apiblaze 0.21.22 → 0.21.23

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.22";
+    version = "0.21.23";
   }
 });
 
@@ -6367,8 +6367,8 @@ var init_files = __esm({
     DEMO_FILES = {
       "README.md": "# Nino's Pizza: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Your API is live on the internet.** The backend runs on your laptop; APIblaze gives it a public\n   URL and an MCP address for AI assistants. A live ticker shows each request reaching your laptop.\n2. **An AI assistant uses it.** Ask it to book a table and watch the request arrive.\n3. **Included, no code:** only the owner can change a booking, each customer (Nino Pizza,\n   Gino Pizza) is separate, rate limits, sign-in, and drop-in widgets for API keys and roles.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | Its endpoints. APIblaze builds the AI tools and the ownership rules from it. |\n| `app.js` | The website's server. Calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\n`npx apiblaze@latest demo` also adds `lib/apiblaze-server.js` and `public/apiblaze-widgets.js`, the same\nhelpers you get from `npm i apiblaze`. Stop the demo with `npx apiblaze@latest demo stop`.\n",
       "openapi.yaml": "openapi: 3.0.3\ninfo:\n  title: Nino's Pizza API\n  version: 1.0.0\n  description: Table bookings at Nino's Pizza. APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.\npaths:\n  /reservations:\n    get:\n      operationId: listReservations\n      summary: List my bookings\n      responses:\n        '200':\n          description: The caller's bookings\n          content:\n            application/json:\n              schema:\n                type: array\n                items: { $ref: '#/components/schemas/Reservation' }\n    post:\n      operationId: createReservation\n      summary: Book a table\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema: { $ref: '#/components/schemas/NewReservation' }\n      responses:\n        '201':\n          description: Booked\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n  /reservations/{id}:\n    parameters:\n      - { name: id, in: path, required: true, schema: { type: string } }\n    get:\n      operationId: getReservation\n      summary: Get one booking\n      responses:\n        '200':\n          description: The booking\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n    delete:\n      operationId: cancelReservation\n      summary: Cancel a booking\n      responses:\n        '204': { description: Cancelled }\ncomponents:\n  schemas:\n    NewReservation:\n      type: object\n      required: [name, table, time]\n      properties:\n        name: { type: string, example: Ana }\n        table: { type: integer, example: 4 }\n        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }\n        guests: { type: integer, example: 2, description: 'How many people' }\n    Reservation:\n      allOf:\n        - $ref: '#/components/schemas/NewReservation'\n        - type: object\n          properties:\n            id: { type: string, example: r1 }\n",
-      "backend.js": "// Nino's Pizza backend: book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  if (!who) return reply(401, { error: 'calls come through APIblaze, which says who is calling' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || 1,\n      time: String(input.time || '19:30'), guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row);\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'DELETE') { bookings.delete(id); return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
-      "app.js": "// Nino's Pizza website server: serves the page and makes its calls.\n//\n// Every call goes through APIblaze with ONE server key (kept here, never in the\n// browser) and says who is acting with X-End-User-Id. The chat and the two\n// widgets use apiblaze's own server helpers (lib/apiblaze-server.js, copied in by\n// `npx apiblaze@latest demo` \u2014 the same code as `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst { recent } = require('./backend');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\nconst mask = (k) => (k ? `${k.slice(0, 7)}\u2022\u2022\u2022\u2022${k.slice(-4)}` : '');\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The person using the page. A real app takes this from its own login.\nconst ME = { userId: 'ana', email: 'ana@ninopizza.example', label: 'Ana' };\n\nasync function call(op, { as = 'ana', id, key = 'nino', body } = {}) {\n  const base = env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = {\n    'content-type': 'application/json',\n    'x-api-key': key === 'gino' ? env('APIBLAZE_GINO_KEY') : env('APIBLAZE_SERVER_KEY'),\n    'x-end-user-id': as,\n  };\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify(body || { name: 'Ana', table: 4, time: '19:30', guests: 2 }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : op === 'open' ? { method: 'GET', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n        : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const project = env('APIBLAZE_NAME');\n  const tenant = env('APIBLAZE_TENANT');\n  const out = {};\n  out.chat = lib.createApiblazeChat({\n    project: `${project}-${tenant}`, apiKey: env('APIBLAZE_SERVER_KEY'),\n    host: 'tryabz.run', environment: 'dev', getUser: () => ({ userId: ME.userId }),\n  });\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    const user = () => ({ tenant, userId: ME.userId, email: ME.email, label: ME.label });\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user });\n  }\n  return out;\n}\n\nfunction startApp(port = Number(env('APP_PORT', '3000'))) {\n  const w = widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        if (req.method === 'GET' && p === '/apiblaze-widgets.js' && fs.existsSync(path.join(pub, 'apiblaze-widgets.js'))) {\n          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'apiblaze-widgets.js')));\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            name: env('APIBLAZE_NAME'), apiUrl: env('APIBLAZE_URL'), mcpUrl: env('APIBLAZE_MCP_URL'),\n            portalUrl: env('APIBLAZE_PORTAL_URL'), key: mask(env('APIBLAZE_SERVER_KEY')), ginoKey: mask(env('APIBLAZE_GINO_KEY')),\n            backendPort: env('BACKEND_PORT', '3001'), rps: Number(env('APIBLAZE_DEMO_RPS')) || null, rateCard: env('APIBLAZE_RATE_CARD') === '1', widgets: { chat: !!w.chat, keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/ticker') return json(res, 200, recent.slice(0, 12));\n        if (p === '/api/apiblaze/chat' && w.chat) return viaHandler(w.chat.handler, req, res, raw);\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { as: String(b.as || 'ana'), id: b.id, key: b.key, body: b.body }));\n        }\n        if (req.method === 'POST' && p === '/api/hammer') {\n          // 30 calls at once, as one customer: the demo's rate limit lets only some through.\n          const codes = await Promise.all(Array.from({ length: 30 }, () => call('list').then((r) => r.status).catch(() => 0)));\n          const served = codes.filter((c) => c === 200).length;\n          const limited = codes.filter((c) => c === 429).length;\n          return json(res, 200, { sent: codes.length, served, limited, other: codes.length - served - limited });\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
+      "backend.js": "// Nino's Pizza backend: book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  if (!who) return reply(401, { error: 'calls come through APIblaze, which says who is calling' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || 1,\n      time: String(input.time || '19:30'), guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row);\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'DELETE') { bookings.delete(id); return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "app.js": "// Nino's Pizza website server: serves the page and makes its calls.\n//\n// Every call goes through APIblaze with ONE server key (kept here, never in the\n// browser) and says who is acting with X-End-User-Id. The chat and the two\n// widgets use apiblaze's own server helpers (lib/apiblaze-server.js, copied in by\n// `npx apiblaze@latest demo` \u2014 the same code as `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\nconst mask = (k) => (k ? `${k.slice(0, 7)}\u2022\u2022\u2022\u2022${k.slice(-4)}` : '');\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// Who is using the page. A real app takes this from its own login; the demo lets you switch.