} ships the same code to users (API keys + sign-in).` : `${P} ships your code to users (API keys + sign-in); ${other} ships the same code to agents (an MCP server).`;
   return `---
@@ -6807,7 +6808,7 @@ ship; \`/\` is the same thing behind ${P}. Narrate each step in one line and sho
 \`npx ${cli}\` command \u2014 the commands are the product. Everything goes in \`${cli}-demo/\`.
 
 1. **Scaffold.** \`npx create-next-app@latest ${cli}-demo\` (TypeScript, App Router). Then
-   \`npm i hono ${cli}\`.
+   \`npm i hono ${LIB}\`.
 2. **The backend.** Hono mounted at \`app/api/[[...route]]/route.ts\` (\`import { handle } from
    'hono/vercel'\`). Three resources \u2014 restaurants, tables, reservations \u2014 in an in-memory Map,
    every row stamped with \`owner\` = the \`x-abz-user-id\` header (${P} sets it on every call it
@@ -6835,8 +6836,8 @@ ship; \`/\` is the same thing behind ${P}. Narrate each step in one line and sho
 6. **/.** \`app/page.tsx\`: the same UI, plus a **user picker** (ana \xB7 ben \xB7 admin \u2014 a select, no
    real login; the demo is about authorization, not building sign-in). Its server route calls
    \`process.env.APIBLAZE_URL\` with \`X-API-Key: APIBLAZE_SERVER_KEY\` and \`X-End-User-Id: <the
-   picked user>\`. Add the three widgets from \`${cli}/react\`, each with its server route:
-   - \`<ApiKeyWidget />\` + \`app/api/apiblaze/keys/route.ts\` (\`createApiblazeKeys\` from \`${cli}/server\`)
+   picked user>\`. Add the three widgets from \`${LIB}/react\`, each with its server route:
+   - \`<ApiKeyWidget />\` + \`app/api/apiblaze/keys/route.ts\` (\`createApiblazeKeys\` from \`${LIB}/server\`)
    - \`<UsersGroupsWidget />\` + \`app/api/apiblaze/groups/route.ts\` (\`createApiblazeGroups\` \u2014
      the keys route with one word changed)
    - \`<ChatWidget />\` + \`app/api/apiblaze/chat/route.ts\` (\`createApiblazeChat\`)
@@ -7919,6 +7920,7 @@ async function runOpenapi(projectArg, apiVersionArg) {
 }
 
 // src/commands/mcp.ts
+var import_fs4 = __toESM(require("fs"));
 var import_chalk33 = __toESM(require("chalk"));
 init_auth();
 init_api();
@@ -7960,6 +7962,234 @@ async function runMcp(projectArg, apiVersionArg, opts) {
     ]
   });
 }
+var PROMPT_NAME_RE = /^[a-z0-9_-]{1,64}$/;
+function derivedBehavior(method) {
+  const m = (method ?? "").toUpperCase();
+  const destructive = m === "DELETE";
+  return {
+    readOnly: m === "GET" || m === "HEAD" || m === "OPTIONS",
+    destructive,
+    idempotent: m === "PUT" || m === "DELETE",
+    confirm: destructive,
+    alwaysAsync: false
+  };
+}
+function effectiveBehavior(method, o) {
+  const d = derivedBehavior(method);
+  const readOnly = o?.readOnly ?? d.readOnly;
+  const destructive = readOnly ? false : o?.destructive ?? d.destructive;
+  return {
+    readOnly,
+    destructive,
+    idempotent: o?.idempotent ?? d.idempotent,
+    confirm: o?.confirm ?? destructive,
+    alwaysAsync: o?.alwaysAsync ?? false
+  };
+}
+function uiResourceUri(projectId, toolName) {
+  return `ui://${projectId}/${toolName}`;
+}
+function normalizePrompt(name, raw) {
+  if (!PROMPT_NAME_RE.test(name)) throw new Error(`Prompt name "${name}" must match ${PROMPT_NAME_RE} (lowercase letters, digits, _ and -).`);
+  const p = raw ?? {};
+  if (typeof p !== "object" || Array.isArray(p)) throw new Error("The prompt file must hold one JSON object.");
+  let messages = p.messages;
+  if (!Array.isArray(messages) && typeof p.text === "string") messages = [{ role: "user", text: p.text }];
+  if (!Array.isArray(messages) || messages.length === 0) throw new Error('The prompt needs "messages": [{ "role": "user", "text": "\u2026" }] (or a "text" shorthand).');
+  for (const m of messages) {
+    if (!m || m.role !== "user" && m.role !== "assistant" || typeof m.text !== "string" || !m.text) {
+      throw new Error('Each message needs role "user" | "assistant" and a non-empty "text".');
+    }
+  }
