apiblaze 0.21.41 → 0.21.42

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.41";
+    version = "0.21.42";
   }
 });
 
@@ -7918,7 +7918,7 @@ async function waitTunnel(dir) {
 }
 async function waitThrough(apiUrl, serverKey) {
   let last = 0;
-  for (let i = 0; i < 60; i++) {
+  for (let i = 0; i < 120; i++) {
     try {
       const r = await fetch(`${apiUrl}/reservations`, { headers: { "x-api-key": serverKey, "x-end-user-id": "ana" } });
       last = r.status;
@@ -9655,14 +9655,15 @@ function folderReport(f, opts = {}) {
 function blockedMarkdown() {
   return `## If a command is blocked or fails
 
-A permission prompt declined, a command denied, or a step needing access you do not have:
-- **A step the rest depends on** (the tunnel, creating the proxy, its key): stop there. In one
-  line, say what it was for and give the user the exact command to run themselves
-  (\`! <command>\` in Claude Code). Then wait. If they would rather not, say it stops here.
-- **An optional step** (groups, admins, widgets, a rule, limits): skip it. Say in one line what
-  is missing because of it, and carry on with what does not need it.
-- **Always:** never retry it in pieces, take another route, or write code to replace it. Never
-  say something works until you have checked it: a call that answered, or a page you loaded.
+When a permission prompt is declined, a command is denied, or a step needs access you do not have:
+- **A step the rest depends on** (the tunnel, creating the proxy, its key): nothing after it can
+  work, so the useful move is to stop there, say what it was for, and give the user the exact
+  command to run themselves (\`! <command>\` in Claude Code).
+- **An optional step** (groups, admins, widgets, a rule, limits): the rest works without it. Skip
+  it and say what is missing because of it.
+- Working around a blocked step (retrying it in pieces, another route, code written to replace
+  it) leaves a half-built setup that fails in ways nobody can read. And something only works
+  once it has been checked: a call that answered, or a page that loaded.
 `;
 }
 function staleSkillCopies(cwd = process.cwd(), home = import_os2.default.homedir()) {
@@ -9682,90 +9683,97 @@ function heroMarkdown(found, stale = []) {
   const run2 = `npx ${B.cli}@latest`;
   const report = found ? folderReport(found) : null;
   const port = found ? backendPort(found) : void 0;
-  const folder = report ? `## This folder, checked by the CLI just now: read no files to decide what to offer
+  const folder = report ? `## This folder (the CLI checked it just now)
 
 ${report.lines.map((l) => `- ${l}`).join("\n")}
 ` : `## First, the folder
 
-Run \`${run2} skills\` in the project folder and follow what it prints: it checks the folder
-and gives the exact question to ask.
+Run \`${run2} skills\` in the project folder: it checks the folder and prints the current version
+of this guide, with the next step that fits it.
 `;
-  const question = report?.question ?? "<the question it prints>";
+  const question = report?.question ?? "the question it prints for the folder";
   const ownApi = report?.ownApi && found ? (() => {
     const specArg = found.specFile ? ` --openapi ${found.specFile}` : "";
-    const steps = [`Say one line: "Putting your API behind ${P}, about 30 seconds."`];
+    const steps = [];
     if (!found.listening) {
       steps.push(`Start it first as its own detached process${found.start ? `: \`nohup ${found.start} > app.log 2>&1 < /dev/null &\`` : ", with its usual start command"}. Wait until localhost:${port ?? "<port>"} answers.`);
     }
     if (!found.specFile && !found.specUrl) {
-      steps.push('Write `./openapi.yaml` from its route files first: every path and method, and the id each POST returns. Say "Writing an OpenAPI spec from your code."');
+      steps.push("Write `./openapi.yaml` from its route files first: every path and method, and the id each POST returns.");
     }
     const spec2 = found.specFile ? specArg : !found.specUrl ? " --openapi ./openapi.yaml" : "";
-    steps.push(`Open the tunnel as its own detached process, never \`cmd &\` inside a shell call that ends:
+    steps.push(`Open the tunnel as its own detached process (a \`cmd &\` inside a shell call that ends is killed with it):
    \`nohup ${run2} dev --port ${port ?? "<port>"}${spec2} --auto > ${B.cli}-dev.log 2>&1 < /dev/null &\`
-   Then read ${B.cli}-dev.log until it says "is live on the internet" (about 20 seconds). It saves the key to .env.local itself.`);
-    steps.push(`Tell them in plain words, with the two addresses it printed: their API is on the internet at the API address, and AI assistants can use it at the MCP address. API keys, sign-in, rules for who can change what, and rate limits are already on. Say "saved your key to .env.local". Leave the tunnel running.`);
-    steps.push(`Ask one question: **"Want it ready for real customers: their own API keys, sign-in, and only-the-owner-can-change rules?"** If yes, run \`${run2} skills ship\` and follow it from "Adopt".`);
+   ${B.cli}-dev.log says "is live on the internet" after about 20 seconds. It saves the key to .env.local itself.`);
+    steps.push(`What they have then, with the two addresses it printed: their API on the internet at the API address, and an address AI assistants can use (MCP). API keys, sign-in, rules for who can change what, and rate limits are already on. The key is saved to .env.local and never printed. The tunnel keeps running.`);
+    steps.push(`The natural next step: ready for real customers, with their own API keys, sign-in, and only-the-owner-can-change rules. \`${run2} skills ship\` has that procedure, from "Adopt".`);
     return `
-## Their API: they say yes to putting it behind ${P}
+## Their API, if they want it behind ${P}
 
