apiblaze 0.21.41 → 0.21.43

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.41";
+    version = "0.21.43";
   }
 });
 
@@ -6505,7 +6505,7 @@ paths:
     post:
       operationId: createReservation
       summary: Book a table
-      description: Only the time is needed. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
+      description: Only the time is needed; the day is today unless a date is sent. For tomorrow or any other day, work out the date and send it. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
       requestBody:
         required: true
         content:
@@ -6533,7 +6533,7 @@ paths:
     patch:
       operationId: updateReservation
       summary: Change a booking
-      description: Move a booking to another table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
+      description: Move a booking to another day, table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
       requestBody:
         required: true
         content:
@@ -6545,7 +6545,7 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/Reservation' }
-        '409': { description: That table is already booked at that time }
+        '409': { description: That table is already booked that day at that time }
     delete:
       operationId: cancelReservation
       summary: Cancel a booking
@@ -6560,12 +6560,14 @@ components:
       properties:
         name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }
         table: { type: integer, example: 4, description: 'Optional: the restaurant picks a free table. Do not ask for it.' }
+        date: { type: string, format: date, example: '2026-10-09', description: 'Day of the booking, YYYY-MM-DD. Optional: today if not given.' }
         time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }
         guests: { type: integer, example: 2, description: 'How many people. Optional, 2 if not given.' }
     ReservationChange:
       type: object
       properties:
         table: { type: integer, example: 2, description: 'Move to this table.' }
+        date: { type: string, format: date, example: '2026-10-10', description: 'New day, YYYY-MM-DD' }
         time: { type: string, example: '20:00', description: 'New time, 24h HH:MM' }
         guests: { type: integer, example: 4, description: 'New number of people' }
     Reservation:
@@ -6575,7 +6577,7 @@ components:
           properties:
             id: { type: string, example: r1 }
 `,
-      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant picks the table: the lowest one still free at that time, at that restaurant.\nfunction freeTable(tenant, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, time),\n      time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const time = input.time ? String(input.time) : row.time;\n    const table = input.table ? Number(input.table) : (time === row.time ? row.table : freeTable(row.tenant, time));\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked at ${time}` });\n    Object.assign(row, { time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
       "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
       "public/index.html": `<!doctype html>
@@ -6693,6 +6695,7 @@ components:
         <p class="sub">Book here, or ask the assistant. Each person only sees their own.</p>
         <div class="form">
           <label><input type="number" id="guests" min="1" max="20" value="2"> people</label>
+          <label>on <input type="date" id="date"></label>
           <label>at <input type="time" id="time" value="19:30"></label>
           <button class="act primary" id="book">Book a table</button>
         </div>
@@ -6722,6 +6725,16 @@ components:
 <script src="/apiblaze-widgets.js"></script>
 <script>
 const $ = (s) => document.querySelector(s);
+// Days as the backend writes them (YYYY-MM-DD), on this laptop's clock; shown as today / tomorrow / Thu, Oct 9.
+const localDay = (offset = 0) => { const d = new Date(); d.setDate(d.getDate() + offset); return \`\${d.getFullYear()}-\${String(d.getMonth() + 1).padStart(2, '0')}-\${String(d.getDate()).padStart(2, '0')}\`; };
+const dayLabel = (day) => {
+  if (!day || day === localDay()) return 'today';
+  if (day === localDay(1)) return 'tomorrow';
+  const [y, m, d] = day.split('-').map(Number);
+  return new Date(y, m - 1, d).toLocaleDateString(undefined, { weekday: 'short', month: 'short', day: 'numeric' });
+};
+// The form books today unless they pick another day (and never a day already gone).
+$('#date').value = $('#date').min = localDay();
 const W = window.ApiblazeWidgets;
 const theme = { accent: '#e4572e' };
 // Every switch (pizzeria, tab, person) is a fresh page load, the choice kept in the address:
@@ -6802,7 +6815,7 @@ async function refresh() {
     const li = document.createElement('li');
     if (!seen.has(b.id)) { li.className = 'new'; seen.add(b.id); }
     const t = document.createElement('span');
-    t.textContent = \`\${b.guests || 2} people \xB7 \${b.time} \xB7 table \${b.table} \xB7 #\${b.id}\`;
+    t.textContent = \`\${b.guests || 2} people \xB7 \${dayLabel(b.date)} \${b.time} \xB7 table \${b.table} \xB7 #\${b.id}\`;
     const x = document.createElement('button'); x.className = 'act'; x.textContent = 'Cancel';
     x.onclick = async () => { await act('cancel', { id: b.id }); refresh(); };
     li.append(t, x); ul.append(li);
@@ -6811,8 +6824,9 @@ async function refresh() {
 }
 $('#book').onclick = async () => {
   const guests = Math.max(1, Number($('#guests').value) || 2);
+  const date = $('#date').value || localDay();
   const time = $('#time').value || '19:30';
-  await act('book', { body: { guests, time } }); // the restaurant picks the table
+  await act('book', { body: { guests, date, time } }); // the restaurant picks the table
   refresh();
 };
 $('#ben-cancel').onclick = async () => {
@@ -6849,7 +6863,7 @@ function mountChat() {
   W.chat('#chat', { endpoint: \`/api/apiblaze/chat?pizzeria=\${state.pizzeria}&as=\${me()}\`, mode: 'inline', title: \`\${pz().label} assistant\`, avatar: '\u{1F355}', height: 520, theme,
     storageKey: 'pizza-chat-' + key,
     welcome: \`Hi \${who}! I can book, list and cancel your tables at \${pz().label}. I'm using the app on your laptop, through APIblaze.\`,
-    suggestions: ['Book a table for 4 people at 8pm', 'What are my reservations?'] });
+    suggestions: ['Book a table for 4 people tomorrow at 8pm', 'What are my reservations?'] });
 }
 
