apiblaze 0.21.42 → 0.21.43

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.42";
+    version = "0.21.43";
   }
 });
 
@@ -6505,7 +6505,7 @@ paths:
     post:
       operationId: createReservation
       summary: Book a table
-      description: Only the time is needed. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
+      description: Only the time is needed; the day is today unless a date is sent. For tomorrow or any other day, work out the date and send it. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
       requestBody:
         required: true
         content:
@@ -6533,7 +6533,7 @@ paths:
     patch:
       operationId: updateReservation
       summary: Change a booking
-      description: Move a booking to another table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
+      description: Move a booking to another day, table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
       requestBody:
         required: true
         content:
@@ -6545,7 +6545,7 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/Reservation' }
-        '409': { description: That table is already booked at that time }
+        '409': { description: That table is already booked that day at that time }
     delete:
       operationId: cancelReservation
       summary: Cancel a booking
@@ -6560,12 +6560,14 @@ components:
       properties:
         name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }
         table: { type: integer, example: 4, description: 'Optional: the restaurant picks a free table. Do not ask for it.' }
+        date: { type: string, format: date, example: '2026-10-09', description: 'Day of the booking, YYYY-MM-DD. Optional: today if not given.' }
         time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }
         guests: { type: integer, example: 2, description: 'How many people. Optional, 2 if not given.' }
     ReservationChange:
       type: object
       properties:
         table: { type: integer, example: 2, description: 'Move to this table.' }
+        date: { type: string, format: date, example: '2026-10-10', description: 'New day, YYYY-MM-DD' }
         time: { type: string, example: '20:00', description: 'New time, 24h HH:MM' }
         guests: { type: integer, example: 4, description: 'New number of people' }
     Reservation:
@@ -6575,7 +6577,7 @@ components:
           properties:
             id: { type: string, example: r1 }
 `,
-      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant picks the table: the lowest one still free at that time, at that restaurant.\nfunction freeTable(tenant, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, time),\n      time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const time = input.time ? String(input.time) : row.time;\n    const table = input.table ? Number(input.table) : (time === row.time ? row.table : freeTable(row.tenant, time));\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked at ${time}` });\n    Object.assign(row, { time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
       "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
       "public/index.html": `<!doctype html>
@@ -6693,6 +6695,7 @@ components:
         <p class="sub">Book here, or ask the assistant. Each person only sees their own.</p>
         <div class="form">
           <label><input type="number" id="guests" min="1" max="20" value="2"> people</label>
+          <label>on <input type="date" id="date"></label>
           <label>at <input type="time" id="time" value="19:30"></label>
           <button class="act primary" id="book">Book a table</button>
         </div>
@@ -6722,6 +6725,16 @@ components:
 <script src="/apiblaze-widgets.js"></script>
 <script>
 const $ = (s) => document.querySelector(s);
+// Days as the backend writes them (YYYY-MM-DD), on this laptop's clock; shown as today / tomorrow / Thu, Oct 9.
+const localDay = (offset = 0) => { const d = new Date(); d.setDate(d.getDate() + offset); return \`\${d.getFullYear()}-\${String(d.getMonth() + 1).padStart(2, '0')}-\${String(d.getDate()).padStart(2, '0')}\`; };
+const dayLabel = (day) => {
+  if (!day || day === localDay()) return 'today';
+  if (day === localDay(1)) return 'tomorrow';
+  const [y, m, d] = day.split('-').map(Number);
+  return new Date(y, m - 1, d).toLocaleDateString(undefined, { weekday: 'short', month: 'short', day: 'numeric' });
+};
+// The form books today unless they pick another day (and never a day already gone).
+$('#date').value = $('#date').min = localDay();
 const W = window.ApiblazeWidgets;
 const theme = { accent: '#e4572e' };
 // Every switch (pizzeria, tab, person) is a fresh page load, the choice kept in the address:
@@ -6802,7 +6815,7 @@ async function refresh() {
     const li = document.createElement('li');
     if (!seen.has(b.id)) { li.className = 'new'; seen.add(b.id); }
     const t = document.createElement('span');
-    t.textContent = \`\${b.guests || 2} people \xB7 \${b.time} \xB7 table \${b.table} \xB7 #\${b.id}\`;
+    t.textContent = \`\${b.guests || 2} people \xB7 \${dayLabel(b.date)} \${b.time} \xB7 table \${b.table} \xB7 #\${b.id}\`;
     const x = document.createElement('button'); x.className = 'act'; x.textContent = 'Cancel';
     x.onclick = async () => { await act('cancel', { id: b.id }); refresh(); };
     li.append(t, x); ul.append(li);
@@ -6811,8 +6824,9 @@ async function refresh() {
 }
 $('#book').onclick = async () => {
   const guests = Math.max(1, Number($('#guests').value) || 2);
+  const date = $('#date').value || localDay();
   const time = $('#time').value || '19:30';
-  await act('book', { body: { guests, time } }); // the restaurant picks the table
+  await act('book', { body: { guests, date, time } }); // the restaurant picks the table
   refresh();
 };
 $('#ben-cancel').onclick = async () => {
@@ -6849,7 +6863,7 @@ function mountChat() {
   W.chat('#chat', { endpoint: \`/api/apiblaze/chat?pizzeria=\${state.pizzeria}&as=\${me()}\`, mode: 'inline', title: \`\${pz().label} assistant\`, avatar: '\u{1F355}', height: 520, theme,
     storageKey: 'pizza-chat-' + key,
     welcome: \`Hi \${who}! I can book, list and cancel your tables at \${pz().label}. I'm using the app on your laptop, through APIblaze.\`,
-    suggestions: ['Book a table for 4 people at 8pm', 'What are my reservations?'] });
+    suggestions: ['Book a table for 4 people tomorrow at 8pm', 'What are my reservations?'] });
 }
 
 // \u2500\u2500 admin \u2500\u2500
@@ -8109,7 +8123,9 @@ paths:`));
   console.log(import_chalk24.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
   console.log(import_chalk24.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path5.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
   console.log(import_chalk24.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
-  console.log(import_chalk24.default.cyan(`       -H "content-type: application/json" -d '{"time":"19:30","guests":2}'`));
+  const tomorrow = new Date(Date.now() + 864e5);
+  const day = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, "0")}-${String(tomorrow.getDate()).padStart(2, "0")}`;
+  console.log(import_chalk24.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
   if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
     return stopHere("proxy", [
       `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk24.default.dim(`(${cdDir}npm run stop stops it)`)}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.42",
+  "version": "0.21.43",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",