apiblaze 0.21.43 → 0.21.44

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.43";
+    version = "0.21.44";
   }
 });
 
@@ -2139,6 +2139,17 @@ function fail(message) {
   console.error(import_chalk11.default.red(`Error: ${message}`));
   process.exit(1);
 }
+function claimRefusalMessage(code, status2, team, claimCode) {
+  if (code === "merge_not_supported_with_iam") {
+    return `This workspace has people, groups or admins, so it can't be merged into ${team ? `"${team}"` : "an existing team"} yet.
+  Claim it as a new team instead: ${B.cli} claim ${claimCode}`;
+  }
+  if (status2 === 403 && code === "forbidden" && team) {
+    return `Merging into "${team}" needs the admin role on that team.
+  Claim it as a new team instead: ${B.cli} claim ${claimCode}`;
+  }
+  return null;
+}
 async function runClaim(claimCodeArg, opts) {
   const creds = loadCredentials();
   if (!creds) fail("Not logged in. Run `apiblaze login` first, then claim.");
@@ -2170,6 +2181,8 @@ async function runClaim(claimCodeArg, opts) {
   } catch (err) {
     if (err instanceof ApiError) {
       const c = typeof err.body === "object" && err.body ? err.body.error : void 0;
+      const refusal = claimRefusalMessage(c, err.status, opts.team, claimCode);
+      if (refusal) fail(refusal);
       if (c === "already_claimed" || c === "not_claimable") {
         if (fromLocal) clearAnonCred();
         console.log(import_chalk11.default.yellow("\nThis workspace was already claimed (e.g. on dashboard.apiblaze.com)."));
@@ -2212,6 +2225,7 @@ var init_claim = __esm({
     init_anon_cred();
     init_api();
     init_types();
+    init_brand();
   }
 });
 
@@ -6476,6 +6490,71 @@ var init_create = __esm({
   }
 });
 