\n//   App tab:   ana, ben  \u2014 customers of Nino Pizza\n//   Admin tab: ana       \u2014 admin of Nino Pizza;  gina \u2014 admin of Gino Pizza\nconst PEOPLE = {\n  ana: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example', tenant: () => env('APIBLAZE_TENANT') },\n  ben: { userId: 'ben', label: 'Ben', email: 'ben@ninopizza.example', tenant: () => env('APIBLAZE_TENANT') },\n  gina: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example', tenant: () => env('APIBLAZE_GINO_TENANT') },\n};\nfunction personOf(req) {\n  const as = new URL(req.url, 'http://x').searchParams.get('as') || 'ana';\n  return PEOPLE[as] || PEOPLE.ana;\n}\n\nasync function call(op, { as = 'ana', id, key = 'nino', body } = {}) {\n  const base = env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = {\n    'content-type': 'application/json',\n    'x-api-key': key === 'gino' ? env('APIBLAZE_GINO_KEY') : env('APIBLAZE_SERVER_KEY'),\n    'x-end-user-id': as,\n  };\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify(body || { name: (PEOPLE[as] || PEOPLE.ana).label, table: 4, time: '19:30', guests: 2 }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : op === 'open' ? { method: 'GET', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n        : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = {};\n  out.chat = lib.createApiblazeChat({\n    project: `${env('APIBLAZE_NAME')}-${env('APIBLAZE_TENANT')}`, apiKey: env('APIBLAZE_SERVER_KEY'),\n    host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: personOf(req).userId }),\n  });\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    const user = (req) => { const p = personOf(req); return { tenant: p.tenant(), userId: p.userId, email: p.email, label: p.label }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user });\n  }\n  return out;\n}\n\nfunction startApp(port = Number(env('APP_PORT', '3000'))) {\n  const w = widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        if (req.method === 'GET' && p === '/apiblaze-widgets.js' && fs.existsSync(path.join(pub, 'apiblaze-widgets.js'))) {\n          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'apiblaze-widgets.js')));\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            name: env('APIBLAZE_NAME'), apiUrl: env('APIBLAZE_URL'), mcpUrl: env('APIBLAZE_MCP_URL'),\n            portalUrl: env('APIBLAZE_PORTAL_URL'), gino: !!env('APIBLAZE_GINO_TENANT'),\n            backendPort: env('BACKEND_PORT', '3001'), widgets: { chat: !!w.chat, keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/apiblaze/chat' && w.chat) return viaHandler(w.chat.handler, req, res, raw);\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { as: String(b.as || 'ana'), id: b.id, key: b.key, body: b.body }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts the pizzeria: the backend (port 3001) and the website (port 3000).\n// `npx apiblaze@latest demo` runs this for you and connects APIblaze to the backend.\n// To run it yourself: `node start.js`, then in another terminal\n//   npx apiblaze@latest dev --port 3001 --project <the name in .env.local> --auto\n\nconst fs = require('fs');\nconst path = require('path');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  await startBackend(backendPort);\n  await startApp(appPort);\n  return { backendPort, appPort };\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  start().then(({ appPort }) => console.log(`Pizzeria running: http://localhost:${appPort}`))\n    .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n}\n",
       "public/index.html": `<!doctype html>
 <html lang="en">
@@ -6380,7 +6380,7 @@ var init_files = __esm({
   :root {
     --bg: #faf7f2; --card: #fff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9; --soft: #f3eee6;
     --accent: #e4572e; --accent-ink: #fff; --good: #15803d; --good-bg: #ecfdf3; --bad: #c2410c; --bad-bg: #fff1e8;
-    --live: #16a34a; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
+    --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
   }
   @media (prefers-color-scheme: dark) {
     :root { --bg: #161412; --card: #1f1c1a; --ink: #f3efe9; --muted: #a39b92; --line: #34302c; --soft: #26221f;
@@ -6388,188 +6388,163 @@ var init_files = __esm({
   }
   * { box-sizing: border-box; }
   body { margin: 0; background: var(--bg); color: var(--ink); font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
-  main { max-width: 1080px; margin: 0 auto; padding: 28px 16px 64px; }
-  h1 { font-size: 30px; margin: 0; letter-spacing: -0.02em; }
-  .lede { font-size: 18px; color: var(--muted); margin: 6px 0 20px; }
-  .card { background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 20px; }
-  .hero { display: grid; grid-template-columns: 1.1fr 0.9fr; gap: 16px; }
-  @media (max-width: 820px) { .hero, .grid { grid-template-columns: 1fr !important; } }
-  .addr { display: grid; gap: 14px; }
-  .addr .label { font-size: 13px; font-weight: 700; letter-spacing: .06em; text-transform: uppercase; color: var(--muted); }
-  .addr .row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-  code, .mono { font-family: var(--mono); font-size: 13px; }
-  .url { background: var(--soft); padding: 8px 10px; border-radius: 10px; word-break: break-all; flex: 1; min-width: 0; }
-  button { background: var(--soft); color: var(--ink); border: 1px solid var(--line); border-radius: 10px; padding: 9px 13px; font-size: 14px; cursor: pointer; }
-  button:hover { border-color: var(--muted); }
+  main { max-width: 1000px; margin: 0 auto; padding: 20px 16px 56px; }
+  .live { display: flex; flex-wrap: wrap; gap: 6px 18px; align-items: center; font-size: 13px; color: var(--muted);
+    background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 8px 12px; }
+  .live b { color: var(--ink); font-weight: 600; }
+  .live code { font-family: var(--mono); font-size: 12px; color: var(--ink); word-break: break-all; }
+  .dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: #16a34a; margin-right: 6px; }
+  nav { display: flex; gap: 6px; margin: 18px 0 14px; }
+  nav button { border: 0; background: transparent; font-size: 17px; padding: 8px 14px; border-radius: 10px; cursor: pointer; color: var(--muted); }
+  nav button[aria-selected="true"] { background: var(--card); color: var(--ink); font-weight: 600; box-shadow: 0 0 0 1px var(--line); }
+  .who { display: flex; align-items: center; gap: 10px; margin-bottom: 14px; font-size: 15px; color: var(--muted); }
+  select { font-size: 15px; padding: 6px 10px; border-radius: 10px; border: 1px solid var(--line); background: var(--card); color: var(--ink); }
+  .cols { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
+  @media (max-width: 820px) { .cols { grid-template-columns: 1fr; } }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 18px; }
+  h2 { font-size: 19px; margin: 0 0 4px; }
+  .sub { color: var(--muted); font-size: 14px; margin: 0 0 12px; }
+  button.act { background: var(--soft); color: var(--ink); border: 1px solid var(--line); border-radius: 10px; padding: 8px 12px; font-size: 14px; cursor: pointer; }
   button.primary { background: var(--accent); color: var(--accent-ink); border-color: transparent; font-weight: 600; }
-  .hint { color: var(--muted); font-size: 14px; margin: 2px 0 0; }
-  .dot { display: inline-block; width: 9px; height: 9px; border-radius: 50%; background: var(--live); margin-right: 6px; box-shadow: 0 0 0 0 rgba(22,163,74,.6); animation: pulse 1.6s infinite; }
-  @keyframes pulse { 70% { box-shadow: 0 0 0 8px rgba(22,163,74,0); } 100% { box-shadow: 0 0 0 0 rgba(22,163,74,0); } }
-  .ticker { margin-top: 14px; border-top: 1px solid var(--line); padding-top: 12px; }
-  .ticker ol { list-style: none; margin: 8px 0 0; padding: 0; display: grid; gap: 6px; max-height: 230px; overflow: auto; }
-  .ticker li { font-family: var(--mono); font-size: 12.5px; background: var(--soft); border-radius: 8px; padding: 6px 9px; display: flex; gap: 8px; }
-  .ticker li.new { animation: flash 1.2s ease-out; }
+  ul.res { list-style: none; padding: 0; margin: 12px 0 0; display: grid; gap: 8px; }
+  ul.res li { display: flex; align-items: center; gap: 10px; background: var(--soft); border-radius: 10px; padding: 10px 12px; }
+  ul.res li.new { animation: flash 1.5s ease-out; }
   @keyframes flash { from { background: var(--good-bg); } }
-  .ticker .st { margin-left: auto; color: var(--muted); }
+  ul.res li span { flex: 1; }
   .empty { color: var(--muted); font-size: 14px; }
-  h2 { font-size: 20px; margin: 0 0 4px; }
-  h3 { font-size: 17px; margin: 0 0 4px; }
-  .section { margin: 28px 0 10px; font-size: 13px; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; color: var(--muted); }
-  .grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 14px; }
-  .grid .card { padding: 16px; }
-  .sub { color: var(--muted); font-size: 14px; margin: 0 0 12px; }
-  .out { border-radius: 10px; padding: 8px 10px; font-size: 14px; margin-top: 10px; background: var(--soft); }
+  .out { border-radius: 10px; padding: 8px 10px; font-size: 14px; margin-top: 10px; }
   .out.good { background: var(--good-bg); color: var(--good); font-weight: 600; }
   .out.bad { background: var(--bad-bg); color: var(--bad); font-weight: 600; }
-  .out small { display: block; font-weight: 400; color: var(--muted); font-family: var(--mono); font-size: 12px; }
-  .wide { grid-column: span 3; }
-  @media (max-width: 820px) { .wide { grid-column: auto; } }
-  .footer { margin-top: 26px; font-size: 17px; }
-  #chat { min-height: 420px; }
+  #chat { min-height: 460px; }
+  .chatcard { padding: 0; overflow: hidden; }
+  .next { margin-top: 16px; color: var(--muted); font-size: 15px; }
+  .next a { color: var(--accent); cursor: pointer; text-decoration: none; font-weight: 600; }
+  .next code { font-family: var(--mono); font-size: 13px; }
+  .stack { display: grid; gap: 16px; }
 </style>
 </head>
 <body>
 <main>
-  <h1>\u{1F355} Nino's Pizza</h1>
-  <p class="lede">This booking app is running on your laptop. One command put it on the internet, with a door for AI assistants. You wrote no code for it.</p>
+  <div class="live"><span><span class="dot"></span><b>Running on your laptop, live on the internet</b></span>
+    <span>API <code id="api">\u2026</code></span><span>MCP <code id="mcp">\u2026</code></span></div>
 