 // \u2500\u2500 admin \u2500\u2500
@@ -7918,7 +7932,7 @@ async function waitTunnel(dir) {
 }
 async function waitThrough(apiUrl, serverKey) {
   let last = 0;
-  for (let i = 0; i < 60; i++) {
+  for (let i = 0; i < 120; i++) {
     try {
       const r = await fetch(`${apiUrl}/reservations`, { headers: { "x-api-key": serverKey, "x-end-user-id": "ana" } });
       last = r.status;
@@ -8109,7 +8123,9 @@ paths:`));
   console.log(import_chalk24.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
   console.log(import_chalk24.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path5.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
   console.log(import_chalk24.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
-  console.log(import_chalk24.default.cyan(`       -H "content-type: application/json" -d '{"time":"19:30","guests":2}'`));
+  const tomorrow = new Date(Date.now() + 864e5);
+  const day = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, "0")}-${String(tomorrow.getDate()).padStart(2, "0")}`;
+  console.log(import_chalk24.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
   if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
     return stopHere("proxy", [
       `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk24.default.dim(`(${cdDir}npm run stop stops it)`)}`,
@@ -9655,14 +9671,15 @@ function folderReport(f, opts = {}) {
 function blockedMarkdown() {
   return `## If a command is blocked or fails
 
-A permission prompt declined, a command denied, or a step needing access you do not have:
-- **A step the rest depends on** (the tunnel, creating the proxy, its key): stop there. In one
-  line, say what it was for and give the user the exact command to run themselves
-  (\`! <command>\` in Claude Code). Then wait. If they would rather not, say it stops here.
-- **An optional step** (groups, admins, widgets, a rule, limits): skip it. Say in one line what
-  is missing because of it, and carry on with what does not need it.
-- **Always:** never retry it in pieces, take another route, or write code to replace it. Never
-  say something works until you have checked it: a call that answered, or a page you loaded.
+When a permission prompt is declined, a command is denied, or a step needs access you do not have:
+- **A step the rest depends on** (the tunnel, creating the proxy, its key): nothing after it can
+  work, so the useful move is to stop there, say what it was for, and give the user the exact
+  command to run themselves (\`! <command>\` in Claude Code).
+- **An optional step** (groups, admins, widgets, a rule, limits): the rest works without it. Skip
+  it and say what is missing because of it.
+- Working around a blocked step (retrying it in pieces, another route, code written to replace
+  it) leaves a half-built setup that fails in ways nobody can read. And something only works
+  once it has been checked: a call that answered, or a page that loaded.
 `;
 }
 function staleSkillCopies(cwd = process.cwd(), home = import_os2.default.homedir()) {
@@ -9682,90 +9699,97 @@ function heroMarkdown(found, stale = []) {
   const run2 = `npx ${B.cli}@latest`;
   const report = found ? folderReport(found) : null;
   const port = found ? backendPort(found) : void 0;
-  const folder = report ? `## This folder, checked by the CLI just now: read no files to decide what to offer
+  const folder = report ? `## This folder (the CLI checked it just now)
 