+  if (p.arguments !== void 0 && (!Array.isArray(p.arguments) || p.arguments.some((a) => !a || typeof a.name !== "string"))) {
+    throw new Error('"arguments" must be [{ "name": "\u2026", "description"?: "\u2026", "required"?: true }].');
+  }
+  return {
+    name,
+    ...typeof p.title === "string" ? { title: p.title } : {},
+    ...typeof p.description === "string" ? { description: p.description } : {},
+    ...Array.isArray(p.arguments) ? { arguments: p.arguments } : {},
+    messages
+  };
+}
+function withPrompt(cat, prompt) {
+  const prompts = [...cat.prompts ?? []];
+  const i = prompts.findIndex((p) => p.name === prompt.name);
+  if (i >= 0) prompts[i] = prompt;
+  else prompts.push(prompt);
+  return { ...cat, prompts };
+}
+function withoutPrompt(cat, name) {
+  const prompts = cat.prompts ?? [];
+  if (!prompts.some((p) => p.name === name)) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list\`.`);
+  return { ...cat, prompts: prompts.filter((p) => p.name !== name) };
+}
+function requireTool(cat, tool) {
+  if (!cat.tools.some((t) => t.name === tool)) {
+    const names = cat.tools.slice(0, 10).map((t) => t.name).join(", ");
+    throw new Error(`No tool named "${tool}" in the published catalogue${names ? ` (tools: ${names}${cat.tools.length > 10 ? ", \u2026" : ""})` : ""}.`);
+  }
+}
+function withOverride(cat, tool, flags) {
+  requireTool(cat, tool);
+  const patch = {};
+  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
+    if (typeof flags[k] === "boolean") patch[k] = flags[k];
+  }
+  if (Object.keys(patch).length === 0) {
+    throw new Error("Nothing to set. Pass --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+  }
+  return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
+}
+function withoutOverride(cat, tool) {
+  requireTool(cat, tool);
+  const overrides = { ...cat.overrides ?? {} };
+  delete overrides[tool];
+  return { ...cat, overrides };
+}
+function flagsLine(b) {
+  const f = [];
+  if (b.readOnly) f.push("read-only");
+  if (b.idempotent) f.push("idempotent");
+  if (b.destructive) f.push("destructive");
+  if (b.confirm) f.push("asks to confirm");
+  if (b.alwaysAsync) f.push("always async");
+  return f.length ? f.join(", ") : "\u2014";
+}
+function renderOps(cat) {
+  const rows = cat.tools.map((t) => {
+    const method = t["x-route"]?.method?.toUpperCase() ?? "";
+    const o = cat.overrides?.[t.name];
+    return { name: t.name, route: `${method} ${t["x-route"]?.path ?? ""}`.trim(), eff: flagsLine(effectiveBehavior(method, o)), custom: !!o && Object.keys(o).length > 0 };
+  });
+  const w = Math.min(40, Math.max(4, ...rows.map((r) => r.name.length)));
+  const rw = Math.min(40, Math.max(5, ...rows.map((r) => r.route.length)));
+  return rows.map((r) => `  ${r.name.padEnd(w)}  ${r.route.padEnd(rw)}  ${r.eff}${r.custom ? import_chalk33.default.yellow("  (override)") : ""}`);
+}
+async function resolveMcpTarget(projectArg, opts) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const projects = await getProjects(creds.teamId ?? "");
+  const matches2 = projects.filter((p) => p.projectId === projectArg || p.projectName === projectArg);
+  const wanted = opts.apiversion ?? opts.version;
+  const match = (wanted ? matches2.find((p) => p.apiVersion === wanted) : matches2[0]) ?? null;
+  if (!match) throw new Error(`Project "${projectArg}"${wanted ? ` version ${wanted}` : ""} not found in your active team. Run \`${B.cli} projects\`.`);
+  return { projectId: match.projectId, apiVersion: wanted || match.apiVersion, environment: opts.environment || "prod" };
+}
+async function loadCatalogue(t) {
+  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec?environment=${encodeURIComponent(t.environment)}`, "GET");
+  if (r.status >= 400) throw new Error(`Could not read the MCP catalogue (${r.status}): ${r.data?.error ?? ""}`);
+  const spec2 = r.data?.spec;
+  if (!spec2 || !Array.isArray(spec2.tools)) {