-  <section class="hero">
-    <div class="card">
-      <div class="addr">
-        <div>
-          <div class="label"><span class="dot"></span>Your API, live on the internet</div>
-          <div class="row"><span class="url mono" id="api">\u2026</span><button data-copy="api">Copy</button></div>
-          <p class="hint">Anyone you give a key to can call it from anywhere. It's answered by <span class="mono" id="local">localhost</span> on this machine.</p>
-        </div>
-        <div>
-          <div class="label">\u{1F916} Its MCP address, for AI assistants</div>
-          <div class="row"><span class="url mono" id="mcp">\u2026</span><button data-copy="mcp">Copy</button></div>
-          <p class="hint">Paste it into Claude, ChatGPT or Cursor and they can use your app, under the same rules.</p>
+  <nav role="tablist">
+    <button role="tab" id="tab-app" aria-selected="true">\u{1F355} Nino's Pizza</button>
+    <button role="tab" id="tab-admin" aria-selected="false">\u2699 Admin</button>
+  </nav>
+
+  <!-- THE APP: what a customer of the pizzeria sees -->
+  <section id="app">
+    <div class="who">Signed in as
+      <select id="as"><option value="ana">Ana</option><option value="ben">Ben</option></select>
+    </div>
+    <div class="cols">
+      <div class="card">
+        <h2>Your reservations</h2>
+        <p class="sub">Book here, or ask the assistant. Each person only sees their own.</p>
+        <button class="act primary" id="book">Book table 4 at 7:30pm</button>
+        <ul class="res" id="list"><li class="empty">No reservations yet.</li></ul>
+        <div id="try-ben" hidden>
+          <p class="sub" style="margin:14px 0 6px">Ana booked a table. Can Ben cancel it?</p>
+          <button class="act" id="ben-cancel">Cancel Ana's booking</button>
+          <div id="ben-out"></div>
         </div>
       </div>
-      <div class="ticker">
-        <div class="label" style="font-size:13px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--muted)">Requests reaching your laptop, live</div>
-        <ol id="ticker"><li class="empty" id="ticker-empty">Nothing yet. Ask the assistant to book a table \u2192</li></ol>
-      </div>
+      <div class="card chatcard"><div id="chat"></div></div>
     </div>
-    <div class="card" style="padding:0;overflow:hidden"><div id="chat"></div></div>
+    <p class="next">Every request here went from the internet, through APIblaze, to your laptop: <code>npx apiblaze@latest demo logs</code> shows them. Next: <a id="go-admin">the admin side \u2192</a></p>
   </section>
 
-  <div class="section">Included with every APIblaze API, still no code</div>
-  <section class="grid">
-    <div class="card">
-      <h3>\u{1F6E1} Only the owner can change it</h3>
-      <p class="sub">Ana books a table. Ben tries to cancel it.</p>
-      <button id="rule">Ben cancels Ana's booking</button>
-      <div id="rule-out"></div>
+  <!-- ADMIN: what each pizzeria's admin sees -->
+  <section id="admin" hidden>
+    <div class="who">Signed in as
+      <select id="admin-as"><option value="ana">Ana, admin of Nino Pizza</option><option value="gina">Gina, admin of Gino Pizza</option></select>
     </div>
-    <div class="card" id="tenants" hidden>
-      <h3>\u{1F3E2} Each customer is separate</h3>
-      <p class="sub">Nino Pizza and Gino Pizza use the same app, each with its own key.</p>
-      <button id="gino">Gino's key asks for Nino's booking</button>
-      <div id="gino-out"></div>
-    </div>
-    <div class="card" id="rate-card" hidden>
-      <h3>\u23F1 Rate limits</h3>
-      <p class="sub">Each customer gets <span id="rps">a few</span> calls a second. Send 30 at once and see what happens.</p>
-      <button id="hammer">Send 30 calls at once</button>
-      <div id="hammer-out"></div>
-    </div>
-    <div class="card">
-      <h3>\u{1F510} Sign-in</h3>
-      <p class="sub">People and AI agents can sign in with GitHub instead of a key. Your API has a developer portal for that.</p>
-      <a id="portal" href="#" target="_blank" rel="noopener"><button>Open the developer portal</button></a>
-    </div>
-    <div class="card wide" id="keys-card" hidden>
-      <h3>\u{1F511} API keys, self-serve</h3>
-      <p class="sub">Drop this widget into your site and each customer makes their own keys.</p>
-      <div id="keys"></div>
-    </div>
-    <div class="card wide" id="groups-card" hidden>
-      <h3>\u{1F465} Users and roles</h3>
-      <p class="sub">Put people in groups. Rules can say "only staff may cancel".</p>
-      <div id="groups"></div>
+    <div class="stack">
+      <div class="card"><div id="keys"></div></div>
+      <div class="card"><div id="groups"></div></div>
     </div>
+    <p class="next">Each pizzeria only sees its own keys and people. Developers can also sign in and get a key at the <a id="portal" target="_blank" rel="noopener">developer portal</a>.</p>
   </section>
-
-  <p class="footer">This is exactly what <code>npx apiblaze@latest dev</code> does for your own app. Ask Claude: <b>"Put my app on APIblaze."</b></p>
 </main>
 <script src="/apiblaze-widgets.js"></script>
 <script>
 const $ = (s) => document.querySelector(s);
-const post = (url, body) => fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body || {}) }).then((r) => r.json()).catch((e) => ({ status: 0, error: String(e) }));
-function out(el, cls, text, detail) {
-  const d = document.createElement('div'); d.className = 'out ' + (cls || ''); d.textContent = text;
-  if (detail) { const s = document.createElement('small'); s.textContent = detail; d.appendChild(s); }
-  $(el).replaceChildren(d);
-}
-document.querySelectorAll('[data-copy]').forEach((b) => b.onclick = () => { navigator.clipboard?.writeText($('#' + b.dataset.copy).textContent); b.textContent = 'Copied'; setTimeout(() => b.textContent = 'Copy', 1200); });
+const post = (url, body) => fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body || {}) }).then((r) => r.json()).catch(() => ({ status: 0 }));
+const W = window.ApiblazeWidgets;
+const theme = { accent: '#e4572e' };
+let cfg = {};
+let anaBooking = null;
 