 ${report.lines.map((l) => `- ${l}`).join("\n")}
 ` : `## First, the folder
 
-Run \`${run2} skills\` in the project folder and follow what it prints: it checks the folder
-and gives the exact question to ask.
+Run \`${run2} skills\` in the project folder: it checks the folder and prints the current version
+of this guide, with the next step that fits it.
 `;
-  const question = report?.question ?? "<the question it prints>";
+  const question = report?.question ?? "the question it prints for the folder";
   const ownApi = report?.ownApi && found ? (() => {
     const specArg = found.specFile ? ` --openapi ${found.specFile}` : "";
-    const steps = [`Say one line: "Putting your API behind ${P}, about 30 seconds."`];
+    const steps = [];
     if (!found.listening) {
       steps.push(`Start it first as its own detached process${found.start ? `: \`nohup ${found.start} > app.log 2>&1 < /dev/null &\`` : ", with its usual start command"}. Wait until localhost:${port ?? "<port>"} answers.`);
     }
     if (!found.specFile && !found.specUrl) {
-      steps.push('Write `./openapi.yaml` from its route files first: every path and method, and the id each POST returns. Say "Writing an OpenAPI spec from your code."');
+      steps.push("Write `./openapi.yaml` from its route files first: every path and method, and the id each POST returns.");
     }
     const spec2 = found.specFile ? specArg : !found.specUrl ? " --openapi ./openapi.yaml" : "";
-    steps.push(`Open the tunnel as its own detached process, never \`cmd &\` inside a shell call that ends:
+    steps.push(`Open the tunnel as its own detached process (a \`cmd &\` inside a shell call that ends is killed with it):
    \`nohup ${run2} dev --port ${port ?? "<port>"}${spec2} --auto > ${B.cli}-dev.log 2>&1 < /dev/null &\`
-   Then read ${B.cli}-dev.log until it says "is live on the internet" (about 20 seconds). It saves the key to .env.local itself.`);
-    steps.push(`Tell them in plain words, with the two addresses it printed: their API is on the internet at the API address, and AI assistants can use it at the MCP address. API keys, sign-in, rules for who can change what, and rate limits are already on. Say "saved your key to .env.local". Leave the tunnel running.`);
-    steps.push(`Ask one question: **"Want it ready for real customers: their own API keys, sign-in, and only-the-owner-can-change rules?"** If yes, run \`${run2} skills ship\` and follow it from "Adopt".`);
+   ${B.cli}-dev.log says "is live on the internet" after about 20 seconds. It saves the key to .env.local itself.`);
+    steps.push(`What they have then, with the two addresses it printed: their API on the internet at the API address, and an address AI assistants can use (MCP). API keys, sign-in, rules for who can change what, and rate limits are already on. The key is saved to .env.local and never printed. The tunnel keeps running.`);
+    steps.push(`The natural next step: ready for real customers, with their own API keys, sign-in, and only-the-owner-can-change rules. \`${run2} skills ship\` has that procedure, from "Adopt".`);
     return `
-## Their API: they say yes to putting it behind ${P}
+## Their API, if they want it behind ${P}
 
 ${steps.map((t, i) => `${i + 1}. ${t}`).join("\n")}
 `;
   })() : "";
-  return `---
+  const frontMatter = found ? "" : `---
 name: ${SKILL_NAME}
 description: Use when the user asks what ${P} (or ${B.cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share or expose an API; wants API keys, sign-in, per-user data, rate limits or quotas; wants AI agents to use their app safely; or says users can reach each other's records.
 ---
 
-# ${P}
+`;
+  return `${frontMatter}# ${P}
 
-This output is current: it replaces any copy of this skill loaded earlier.
+What \`${run2} skills\` reports: what ${P} is, what is in this folder, and the next steps you can
+offer. Nothing here needs to run before the user says so.
 ${stale.length ? `
-## Outdated copies are installed: ignore them
+## Older copies of this guide are installed
 
 ${stale.map((f) => `- \`${f}\``).join("\n")}
 
-They hold an older walkthrough. Follow only what this output says. Tell the user once that the
-file is outdated (re-run \`${run2} skills --install --force\` in that folder to refresh it).
+They were written for an older CLI; this output is the current one. The user can refresh a copy
+with \`${run2} skills --install --force\` in its folder.
 ` : ""}
 ${folder}
-## Explain: they ask what ${P} does or can do for them
+## What ${P} is
 