+    throw new Error(`No MCP catalogue published for ${t.projectId} ${t.apiVersion} (${t.environment}). Try --environment, or build one with \`${B.cli} agent mcp ${t.projectId}\`.`);
+  }
+  return spec2;
+}
+async function saveCatalogue(t, spec2) {
+  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec`, "PUT", { environment: t.environment, spec: spec2 });
+  if (r.status >= 400) {
+    const d = r.data;
+    throw new Error(`Save failed (${r.status}): ${d?.error ?? ""}${d?.details ? ` \u2014 ${typeof d.details === "string" ? d.details : JSON.stringify(d.details)}` : ""}`);
+  }
+}
+async function runMcpPrompts(action2, project, name, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  const prompts = cat.prompts ?? [];
+  if (action2 === "list") {
+    if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, prompts }, null, 2));
+    if (!prompts.length) {
+      console.log(import_chalk33.default.dim(`
+  No prompts on ${t.projectId} (${t.environment}). Prompts are drafted by the MCP agent (\`${B.cli} agent mcp ${t.projectId}\`) or added with \`${B.cli} mcp prompts set\`.
+`));
+      return;
+    }
+    console.log("");
+    for (const p of prompts) {
+      const args = (p.arguments ?? []).map((a) => a.required ? a.name : `${a.name}?`).join(", ");
+      console.log(`  ${import_chalk33.default.bold(p.name)}${args ? import_chalk33.default.dim(`(${args})`) : ""}${p.title || p.description ? `  ${p.title ?? p.description}` : ""}`);
+    }
+    console.log("");
+    return;
+  }
+  if (!name) throw new Error(`Usage: ${B.cli} mcp prompts ${action2} <project> <name>`);
+  if (action2 === "show") {
+    const p = prompts.find((x) => x.name === name);
+    if (!p) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list ${project}\`.`);
+    if (opts.json) return void console.log(JSON.stringify(p, null, 2));
+    console.log(`
+  ${import_chalk33.default.bold(p.name)}${p.title ? ` \u2014 ${p.title}` : ""}`);
+    if (p.description) console.log(`  ${p.description}`);
+    for (const a of p.arguments ?? []) console.log(import_chalk33.default.dim(`    ${a.name}${a.required ? " (required)" : ""}${a.description ? `: ${a.description}` : ""}`));
+    for (const m of p.messages) console.log(`
+  [${m.role}] ${m.text}`);
+    console.log("");
+    return;
+  }
+  let next;
+  if (action2 === "set") {
+    if (!opts.file) throw new Error(`Usage: ${B.cli} mcp prompts set <project> <name> --file prompt.json`);
+    let raw;
+    try {
+      raw = JSON.parse(import_fs4.default.readFileSync(opts.file, "utf8"));
+    } catch (e) {
+      throw new Error(`Could not read ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    next = withPrompt(cat, normalizePrompt(name, raw));
+  } else {
+    next = withoutPrompt(cat, name);
+  }
+  await saveCatalogue(t, next);
+  if (opts.json) return void console.log(JSON.stringify({ saved: true, environment: t.environment, prompts: next.prompts }, null, 2));
+  console.log(import_chalk33.default.green(`  \u2713 ${action2 === "set" ? "Saved" : "Removed"} prompt "${name}" on ${t.projectId} (${t.environment}).`));
+}
+async function runMcpOps(action2, project, tool, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  if (action2 === "list") {
+    if (opts.json) {
+      const tools = cat.tools.map((x) => {
+        const method2 = x["x-route"]?.method?.toUpperCase();
+        return {
+          name: x.name,
+          method: method2,
+          path: x["x-route"]?.path,
+          default: derivedBehavior(method2),
+          override: cat.overrides?.[x.name] ?? null,
+          effective: effectiveBehavior(method2, cat.overrides?.[x.name])
+        };
+      });
+      return void console.log(JSON.stringify({ environment: t.environment, tools }, null, 2));
+    }
+    console.log(import_chalk33.default.dim(`
+  ${cat.tools.length} tool(s) on ${t.projectId} (${t.environment}). Defaults come from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm.