-let bookingId = null;
-async function book() { const r = await post('/api/act', { op: 'book', as: 'ana' }); if (r.status === 201) bookingId = r.body.id; return r; }
+// \u2500\u2500 tabs \u2500\u2500
+function show(tab) {
+  $('#app').hidden = tab !== 'app'; $('#admin').hidden = tab !== 'admin';
+  $('#tab-app').setAttribute('aria-selected', tab === 'app'); $('#tab-admin').setAttribute('aria-selected', tab === 'admin');
+  if (tab === 'admin') mountAdmin();
+}
+$('#tab-app').onclick = () => show('app');
+$('#tab-admin').onclick = () => show('admin');
+$('#go-admin').onclick = () => show('admin');
 
-$('#rule').onclick = async () => {
-  if (!bookingId) await book();
-  const r = await post('/api/act', { op: 'cancel', as: 'ben', id: bookingId });
-  if (r.status === 403) out('#rule-out', 'good', "\u{1F6E1} Blocked. Only Ana can cancel Ana's booking.", 'HTTP 403 \xB7 decided by APIblaze, not your code');
-  else if (r.status === 204) { out('#rule-out', 'bad', 'Cancelled. That should not happen.', 'HTTP 204'); bookingId = null; }
-  else out('#rule-out', 'bad', explain(r), 'HTTP ' + r.status);
-};
-$('#gino').onclick = async () => {
-  if (!bookingId) await book();
-  const r = await post('/api/act', { op: 'open', as: 'ana', id: bookingId, key: 'gino' });
-  if (r.status === 403 || r.status === 404) out('#gino-out', 'good', "\u{1F6E1} Blocked. Gino Pizza only sees Gino Pizza's bookings.", 'HTTP ' + r.status);
-  else out('#gino-out', 'bad', r.status === 200 ? "Gino Pizza can read Nino's booking." : explain(r), 'HTTP ' + r.status);
-};
-$('#hammer').onclick = async () => {
-  out('#hammer-out', '', 'Sending\u2026');
-  const r = await post('/api/hammer');
-  out('#hammer-out', 'good', \`\${r.served} served, \${r.limited} told to slow down.\`, \`\${r.sent} calls \xB7 HTTP 200 \xD7 \${r.served}, 429 \xD7 \${r.limited}\`);
+// \u2500\u2500 the app \u2500\u2500
+const me = () => $('#as').value;
+const seen = new Set();
+async function refresh() {
+  const r = await post('/api/act', { op: 'list', as: me() });
+  const rows = Array.isArray(r.body) ? r.body : [];
+  if (me() === 'ana') anaBooking = rows.length ? rows[0].id : null;
+  const ul = $('#list'); ul.replaceChildren();
+  if (!rows.length) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'No reservations yet.'; ul.append(li); }
+  for (const b of rows) {
+    const li = document.createElement('li');
+    if (!seen.has(b.id)) { li.className = 'new'; seen.add(b.id); }
+    const t = document.createElement('span');
+    t.textContent = \`Table \${b.table} \xB7 \${b.time} \xB7 \${b.guests || 2} people \xB7 #\${b.id}\`;
+    const x = document.createElement('button'); x.className = 'act'; x.textContent = 'Cancel';
+    x.onclick = async () => { await post('/api/act', { op: 'cancel', as: me(), id: b.id }); refresh(); };
+    li.append(t, x); ul.append(li);
+  }
+  $('#try-ben').hidden = !(me() === 'ben' && anaBooking);
+}
+$('#book').onclick = async () => { await post('/api/act', { op: 'book', as: me() }); refresh(); };
+$('#ben-cancel').onclick = async () => {
+  const r = await post('/api/act', { op: 'cancel', as: 'ben', id: anaBooking });
+  const d = document.createElement('div');
+  if (r.status === 403) { d.className = 'out good'; d.textContent = "\u{1F6E1} Blocked. Only Ana can cancel Ana's booking. APIblaze decided, not the app's code."; }
+  else { d.className = 'out bad'; d.textContent = r.status === 204 ? 'Cancelled. That should not happen.' : 'Something went wrong (HTTP ' + r.status + ').'; }
+  $('#ben-out').replaceChildren(d);
 };
-function explain(r) {
-  if (r.status === 402) return 'The free demo calls ran out. Run again: npx apiblaze@latest demo';
-  if (r.status === 429) return 'Too many calls at once. Wait a second.';
-  if (!r.status || r.status >= 500) return 'The connection to APIblaze dropped. Run again: npx apiblaze@latest demo';
-  return (r.body && (r.body.detail || r.body.error)) || 'Something went wrong';
-}
+function mountChat() {
+  if (!W || !cfg.widgets || !cfg.widgets.chat) return;
+  const who = me() === 'ben' ? 'Ben' : 'Ana';
+  $('#chat').replaceChildren();
+  W.chat('#chat', { endpoint: '/api/apiblaze/chat?as=' + me(), mode: 'inline', title: "Nino's Pizza assistant", avatar: '\u{1F355}', height: 520, theme,
+    storageKey: 'nino-chat-' + me(),
+    welcome: \`Hi \${who}! I can book, list and cancel your tables. I'm using the app on your laptop, through APIblaze.\`,
+    suggestions: ['Book table 2 for 4 people at 8pm', 'What are my reservations?'] });
+}
+$('#as').onchange = () => { $('#ben-out').replaceChildren(); refresh(); mountChat(); };
+setInterval(() => { if (!$('#app').hidden) refresh(); }, 2000); // the assistant's bookings appear here
 
-// Live ticker: what the backend on this laptop just answered.
-const seen = new Set();
-async function tick() {
-  try {
-    const rows = await fetch('/api/ticker').then((r) => r.json());
-    if (rows.length) $('#ticker-empty')?.remove();
-    for (const r of rows.slice().reverse()) {
-      const k = r.at + r.method + r.path + r.who;
-      if (seen.has(k)) continue; seen.add(k);
-      const li = document.createElement('li'); li.className = 'new';
-      const t = new Date(r.at).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', second: '2-digit' });
-      const who = r.who ? \`\${r.who}\${r.tenant ? ' @ ' + r.tenant.replace(/[0-9a-f]{4}$/, '') : ''}\` : '';
-      // Text only: these values come from requests made on the internet.
-      for (const [tag, text, cls] of [['span', t], ['b', r.method], ['span', r.path], ['span', who], ['span', String(r.status), 'st']]) {
-        const el = document.createElement(tag); el.textContent = text; if (cls) el.className = cls; li.appendChild(el);
-      }
-      $('#ticker').prepend(li);
-    }
-  } catch { /* the page keeps working */ }
-}
-setInterval(tick, 1000);
+// \u2500\u2500 admin \u2500\u2500
+function mountAdmin() {
+  if (!W) return;
+  const as = $('#admin-as').value;
+  for (const id of ['#keys', '#groups']) $(id).replaceChildren();
+  if (cfg.widgets && cfg.widgets.keys) W.keys('#keys', { endpoint: '/api/apiblaze/keys?as=' + as, theme, title: 'API keys' });
+  if (cfg.widgets && cfg.widgets.groups) W.groups('#groups', { endpoint: '/api/apiblaze/groups?as=' + as, theme, title: 'People and groups' });
+}
+$('#admin-as').onchange = mountAdmin;
 