-Run nothing else. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
+${pitchText()}
 
-"${pitchText()} ${question}"
+For a first "what does it do", that is usually enough: the demo shows the rest. The next step to
+offer: ${question}
 
-Do not use the words proxy, tenant, OpenAPI or header unless the user does first.
+Most people new to it do not know the words proxy, tenant, OpenAPI or header, so plain words work best.
 ${ownApi}
-## Demo: they say yes to the sample app, or ask to see or try it
+## The demo, if they want to see it
+
+\`${run2} demo\` takes about 30 seconds, needs no login and asks nothing. It:
+- writes a small table-booking app into ./${B.cli}-demo and runs it on this machine (localhost, from
+  port 3000 up, skipping any port another program uses);
+- puts a temporary ${P} gateway in front of it (anonymous, no account) with a tunnel to the app;
+- prints the links once the page is live, then exits. It opens nothing and never prints a key
+  (keys are saved in ./${B.cli}-demo/.env.local).
 
-1. Say one line: "Starting the demo, about 30 seconds."
-2. Run exactly this, in the foreground. It needs no login and asks nothing. It sets
-   everything up and exits by itself once the page is live. It opens nothing: give the user the App link it prints:
-   \`${run2} demo\`
-3. When it prints \u2713, tell this story in plain words, with the App link it printed:
-   - "This booking app runs on your laptop. ${P} just gave it a public address, and one for AI assistants."
-   - "On the Reservations tab, ask the assistant to book a table, and it appears in your list. The switch at the top shows the same app straight to localhost, unprotected."
-   - "The Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart."
-   Then ask one question: **"Want to put your own app on the internet like this?"**
-4. If it prints \u2717, say its one sentence and run the one command it gives, once.
+Run it in the foreground. It is self-contained: nothing in its folder needs reading or changing,
+and its own output says what happened. When it prints \u2713, the links it printed are the thing to
+show, in plain words:
+- the booking app runs on their laptop, and ${P} just gave it a public address, plus one for AI
+  assistants;
+- on the Reservations tab, asking the assistant to book a table makes it appear in the list; the
+  switch at the top shows the same app straight to localhost, unprotected;
+- the Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart.
+The question it leads to: **"Want to put your own app on the internet like this?"**
 
-Rules for the demo: keep each update to one line. Do not narrate steps, read the demo's
-files, open logs, run other commands, or write code. Never show a key: the demo saves it
-in \`.env.local\` and never prints it.
+If it prints \u2717, its one sentence says what failed and the one command after it is the fix.
 
 ${blockedMarkdown()}
-## Their own app: they say yes after the demo
+## Their own app, after the demo
 
-Their app runs on this machine \u2192 it will use \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
-Run \`${run2} skills ship\` and follow what it prints.
+On this machine \u2192 \`${run2} dev\`; deployed \u2192 \`${run2} create\`. \`${run2} skills ship\` has the
+whole procedure.
 
-## One thing at a time, later
+## One thing at a time
 
-When they ask about one thing, read only its page: \`${run2} skills keys\` (API keys) \xB7
-\`signin\` (OAuth sign-in and the developer portal) \xB7 \`rules\` (who can change what) \xB7
-\`limits\` (rate limits and quotas) \xB7 \`mcp\` (AI agents) \xB7 \`widgets\` (keys, users and chat on
-their site) \xB7 \`ship\` (the whole procedure for their own app).
+Each topic has its own page: \`${run2} skills keys\` (API keys) \xB7 \`signin\` (OAuth sign-in and the
+developer portal) \xB7 \`rules\` (who can change what) \xB7 \`limits\` (rate limits and quotas) \xB7 \`mcp\`
+(AI agents) \xB7 \`widgets\` (keys, users and chat on their site) \xB7 \`ship\` (the whole procedure for
+their own app).
 `;
 }
 function shipMarkdown() {
@@ -9930,7 +9954,7 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
   of the job: move the call to a server route, delete the public variable, say so in the report.
 - **Both** (monorepo): do the backend first, then the frontend.
 
-**Ask for what is missing \u2014 and nothing else.**
+**Ask only for what is missing.**
 - Backend found only on localhost \u2192 "Where is it hosted for production?" (a URL, or "not yet").
 - Backend protected by a secret whose value is in an env var \u2192 "What is the value of
   \`<VAR>\`, or should I keep it where it is?" Never read secrets out of \`.env\` aloud.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.41",
+  "version": "0.21.43",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",