 ${steps.map((t, i) => `${i + 1}. ${t}`).join("\n")}
 `;
   })() : "";
-  return `---
+  const frontMatter = found ? "" : `---
 name: ${SKILL_NAME}
 description: Use when the user asks what ${P} (or ${B.cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share or expose an API; wants API keys, sign-in, per-user data, rate limits or quotas; wants AI agents to use their app safely; or says users can reach each other's records.
 ---
 
-# ${P}
+`;
+  return `${frontMatter}# ${P}
 
-This output is current: it replaces any copy of this skill loaded earlier.
+What \`${run2} skills\` reports: what ${P} is, what is in this folder, and the next steps you can
+offer. Nothing here needs to run before the user says so.
 ${stale.length ? `
-## Outdated copies are installed: ignore them
+## Older copies of this guide are installed
 
 ${stale.map((f) => `- \`${f}\``).join("\n")}
 
-They hold an older walkthrough. Follow only what this output says. Tell the user once that the
-file is outdated (re-run \`${run2} skills --install --force\` in that folder to refresh it).
+They were written for an older CLI; this output is the current one. The user can refresh a copy
+with \`${run2} skills --install --force\` in its folder.
 ` : ""}
 ${folder}
-## Explain: they ask what ${P} does or can do for them
+## What ${P} is
 
-Run nothing else. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
+${pitchText()}
 
-"${pitchText()} ${question}"
+For a first "what does it do", that is usually enough: the demo shows the rest. The next step to
+offer: ${question}
 
-Do not use the words proxy, tenant, OpenAPI or header unless the user does first.
+Most people new to it do not know the words proxy, tenant, OpenAPI or header, so plain words work best.
 ${ownApi}
-## Demo: they say yes to the sample app, or ask to see or try it
+## The demo, if they want to see it
+
+\`${run2} demo\` takes about 30 seconds, needs no login and asks nothing. It:
+- writes a small table-booking app into ./${B.cli}-demo and runs it on this machine (localhost, from
+  port 3000 up, skipping any port another program uses);
+- puts a temporary ${P} gateway in front of it (anonymous, no account) with a tunnel to the app;
+- prints the links once the page is live, then exits. It opens nothing and never prints a key
+  (keys are saved in ./${B.cli}-demo/.env.local).
 
-1. Say one line: "Starting the demo, about 30 seconds."
-2. Run exactly this, in the foreground. It needs no login and asks nothing. It sets
-   everything up and exits by itself once the page is live. It opens nothing: give the user the App link it prints:
-   \`${run2} demo\`
-3. When it prints \u2713, tell this story in plain words, with the App link it printed:
-   - "This booking app runs on your laptop. ${P} just gave it a public address, and one for AI assistants."
-   - "On the Reservations tab, ask the assistant to book a table, and it appears in your list. The switch at the top shows the same app straight to localhost, unprotected."
-   - "The Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart."
-   Then ask one question: **"Want to put your own app on the internet like this?"**
-4. If it prints \u2717, say its one sentence and run the one command it gives, once.
+Run it in the foreground. It is self-contained: nothing in its folder needs reading or changing,
+and its own output says what happened. When it prints \u2713, the links it printed are the thing to
+show, in plain words:
+- the booking app runs on their laptop, and ${P} just gave it a public address, plus one for AI
+  assistants;
+- on the Reservations tab, asking the assistant to book a table makes it appear in the list; the
+  switch at the top shows the same app straight to localhost, unprotected;
+- the Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart.
+The question it leads to: **"Want to put your own app on the internet like this?"**
 
-Rules for the demo: keep each update to one line. Do not narrate steps, read the demo's
-files, open logs, run other commands, or write code. Never show a key: the demo saves it
-in \`.env.local\` and never prints it.
+If it prints \u2717, its one sentence says what failed and the one command after it is the fix.
 
 ${blockedMarkdown()}
-## Their own app: they say yes after the demo
+## Their own app, after the demo
 
-Their app runs on this machine \u2192 it will use \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
-Run \`${run2} skills ship\` and follow what it prints.
+On this machine \u2192 \`${run2} dev\`; deployed \u2192 \`${run2} create\`. \`${run2} skills ship\` has the
+whole procedure.
 
-## One thing at a time, later
+## One thing at a time
 
-When they ask about one thing, read only its page: \`${run2} skills keys\` (API keys) \xB7
-\`signin\` (OAuth sign-in and the developer portal) \xB7 \`rules\` (who can change what) \xB7
-\`limits\` (rate limits and quotas) \xB7 \`mcp\` (AI agents) \xB7 \`widgets\` (keys, users and chat on
-their site) \xB7 \`ship\` (the whole procedure for their own app).
+Each topic has its own page: \`${run2} skills keys\` (API keys) \xB7 \`signin\` (OAuth sign-in and the
+developer portal) \xB7 \`rules\` (who can change what) \xB7 \`limits\` (rate limits and quotas) \xB7 \`mcp\`
+(AI agents) \xB7 \`widgets\` (keys, users and chat on their site) \xB7 \`ship\` (the whole procedure for
+their own app).
 `;
 }
 function shipMarkdown() {
@@ -9930,7 +9938,7 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
   of the job: move the call to a server route, delete the public variable, say so in the report.
 - **Both** (monorepo): do the backend first, then the frontend.
 
-**Ask for what is missing \u2014 and nothing else.**
+**Ask only for what is missing.**
 - Backend found only on localhost \u2192 "Where is it hosted for production?" (a URL, or "not yet").
 - Backend protected by a secret whose value is in an env var \u2192 "What is the value of
   \`<VAR>\`, or should I keep it where it is?" Never read secrets out of \`.env\` aloud.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.41",
+  "version": "0.21.42",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",