 fetch('/api/config').then((r) => r.json()).then((c) => {
+  cfg = c;
   $('#api').textContent = c.apiUrl || 'not connected';
   $('#mcp').textContent = c.mcpUrl || 'not connected';
-  $('#local').textContent = 'localhost:' + c.backendPort;
-  if (c.portalUrl) $('#portal').href = c.portalUrl; else $('#portal').hidden = true;
-  if (c.ginoKey) $('#tenants').hidden = false;
-  if (c.rps) $('#rps').textContent = c.rps;
-  if (c.rateCard) $('#rate-card').hidden = false;
-  const W = window.ApiblazeWidgets;
-  const theme = { accent: '#e4572e' };
-  if (W && c.widgets.chat) W.chat('#chat', { endpoint: '/api/apiblaze/chat', mode: 'inline', title: "Nino's Pizza assistant", avatar: '\u{1F355}', height: 520, theme,
-    welcome: "Hi Ana! I can book, list and cancel tables at Nino's Pizza. I'm using the app on your laptop, through APIblaze.",
-    suggestions: ['Book table 4 for 2 people at 7:30pm', 'What are my bookings?', "Cancel booking r1"] });
-  if (W && c.widgets.keys) { $('#keys-card').hidden = false; W.keys('#keys', { endpoint: '/api/apiblaze/keys', theme }); }
-  if (W && c.widgets.groups) { $('#groups-card').hidden = false; W.groups('#groups', { endpoint: '/api/apiblaze/groups', theme }); }
+  if (c.portalUrl) $('#portal').href = c.portalUrl;
+  if (!c.gino) { const o = $('#admin-as').querySelector('[value="gina"]'); if (o) o.remove(); }
+  if (!c.widgets || (!c.widgets.keys && !c.widgets.groups)) $('#tab-admin').hidden = true;
+  refresh(); mountChat();
+  if (location.hash === '#admin') show('admin');
 });
 </script>
 </body>
@@ -6583,9 +6558,13 @@ fetch('/api/config').then((r) => r.json()).then((c) => {
 var demo_exports = {};
 __export(demo_exports, {
   DEMO_ADMIN_EMAIL: () => DEMO_ADMIN_EMAIL,
+  DEMO_GINO_ADMIN_EMAIL: () => DEMO_GINO_ADMIN_EMAIL,
   DEMO_RPS: () => DEMO_RPS,
   demoName: () => demoName,
+  routesOf: () => routesOf,
   runDemo: () => runDemo,
+  runDemoLogs: () => runDemoLogs,
+  runDemoStart: () => runDemoStart,
   runDemoStop: () => runDemoStop,
   stopDemos: () => stopDemos
 });
@@ -6641,7 +6620,8 @@ async function stopDemos() {
   return stopped;
 }
 function writeApp(dir) {
-  import_fs5.default.rmSync(dir, { recursive: true, force: true });
+  import_fs5.default.mkdirSync(dir, { recursive: true });
+  for (const entry of import_fs5.default.readdirSync(dir)) import_fs5.default.rmSync(import_path4.default.join(dir, entry), { recursive: true, force: true });
   for (const [rel, text] of Object.entries(DEMO_FILES)) {
     const f = import_path4.default.join(dir, rel);
     import_fs5.default.mkdirSync(import_path4.default.dirname(f), { recursive: true });
@@ -6667,7 +6647,7 @@ function loadState(dir) {
     return null;
   }
 }
-async function createProxy2(name, backendPort, openapi) {
+async function createProxy2(name, backendPort, openapi, tenantName) {
   const auth = resolveAuth({});
   const proposed = await proposeFromSpec(openapi).catch(() => null);
   const families = proposed?.status === 200 && Array.isArray(proposed.data?.families) ? proposed.data.families.filter((f) => !f.skipped_reason).map((f) => f.key) : [];
@@ -6680,7 +6660,7 @@ async function createProxy2(name, backendPort, openapi) {
     environments: { dev: { target: `http://localhost:${backendPort}`, description: `the ${B.cli} demo on this machine` } },
     // Two customers of the same app, each with its own key: the proxy's own tenant
     // is Nino Pizza, and the server adds Gino Pizza and returns its key.
-    tenant: `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`,
+    tenant: tenantName,
     extra_tenants: ["Gino Pizza"],
     ...families.length ? { secure: { families } } : {}
   };
@@ -6721,6 +6701,14 @@ async function waitReady(dir, s, serverKey) {
   }
   throw new DemoError(`The demo is running but ${B.product} cannot reach it yet (last answer ${last}).`, `Run again: ${LATEST} demo`);
 }
+async function offerBrowser(url, opts) {
+  if (opts.open === false || !process.stdin.isTTY || !process.stdout.isTTY) return;
+  const readline3 = await import("readline");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((res) => rl.question(`  Open ${url} in your browser? (Y/n) `, res));
+  rl.close();
+  if (!/^n/i.test(answer.trim())) openBrowser3(url);
+}
 function openBrowser3(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
@@ -6742,17 +6730,56 @@ async function runDemo(opts = {}) {
     process.exit(1);
   }
 }
+function routesOf(openapi) {
+  const out = [];
+  let curPath = "";
+  let cur = null;
+  for (const line of openapi.split("\n")) {
+    const p = /^ {2}(\/[^:]*):\s*$/.exec(line);
+    if (p) {
+      curPath = p[1];
+      cur = null;
+      continue;
+    }
+    const mth = /^ {4}(get|post|put|patch|delete):\s*$/.exec(line);
+    if (mth && curPath) {
+      cur = { method: mth[1].toUpperCase(), path: curPath, summary: "", op: "" };
+      out.push(cur);
+      continue;
+    }
+    const sum = /^ {6}summary:\s*(.+)$/.exec(line);
+    if (sum && cur) cur.summary = sum[1].trim();
+    const op2 = /^ {6}operationId:\s*(.+)$/.exec(line);
+    if (op2 && cur) cur.op = op2[1].trim();
+  }
+  return out;
+}
 async function startDemo(opts) {
   const t0 = Date.now();
-  const dir = import_path4.default.resolve(process.cwd(), DIR_NAME);
-  console.log(import_chalk25.default.dim(`Setting up the demo in ./${DIR_NAME} (about 30 seconds)\u2026`));
+  const here = process.cwd();
+  const dir = import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json")) ? here : import_path4.default.resolve(here, DIR_NAME);
+  const rel = import_path4.default.relative(here, dir) || ".";
+  const run2 = (...cmds) => {
+    for (const c of cmds) console.log(import_chalk25.default.dim(`   $ ${LATEST} ${c}`));
+  };
+  const step = (label3, text, note = "") => console.log(`   ${import_chalk25.default.green("\u2713")} ${import_chalk25.default.bold(label3.padEnd(17))} ${text}${note ? `   ${import_chalk25.default.dim(note)}` : ""}`);
   await stopDemos();
   writeApp(dir);
   const appPort = await freePort(3e3);
   const backendPort = await freePort(3001, [appPort]);
   const name = demoName();
   const openapi = DEMO_FILES["openapi.yaml"];
-  const r = await createProxy2(name, backendPort, openapi);
+  console.log();
+  console.log(import_chalk25.default.bold(`1. The app: Nino's Pizza, a table-booking backend, now in ${rel}`));
+  console.log(import_chalk25.default.dim(`   backend.js runs on this laptop (localhost:${backendPort}). Its routes, from openapi.yaml:`));
+  for (const r2 of routesOf(openapi)) console.log(`     ${r2.method.padEnd(7)}${r2.path.padEnd(21)}${import_chalk25.default.dim(r2.summary)}`);
+  console.log(import_chalk25.default.dim("   No login, no API keys, no permission checks in its code. That is APIblaze's job."));
+  console.log();
+  console.log(import_chalk25.default.bold(`2. ${B.product}, in front of it`) + import_chalk25.default.dim("   (each step does what the command above it does)"));
+  const ninoTenant = `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`;
+  run2(`dev --port ${backendPort} --openapi ./openapi.yaml --name ${name} --tenant ${ninoTenant} --auto`);
+  const tCreate = Date.now();
+  const r = await createProxy2(name, backendPort, openapi, ninoTenant);
   const cpKey = r.cp_key;
   const teamId = r.team_id;
   const keys = r.api_keys ?? {};
@@ -6764,24 +6791,40 @@ async function startDemo(opts) {
   const missing = [!cpKey && "workspace key", !teamId && "team", !serverKey && "API key", !tenant2 && "tenant"].filter(Boolean);
   if (missing.length) throw new DemoError(`${B.product} did not return everything the demo needs (${missing.join(", ")}).`, `Run again: ${LATEST} demo`);
   const apiUrl = restUrl(project, version2, "dev", { anon: true });
-  await cpFetch(cpKey, `/projects/${encodeURIComponent(project)}/${encodeURIComponent(version2)}/limits`, {
+  const gino = (rr.tenants ?? []).find((t) => t.api_key);
+  const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
+  step("Proxy", `${project}, created from openapi.yaml`, `${((Date.now() - tCreate) / 1e3).toFixed(1)} s \xB7 no account needed`);
+  const applied = (rr.secure?.applied ?? []).map((k) => k.replace(/^\//, "").split("/")[0]);
+  if (applied.length) step("Rules", `${applied.join(", ")}: only the person who made one can change or cancel it`);
+  const tools0 = routesOf(openapi).map((x) => x.op).filter(Boolean);
+  step("AI", `${tools0.length} tools for AI assistants, one per route (${tools0.join(", ")})`, "the MCP address");
+  if (gino?.tenant) run2(`tenant create --name "Gino Pizza" --slug ${gino.tenant}`, `tenant attach ${project} --tenant ${gino.tenant}`, `apikeys mint --tenant ${gino.tenant} --backend --env dev`);
+  step("Customers/Tenants", gino ? `Nino Pizza and Gino Pizza, each with its own API key` : `Nino Pizza, with its own API key`, "one API, kept apart");
+  run2(`admins add ${DEMO_ADMIN_EMAIL} --tenant ${tenant2}`, ...gino?.tenant ? [`admins add ${DEMO_GINO_ADMIN_EMAIL} --tenant ${gino.tenant}`] : []);
+  const limited = await cpFetch(cpKey, `/projects/${encodeURIComponent(project)}/${encodeURIComponent(version2)}/limits`, {
     method: "PUT",
     body: JSON.stringify({ consumerRps: DEMO_RPS, endUserRps: DEMO_RPS })
-  }).catch(() => {
-  });