+`));
+    for (const l of renderOps(cat)) console.log(l);
+    console.log(import_chalk33.default.dim(`
+  Override: ${B.cli} mcp ops set ${project} <tool> --read-only | --destructive | --confirm | --no-confirm | --always-async   \xB7   Reset: ${B.cli} mcp ops reset ${project} <tool>
+`));
+    return;
+  }
+  if (!tool) throw new Error(`Usage: ${B.cli} mcp ops ${action2} <project> <tool>`);
+  const next = action2 === "set" ? withOverride(cat, tool, opts) : withoutOverride(cat, tool);
+  await saveCatalogue(t, next);
+  const method = cat.tools.find((x) => x.name === tool)?.["x-route"]?.method;
+  const eff = effectiveBehavior(method, next.overrides?.[tool]);
+  if (opts.json) return void console.log(JSON.stringify({ saved: true, tool, override: next.overrides?.[tool] ?? null, effective: eff }, null, 2));
+  console.log(import_chalk33.default.green(`  \u2713 ${tool}: ${flagsLine(eff)}${action2 === "reset" ? " (automatic default)" : ""}`));
+}
+async function runMcpUi(project, tool, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  requireTool(cat, tool);
+  const uri = uiResourceUri(t.projectId, tool);
+  if (opts.json) return void console.log(JSON.stringify({ tool, uri, kind: "automatic" }, null, 2));
+  console.log(`
+  ${import_chalk33.default.bold(uri)}
+`);
+  console.log(import_chalk33.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
+  console.log(import_chalk33.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
+}
 
 // src/commands/delete.ts
 var import_chalk35 = __toESM(require("chalk"));
@@ -8157,7 +8387,7 @@ async function runJobStatus(jobId, opts) {
 
 // src/commands/export.ts
 var import_chalk37 = __toESM(require("chalk"));
-var import_fs4 = require("fs");
+var import_fs5 = require("fs");
 init_admin();
 init_auth();
 init_resolve();
@@ -8206,7 +8436,7 @@ async function runExport(projectArg, versionArg, opts) {
   });
   if (!res.ok) throw new Error(`Download failed (${res.status}): ${await res.text().catch(() => "")}`);
   const buf = Buffer.from(await res.arrayBuffer());
-  (0, import_fs4.writeFileSync)(outFile, buf);
+  (0, import_fs5.writeFileSync)(outFile, buf);
   console.log(import_chalk37.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
   if (job.decryption_key) console.log(import_chalk37.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
   console.log(import_chalk37.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
@@ -11913,7 +12143,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs12 = __toESM(require("fs"));
+var fs13 = __toESM(require("fs"));
 var import_chalk53 = __toESM(require("chalk"));
 var import_ora24 = __toESM(require("ora"));
 init_admin();
@@ -11936,7 +12166,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs12.readFileSync(opts.file, "utf-8");
+    specContent = fs13.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk53.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -13787,28 +14017,28 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk60 = __toESM(require("chalk"));
 var import_ora30 = __toESM(require("ora"));
-var fs13 = __toESM(require("fs"));
+var fs14 = __toESM(require("fs"));
 var path10 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs13.existsSync(path10.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs14.existsSync(path10.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs13.readFileSync(path10.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs14.readFileSync(path10.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs13.existsSync(path10.join(root, "app")) || fs13.existsSync(path10.join(root, "src", "app"));
-  const pagesDir = fs13.existsSync(path10.join(root, "pages")) || fs13.existsSync(path10.join(root, "src", "pages"));
+  const appDir = fs14.existsSync(path10.join(root, "app")) || fs14.existsSync(path10.join(root, "src", "app"));
+  const pagesDir = fs14.existsSync(path10.join(root, "pages")) || fs14.existsSync(path10.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