-  await cpFetch(cpKey, `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin-emails`, {
+  }).then(() => true).catch(() => false);
+  const adminOk = await cpFetch(cpKey, `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin-emails`, {
     method: "POST",
     body: JSON.stringify({ email: DEMO_ADMIN_EMAIL })
-  }).catch(() => {
-  });
-  const gino = (r.tenants ?? []).find((t) => t.api_key);
-  const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
+  }).then(() => true).catch(() => false);
+  let ginaOk = false;
+  if (gino?.tenant) {
+    ginaOk = await cpFetch(cpKey, `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(gino.tenant)}/admin-emails`, {
+      method: "POST",
+      body: JSON.stringify({ email: DEMO_GINO_ADMIN_EMAIL })
+    }).then(() => true).catch(() => false);
+  }
+  if (adminOk) step("Admins", ginaOk ? "Ana runs Nino Pizza, Gina runs Gino Pizza" : "Ana runs Nino Pizza", "they manage keys and people on the Admin tab");
+  run2(`limits set ${project} --rate ${DEMO_RPS} --end-user-rate ${DEMO_RPS}`);
+  if (limited) step("Limits", `${DEMO_RPS} calls a second per customer`);
   writeEnv(dir, {
     APIBLAZE_NAME: project,
     APIBLAZE_TENANT: tenant2,
     APIBLAZE_URL: apiUrl,
     APIBLAZE_SERVER_KEY: serverKey,
-    ...gino?.api_key ? { APIBLAZE_GINO_KEY: gino.api_key } : {},
+    ...gino?.api_key ? { APIBLAZE_GINO_KEY: gino.api_key, APIBLAZE_GINO_TENANT: gino.tenant ?? "" } : {},
     APIBLAZE_MCP_URL: agents,
     APIBLAZE_PORTAL_URL: `https://${tenant2}.portal.apiblaze.com/${version2}`,
     // The keys + users widgets mint through the workspace's control key (server-side only).
@@ -6793,29 +6836,107 @@ async function startDemo(opts) {
   });
   const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort, apiUrl, claimCode: r.claim_code };
   saveState(dir, state);
-  const log4 = import_fs5.default.openSync(import_path4.default.join(dir, STATE_DIR, "demo.log"), "a");
-  const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
-  child.unref();
-  saveState(dir, { ...state, pid: child.pid });
-  writeRegistry([...readRegistry(), { dir, pid: child.pid ?? 0 }]);
-  await waitReady(dir, state, serverKey);
+  step("Keys", "saved to .env.local for the website's server, never printed");
+  await spawnServe(dir, state, serverKey);
+  step("Tunnel", `the public address now reaches localhost:${backendPort} on this laptop`, "the dev command above keeps it open \xB7 checked with a real call");
+  console.log(import_chalk25.default.dim(`   $ node start.js`) + import_chalk25.default.dim("   (in the demo folder: the backend and the website)"));
+  step("Website", `http://localhost:${appPort}, calling ${B.product} with one server key`);
   const url = `http://localhost:${appPort}`;
-  if (opts.open !== false) openBrowser3(url);
   const secs = Math.round((Date.now() - t0) / 1e3);
+  printReady(dir, secs);
+  await offerBrowser(url, opts);
+}
+function printReady(dir, secs) {
+  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  const row = (label3, value, note = "") => console.log(`  ${label3.padEnd(12)} ${value}${note ? `   ${import_chalk25.default.dim(note)}` : ""}`);
   console.log();
-  console.log(`${import_chalk25.default.green("\u2713")} Nino's Pizza, running on this laptop, is live on the internet: ${import_chalk25.default.bold(url)}   ${import_chalk25.default.dim(`(${secs} s)`)}`);
+  console.log(import_chalk25.default.bold(`3. Live: Nino's Pizza runs on this laptop and is on the internet`) + `   ${import_chalk25.default.dim(`(${secs} s)`)}`);
   console.log();
-  console.log("  Tell the user this, in plain words:");
-  console.log(`  1. "This booking app runs on your laptop. ${B.product} just gave it a public address, plus an MCP address so AI assistants can use it."`);
-  console.log('  2. "On the page, ask the assistant to book a table, and watch the request arrive on your laptop."');
-  console.log('  3. "API keys, sign-in and who-can-change-what are already on, with no code. Try the cards below."');
+  row("App", import_chalk25.default.bold(`http://localhost:${env.APP_PORT}`));
+  row("Public API", env.APIBLAZE_URL ?? "", `answered by localhost:${env.BACKEND_PORT}`);
+  row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor");
+  if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
   console.log();
-  console.log(`  Public API   ${apiUrl}`);
-  console.log(`  MCP          ${agents}`);
-  console.log(`  Same as      ${LATEST} dev --port ${backendPort} --openapi ./openapi.yaml   ${import_chalk25.default.dim("(the command for your own app)")}`);
-  console.log(import_chalk25.default.dim(`  Code in ./${DIR_NAME} \xB7 key saved in .env.local, never shown \xB7 stop: ${LATEST} demo stop`));
+  row("Logs", `${LATEST} demo logs`, "every request reaching your laptop");
+  row("Stop", `${LATEST} demo stop`);
+  row("Restart", `${LATEST} demo restart`, "same addresses and keys");
+  row("Start over", `${LATEST} demo`, "a brand-new demo");
   console.log();
-  console.log(`  Ask the user one question: "Want to put your own app on the internet like this?"`);
+  console.log(import_chalk25.default.dim(`  Code in ${import_path4.default.relative(process.cwd(), dir) || "."} \xB7 keys in .env.local, never shown here`));
+  console.log(import_chalk25.default.dim(`  Your own app: ${LATEST} dev --port <port>   \xB7   deployed already: ${LATEST} create --target <url>`));
+}
+function readEnvFile(file2) {
+  const out = {};
+  try {
+    for (const line of import_fs5.default.readFileSync(file2, "utf8").split("\n")) {
+      const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+      if (m) out[m[1]] = m[2];
+    }
+  } catch {
+  }
+  return out;
+}
+function demoDir() {
+  const here = process.cwd();
+  if (import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json"))) return here;
+  return import_path4.default.resolve(here, DIR_NAME);
+}
+async function spawnServe(dir, state, serverKey) {
+  const log4 = import_fs5.default.openSync(import_path4.default.join(dir, STATE_DIR, "demo.log"), "a");
+  const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
+  child.unref();
+  saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
+  writeRegistry([...readRegistry(), { dir, pid: child.pid ?? 0 }]);
+  await waitReady(dir, state, serverKey);
+}
+async function runDemoStart(opts = {}) {
+  const t0 = Date.now();
+  const dir = demoDir();
+  const state = loadState(dir);
+  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  if (!state || !env.APIBLAZE_SERVER_KEY) {
+    console.log(`${import_chalk25.default.red("\u2717")} There is no demo here to start.`);
+    console.log(`  Make one: ${LATEST} demo`);
+    process.exit(1);
+  }
+  try {
+    await stopDemos();
+    await spawnServe(dir, state, env.APIBLAZE_SERVER_KEY);
+  } catch (err) {
+    const e = err instanceof DemoError ? err : new DemoError(`The demo could not start (${err.message}).`, `Start over: ${LATEST} demo`);
+    await stopDemos().catch(() => 0);
+    console.log(`${import_chalk25.default.red("\u2717")} ${e.message}`);
+    console.log(`  ${e.fix}`);
+    process.exit(1);
+  }
+  printReady(dir, Math.round((Date.now() - t0) / 1e3));
+  await offerBrowser(`http://localhost:${env.APP_PORT}`, opts);
+}
+async function runDemoLogs() {
+  const file2 = import_path4.default.join(demoDir(), STATE_DIR, "demo.log");
+  if (!import_fs5.default.existsSync(file2)) {
+    console.log(`${import_chalk25.default.red("\u2717")} There is no demo log here.`);
+    console.log(`  Make a demo: ${LATEST} demo`);
+    process.exit(1);
+  }
+  console.log(import_chalk25.default.dim(`Following ${import_path4.default.relative(process.cwd(), file2)} \u2014 Ctrl-C stops following (the demo keeps running).`));
+  let pos = Math.max(0, import_fs5.default.statSync(file2).size - 4e3);
+  const pump = () => {
+    const size = import_fs5.default.statSync(file2).size;
+    if (size < pos) pos = 0;
+    if (size > pos) {
+      const fd = import_fs5.default.openSync(file2, "r");
+      const buf = Buffer.alloc(size - pos);
+      import_fs5.default.readSync(fd, buf, 0, buf.length, pos);
+      import_fs5.default.closeSync(fd);
+      pos = size;
+      process.stdout.write(buf.toString("utf8"));
+    }
+  };
+  pump();
+  setInterval(pump, 500);
+  await new Promise(() => {
+  });
 }
 async function runDemoStop() {
   const n = await stopDemos();
@@ -6884,7 +7005,7 @@ async function serveDemo(dir) {
   await new Promise(() => {
   });
 }
-var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_module, import_chalk25, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DemoError, ADJ, NOUN, pick2, registryFile, alive;
+var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_module, import_chalk25, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, DemoError, ADJ, NOUN, pick2, registryFile, alive;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
@@ -6907,6 +7028,7 @@ var init_demo = __esm({
     LATEST = `npx ${B.cli}@latest`;
     DEMO_RPS = 2;
     DEMO_ADMIN_EMAIL = "ana@ninopizza.example";
+    DEMO_GINO_ADMIN_EMAIL = "gina@ginopizza.example";
     DemoError = class extends Error {
       constructor(message, fix) {
         super(message);
@@ -7877,7 +7999,7 @@ description: Use when the user asks what ${P} (or ${B.cli}) does or can do for t
 
 ## Explain: they ask what ${P} does
 
-Run nothing. Say this, in these words or very close to them, then stop:
+Run nothing. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
 
 "${P} puts the app on your laptop on the internet in one command. It gets a public address,
 plus an address AI assistants like me can use to work with it. API keys, sign-in and
@@ -7889,14 +8011,13 @@ Do not use the words proxy, MCP, tenant, OpenAPI or header unless the user does
 
 1. Say one line: "Starting the demo, about 30 seconds."
 2. Run exactly this, in the foreground. It needs no login and asks nothing. It sets
-   everything up, opens the browser and exits by itself once the page is live:
+   everything up and exits by itself once the page is live. It opens nothing: give the user the App link it prints:
    \`${run2} demo\`
-3. When it prints \u2713, tell the story it printed, in plain words, with the link:
+3. When it prints \u2713, tell this story in plain words, with the App link it printed:
    - "This booking app runs on your laptop. ${P} just gave it a public address, and one for AI assistants."
-   - "On the page, ask the assistant to book a table and watch the request arrive on your laptop."
-   - "Keys, sign-in and who-can-change-what are already on, with no code. Try the cards."
+   - "On the Nino's Pizza tab, ask the assistant to book a table, and it appears in your list."
+   - "The Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart."
    Then ask one question: **"Want to put your own app on the internet like this?"**
-   If they say yes: their app runs locally \u2192 \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
 4. If it prints \u2717, say its one sentence and run the one command it gives, once.
 
 Rules for the demo: keep each update to one line. Do not narrate steps, read the demo's
@@ -7905,6 +8026,7 @@ in \`.env.local\` and never prints it.
 
 ## Their own app: they say yes to that
 
+Their app runs on this machine \u2192 it will use \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
 Run \`${run2} skills --ship\` and follow what it prints.
 `;
 }
@@ -12769,6 +12891,7 @@ async function runDomainSetBase(project, opts) {
 var import_chalk53 = __toESM(require("chalk"));
 var import_ora22 = __toESM(require("ora"));
 init_admin();
+init_caller();
 init_resolve();
 init_auth();
 init_tenant_pick();
@@ -12831,10 +12954,11 @@ async function runTenantCreate(opts) {
     console.error(import_chalk53.default.red("--name (display name) is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
   const spinner = (0, import_ora22.default)("Creating tenant...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "POST",
       path: `/teams/${encodeURIComponent(teamId)}/tenants`,
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
@@ -12852,11 +12976,12 @@ async function runTenantAttach(project, opts) {
     console.error(import_chalk53.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
   const spinner = (0, import_ora22.default)("Attaching tenant...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "POST",
       path: `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`,
       body: { tenant_name: opts.tenant, ...opts.authConfig ? { auth_config_id: opts.authConfig } : {} },
@@ -17288,8 +17413,10 @@ program.command("create").description(`Put an app that is already DEPLOYED behin
   }
 });
 program.command("integration").description(`What to add to your frontend and frontend-server for ${B.cli === "mcpblaze" ? "an MCP server" : "a proxy"} \u2014 the same kit the ${B.product} MCP hands an agent: widgets, the call-through with the key + X-End-User-Id, what your backend must trust, env vars, what stays open`).argument("<name>", `The ${B.thingShort} (project name)`).option("--stack <stack>", "nextjs | express | fastapi | other", "nextjs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--json", "Print the raw kit as JSON").action(action((name, opts) => runIntegration(name, opts)));
-program.command("demo").description(`See what ${B.product} does in 30 seconds: a small booking app on this machine, with ${B.product} in front of it (no login, no prompts)`).argument("[action]", '"stop" stops a running demo').option("--no-open", "Do not open the browser").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
+program.command("demo").description(`See what ${B.product} does in 30 seconds: a small booking app on this machine, with ${B.product} in front of it (no login, no prompts)`).argument("[action]", "stop \xB7 start / restart (the same demo again: same addresses and keys) \xB7 logs (follow the requests reaching your laptop)").option("--no-open", "Do not open the browser").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
   if (actionArg === "stop") return runDemoStop();
+  if (actionArg === "start" || actionArg === "restart") return runDemoStart(opts);
+  if (actionArg === "logs") return runDemoLogs();
   if (actionArg) {
     console.log(`Unknown demo action "${actionArg}". Run: npx ${B.cli}@latest demo`);
     process.exit(1);

package/dist/server/index.d.mts

@@ -67,6 +67,8 @@ declare class PlaneError extends Error {
  * `apiblaze authz` / the dashboard).
  */
 