   const p = path10.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs13.readFileSync(p, "utf8");
+    existing = fs14.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -13823,15 +14053,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs13.writeFileSync(p, next);
+  fs14.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs13.existsSync(path10.join(root, "node_modules", "apiblaze", "package.json"))) {
+  if (fs14.existsSync(path10.join(root, "node_modules", "apiblaze", "package.json"))) {
     console.log(`  ${import_chalk60.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f) => fs13.existsSync(path10.join(root, f));
+  const has = (f) => fs14.existsSync(path10.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora30.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -13844,7 +14074,7 @@ function installSidecarPackage(root) {
 }
 function readEnvKey(root) {
   try {
-    const s = fs13.readFileSync(path10.join(root, ".env.local"), "utf8");
+    const s = fs14.readFileSync(path10.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -13855,13 +14085,13 @@ function ensureGitignored(root) {
   const p = path10.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs13.readFileSync(p, "utf8");
+    c = fs14.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs13.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs14.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path10.join("src", "instrumentation.ts")].map((c) => path10.join(root, c)).find((f) => fs13.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path10.join("src", "instrumentation.ts")].map((c) => path10.join(root, c)).find((f) => fs14.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -13869,18 +14099,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs13.writeFileSync(path10.join(root, "instrumentation.ts"), body);
+    fs14.writeFileSync(path10.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs13.readFileSync(existing, "utf8");
+  const cur = fs14.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs13.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs14.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs13.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs14.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -13963,16 +14193,16 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs13.existsSync(path10.join(root, "src", "pages")) ? path10.join(root, "src", "pages") : path10.join(root, "pages");
+      const dir2 = fs14.existsSync(path10.join(root, "src", "pages")) ? path10.join(root, "src", "pages") : path10.join(root, "pages");
       const f2 = path10.join(dir2, "abz-inspector.tsx");
-      fs13.writeFileSync(f2, INSPECTOR_PAGE);
+      fs14.writeFileSync(f2, INSPECTOR_PAGE);
       return path10.relative(root, f2);
     }
-    const base2 = fs13.existsSync(path10.join(root, "src", "app")) ? path10.join(root, "src", "app") : path10.join(root, "app");
+    const base2 = fs14.existsSync(path10.join(root, "src", "app")) ? path10.join(root, "src", "app") : path10.join(root, "app");
     const dir = path10.join(base2, "abz-inspector");
-    fs13.mkdirSync(dir, { recursive: true });
+    fs14.mkdirSync(dir, { recursive: true });
     const f = path10.join(dir, "page.tsx");
-    fs13.writeFileSync(f, INSPECTOR_PAGE);
+    fs14.writeFileSync(f, INSPECTOR_PAGE);
     return path10.relative(root, f);
   } catch {
     return null;
@@ -15415,8 +15645,20 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Lock resources to the person who created them \u2014 or describe any access rule in plain English (that one is billed per turn)").argument("<project>", "Project name or id").argument("[sentence]", 'Optional rule in plain English, e.g. "users see only their own rows". Omit to pick from what the spec can protect.').option("--enforce", "Turn enforcement on right after saving (default: save in shadow mode, then ask)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((project, sentence, opts) => runRule(project, sentence, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
+var mcpCmd = program.command("mcp").description("Optional tweaks to a proxy's MCP server: prompts, per-tool behavior (read-only / destructive / confirm / always-async), UI resource");
+var mcpCommon = (c) => c.option("--apiversion <version>", "API version (defaults to the project's)").option("--environment <env>", "Catalogue environment (default: prod)").option("--json", "Output machine-readable JSON");
+var mcpPrompts = mcpCmd.command("prompts").description("Prompts the MCP server offers (drafted by the MCP agent; editable here)");
+mcpCommon(mcpPrompts.command("list").description("List the prompts").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpPrompts("list", project, void 0, opts)));
+mcpCommon(mcpPrompts.command("show").description("Show one prompt").argument("<project>", "Project name or id").argument("<name>", "Prompt name")).action(action((project, name, opts) => runMcpPrompts("show", project, name, opts)));
+mcpCommon(mcpPrompts.command("set").description("Add or replace a prompt from a JSON file ({ title?, description?, arguments?, messages: [{ role, text }] }, {{arg}} placeholders)").argument("<project>", "Project name or id").argument("<name>", "Prompt name (a-z 0-9 _ -)").requiredOption("--file <path>", "prompt.json")).action(action((project, name, opts) => runMcpPrompts("set", project, name, opts)));
+mcpCommon(mcpPrompts.command("rm").description("Remove a prompt").argument("<project>", "Project name or id").argument("<name>", "Prompt name")).action(action((project, name, opts) => runMcpPrompts("rm", project, name, opts)));
+var mcpOps = mcpCmd.command("ops").description("Per-tool behavior. Default from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm");
+mcpCommon(mcpOps.command("list").description("Every tool with its effective behavior (overrides marked)").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpOps("list", project, void 0, opts)));
+mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
+mcpCommon(mcpOps.command("reset").description("Back to the automatic default for one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpOps("reset", project, tool, opts)));
+mcpCommon(mcpCmd.command("ui").description("Print a tool's MCP Apps UI resource (ui://{project}/{tool}) \u2014 the automatic viewer").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpUi(project, tool, opts)));
 program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {
-  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs5.default.existsSync(project));
+  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs6.default.existsSync(project));
   const target2 = opts.target ?? (looksLikeSource ? project : void 0);
   return runApichat({ ...opts, target: target2, project: looksLikeSource ? void 0 : project, openapispec: opts.openapispec ?? opts.openapi });
 }));
@@ -15580,7 +15822,7 @@ var HELP_GROUPS = [
   { title: "Chat", commands: ["docs", "apichat", "agent", "llm"] },
   { title: "Setup", commands: ["dev", "create", "integration", "skill", "login", "init", "sidecar", "claim", "team", "whoami", "logout", "flush"] },
   { title: "Recipes \u2014 install a working setup, or publish yours", commands: ["search", "show", "install", "publish", "withdraw"] },
-  { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "apikeys", "iam", "identified", "preapprove", "allowoauthregistration", "rule", "domain", "delete", "job", "target", "limits", "billing", "transform", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "apikeys", "iam", "identified", "preapprove", "allowoauthregistration", "rule", "mcp", "domain", "delete", "job", "target", "limits", "billing", "transform", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.15",
+  "version": "0.21.17",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",