+/** Marks the short-lived per-admin keys this widget mints; the API-key widget hides them. */
+declare const GROUPS_SESSION_KEY_DESCRIPTION = "Users & Groups widget (minted per admin session)";
 interface ApiblazeGroupsConfig {
     /** The producer CP key — the SAME widget key the API-key widget uses. Server-only.
      *  Here it only MINTS each admin's personal key, so it must be allowed to grant
@@ -318,4 +320,4 @@ declare function createApiblazeKeys(cfg: ApiblazeKeysConfig): {
     }>;
 };
 
-export { type ApiblazeChatConfig, type ApiblazeGroupsConfig, type ApiblazeKeysConfig, type AppUser, type ChatRelayUser, type GroupsAction, PlaneError, createApiblazeChat, createApiblazeGroups, createApiblazeKeys };
+export { type ApiblazeChatConfig, type ApiblazeGroupsConfig, type ApiblazeKeysConfig, type AppUser, type ChatRelayUser, GROUPS_SESSION_KEY_DESCRIPTION, type GroupsAction, PlaneError, createApiblazeChat, createApiblazeGroups, createApiblazeKeys };

package/dist/server/index.d.ts

@@ -67,6 +67,8 @@ declare class PlaneError extends Error {
  * `apiblaze authz` / the dashboard).
  */
 
+/** Marks the short-lived per-admin keys this widget mints; the API-key widget hides them. */
+declare const GROUPS_SESSION_KEY_DESCRIPTION = "Users & Groups widget (minted per admin session)";
 interface ApiblazeGroupsConfig {
     /** The producer CP key — the SAME widget key the API-key widget uses. Server-only.
      *  Here it only MINTS each admin's personal key, so it must be allowed to grant
@@ -318,4 +320,4 @@ declare function createApiblazeKeys(cfg: ApiblazeKeysConfig): {
     }>;
 };
 
-export { type ApiblazeChatConfig, type ApiblazeGroupsConfig, type ApiblazeKeysConfig, type AppUser, type ChatRelayUser, type GroupsAction, PlaneError, createApiblazeChat, createApiblazeGroups, createApiblazeKeys };
+export { type ApiblazeChatConfig, type ApiblazeGroupsConfig, type ApiblazeKeysConfig, type AppUser, type ChatRelayUser, GROUPS_SESSION_KEY_DESCRIPTION, type GroupsAction, PlaneError, createApiblazeChat, createApiblazeGroups, createApiblazeKeys };

package/dist/server/index.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  GROUPS_SESSION_KEY_DESCRIPTION: () => GROUPS_SESSION_KEY_DESCRIPTION,
   PlaneError: () => PlaneError,
   createApiblazeChat: () => createApiblazeChat,
   createApiblazeGroups: () => createApiblazeGroups,
@@ -87,6 +88,7 @@ function createPlaneCore(cfg) {
 }
 
 // src/server/groups.ts
+var GROUPS_SESSION_KEY_DESCRIPTION = "Users & Groups widget (minted per admin session)";
 function createApiblazeGroups(cfg) {
   if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId, email }.");
   const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base, iamBase: cfg.iamBase });
@@ -113,7 +115,7 @@ function createApiblazeGroups(cfg) {
         environment: "prod",
         permissions: ["call", "manage-access"],
         expires_in_seconds: KEY_TTL_SECONDS,
-        description: "Users & Groups widget (minted per admin session)"
+        description: GROUPS_SESSION_KEY_DESCRIPTION
       })
     });
     if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
@@ -372,13 +374,14 @@ function createApiblazeKeys(cfg) {
         catalogNames(user, tenant2)
       ]);
       const d = await listRes.json();
-      const keys = [...d.keys ?? []];
+      const visible = (k) => k?.description !== GROUPS_SESSION_KEY_DESCRIPTION;
+      const keys = [...d.keys ?? []].filter(visible);
       let cursor = d.page?.next_cursor ?? null;
       for (let hop = 0; hop < 50 && cursor; hop++) {
         const more = await planeFetch("GET", "/apikeys", user, { query: { tenant: tenant2, limit: "200", cursor } });
         if (!more.ok) break;
         const md = await more.json();
-        keys.push(...md.keys ?? []);
+        keys.push(...(md.keys ?? []).filter(visible));
         cursor = md.page?.next_cursor ?? null;
       }
       const eligible = allowed.filter((t) => catalog.includes(t));
@@ -447,6 +450,7 @@ function createApiblazeKeys(cfg) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  GROUPS_SESSION_KEY_DESCRIPTION,
   PlaneError,
   createApiblazeChat,
   createApiblazeGroups,

package/dist/server/index.mjs

@@ -58,6 +58,7 @@ function createPlaneCore(cfg) {
 }
 
 // src/server/groups.ts
+var GROUPS_SESSION_KEY_DESCRIPTION = "Users & Groups widget (minted per admin session)";
 function createApiblazeGroups(cfg) {
   if (typeof cfg.getUser !== "function") throw new Error("apiblaze: getUser is required \u2014 map your session to { tenant, userId, email }.");
   const core = createPlaneCore({ cpKey: cfg.cpKey, apikeysBase: cfg.base, iamBase: cfg.iamBase });
@@ -84,7 +85,7 @@ function createApiblazeGroups(cfg) {
         environment: "prod",
         permissions: ["call", "manage-access"],
         expires_in_seconds: KEY_TTL_SECONDS,
-        description: "Users & Groups widget (minted per admin session)"
+        description: GROUPS_SESSION_KEY_DESCRIPTION
       })
     });
     if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
@@ -343,13 +344,14 @@ function createApiblazeKeys(cfg) {
         catalogNames(user, tenant2)
       ]);
       const d = await listRes.json();
-      const keys = [...d.keys ?? []];
+      const visible = (k) => k?.description !== GROUPS_SESSION_KEY_DESCRIPTION;
+      const keys = [...d.keys ?? []].filter(visible);
       let cursor = d.page?.next_cursor ?? null;
       for (let hop = 0; hop < 50 && cursor; hop++) {
         const more = await planeFetch("GET", "/apikeys", user, { query: { tenant: tenant2, limit: "200", cursor } });
         if (!more.ok) break;
         const md = await more.json();
-        keys.push(...md.keys ?? []);
+        keys.push(...(md.keys ?? []).filter(visible));
         cursor = md.page?.next_cursor ?? null;
       }
       const eligible = allowed.filter((t) => catalog.includes(t));
@@ -417,6 +419,7 @@ function createApiblazeKeys(cfg) {
   return { handler, run };
 }
 export {
+  GROUPS_SESSION_KEY_DESCRIPTION,
   PlaneError,
   createApiblazeChat,
   createApiblazeGroups,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.22",
+  "version": "0.21.23",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",
@@ -93,5 +93,9 @@
     "react": {
       "optional": true
     }
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": true
   }
 }