+// src/server/core.ts
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    if (typeof b.error === "string") return b.error;
+    if (b.error?.message) return b.error.message;
+    if (b.detail || b.title) return [b.title, b.detail].filter(Boolean).join(". ").replace(/\.\. /, ". ");
+    return `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function createPlaneCore(cfg) {
+  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
+  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
+  const tenantCache = /* @__PURE__ */ new Map();
+  const endUserCache = /* @__PURE__ */ new Map();
+  function planeFetch(base2, method, path16, user, opts = {}) {
+    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
+    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
+    let body;
+    if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    return fetch(`${base2}${path16}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+  }
+  async function resolveTenant2(user) {
+    const cached = tenantCache.get(user.tenant);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { tenant: tenant2 } = await res.json();
+    tenantCache.set(user.tenant, tenant2);
+    return tenant2;
+  }
+  async function ensureEndUser(user, tenant2) {
+    const cacheKey = `${tenant2}:${user.userId}`;
+    const cached = endUserCache.get(cacheKey);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
+      body: { tenant: tenant2, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
+    });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { abz_sub } = await res.json();
+    endUserCache.set(cacheKey, abz_sub);
+    return abz_sub;
+  }
+  return { planeFetch, resolveTenant: resolveTenant2, ensureEndUser, apikeysBase, iamBase };
+}
+var PlaneError;
+var init_core = __esm({
+  "src/server/core.ts"() {
+    "use strict";
+    PlaneError = class extends Error {
+      constructor(status2, detail) {
+        super(detail);
+        this.status = status2;
+        this.detail = detail;
+      }
+    };
+  }
+});
+
 // src/demo-app/files.ts
 var DEMO_FILES;
 var init_files = __esm({
@@ -6577,7 +6656,7 @@ components:
           properties:
             id: { type: string, example: r1 }
 `,
-      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The people the demo provisioned up front, per pizzeria: { tenant: { handle: stable id } }.\n// Through APIblaze every call already names the stable id (x-abz-user-id); a call straight\n// to this port still says \"ana\", and must mean the same person.\nconst USER_IDS = (() => { try { return JSON.parse(process.env.DEMO_USER_IDS || '{}'); } catch { return {}; } })();\nconst idOf = (tenant, handle) => (USER_IDS[tenant] || {})[handle] || handle;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const who = idOf(tenant, req.headers['x-abz-user-id'] || '');\n  // Shown in the ticker and the terminal: the name the caller gave (APIblaze forwards it as\n  // x-end-user-id next to the stable id), never the opaque id.\n  const shown = req.headers['x-end-user-id'] || req.headers['x-abz-user-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who: shown, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
       "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
       "public/index.html": `<!doctype html>
@@ -7699,6 +7778,7 @@ __export(demo_exports, {
   DEMO_RPS: () => DEMO_RPS,
   demoName: () => demoName,
   isDemoProcess: () => isDemoProcess,
+  personaPlan: () => personaPlan,
   portFree: () => portFree,
   routesOf: () => routesOf,
   runDemo: () => runDemo,
@@ -7708,6 +7788,19 @@ __export(demo_exports, {
   stopDemos: () => stopDemos,
   stopTunnels: () => stopTunnels
 });
+function personaPlan(ninoTenant, ginoTenant) {
+  const nino = [
+    { tenant: ninoTenant, userId: "ana", label: "Ana", email: DEMO_ADMIN_EMAIL },
+    { tenant: ninoTenant, userId: "ben", label: "Ben" }
+  ];
+  if (!ginoTenant) return nino;
+  return [
+    ...nino,
+    { tenant: ginoTenant, userId: "gina", label: "Gina", email: DEMO_GINO_ADMIN_EMAIL },
+    { tenant: ginoTenant, userId: "ana", label: "Ana" },
+    { tenant: ginoTenant, userId: "ben", label: "Ben" }
+  ];
+}
 function demoName() {
   return `demo${pick2(ADJ)}${pick2(NOUN)}${import_crypto.default.randomBytes(2).toString("hex")}`;
 }
@@ -8169,9 +8262,19 @@ paths:`));
       })()
     ]);
     if (!secretOk) throw new DemoError(`Could not give ${B.product} the backend secret.`, `Run again: ${LATEST} demo`, "secret-failed");
-    return { cpKey: cpKey2, teamId: teamId2, serverKey: serverKey2, project: project2, version: version3, tenant: tenant3, gino: gino2, createSecs: createSecs2, adminOk: adminOk2, ginaOk: ginaOk2, limited: limited2, claimCode: rr.claim_code, applied: rr.secure?.applied ?? [] };
+    const userIds2 = {};
+    const plane = createPlaneCore({ cpKey: cpKey2 });
+    await Promise.all(personaPlan(tenant3, gino2?.tenant).map(async (p) => {
+      try {
+        const id = await plane.ensureEndUser({ tenant: p.tenant, userId: p.userId, label: p.label, email: p.email }, p.tenant);
+        if (id) (userIds2[p.tenant] ??= {})[p.userId] = id;
+      } catch {
+      }
+    }));
+    return { cpKey: cpKey2, teamId: teamId2, serverKey: serverKey2, project: project2, version: version3, tenant: tenant3, gino: gino2, createSecs: createSecs2, adminOk: adminOk2, ginaOk: ginaOk2, limited: limited2, userIds: userIds2, claimCode: rr.claim_code, applied: rr.secure?.applied ?? [] };
   });
-  const { cpKey, teamId, serverKey, project, version: version2, tenant: tenant2, gino, createSecs, adminOk, ginaOk, limited } = setup;
+  const { cpKey, teamId, serverKey, project, version: version2, tenant: tenant2, gino, createSecs, adminOk, ginaOk, limited, userIds } = setup;
+  const peopleOk = Object.values(userIds).reduce((n, m) => n + Object.keys(m).length, 0);
   const apiUrl = restUrl(project, version2, "dev", { anon: true });
   const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
   const applied = setup.applied.map((k) => k.replace(/^\//, "").split("/")[0]);
@@ -8191,7 +8294,9 @@ paths:`));
     DEMO_NINO_TENANT: ninoTenant,
     APP_PORT: appPort,
     BACKEND_PORT: backendPort2,
-    DIRECT_PORT: directPort
+    DIRECT_PORT: directPort,
+    // { tenant: { handle: stable id } }: the backend maps the handles of calls that skip the gateway.
+    DEMO_USER_IDS: JSON.stringify(userIds)
   });
   const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort: backendPort2, apiUrl, claimCode: setup.claimCode };
   saveState(dir, state);
@@ -8209,6 +8314,7 @@ paths:`));
       what: ginaOk ? "Ana runs Nino Pizza, Gina runs Gino Pizza" : "Ana runs Nino Pizza",
       cmds: [L(`admins add ${DEMO_ADMIN_EMAIL} --tenant ${tenant2}`), ...ginaOk && gino?.tenant ? [L(`admins add ${DEMO_GINO_ADMIN_EMAIL} --tenant ${gino.tenant}`)] : []]
     }] : [],
+    ...peopleOk ? [{ label: "People", what: `${peopleOk} people provisioned up front (Ana, Ben, Gina), so their ids never change`, cmds: ["(the keys & users widgets' own call: npm i apiblaze \u2192 ensureEndUser)"] }] : [],
     ...applied.length ? [{ label: "Rules", what: "only who made a reservation can change it", cmds: [L(`rule ${project} "${RULE_SENTENCE}"`)] }] : [],
     { label: "AI (MCP Tools)", what: `${tools.length} tools, one per route`, cmds: ["(part of create, above)"] },
     ...limited ? [{ label: "Limits", what: `${DEMO_RPS} calls a second per customer`, cmds: [L(`limits set ${project} --rate ${DEMO_RPS} --end-user-rate ${DEMO_RPS}`)] }] : [],
@@ -8385,6 +8491,7 @@ var init_demo = __esm({
     init_auth();
     init_anon_cred();
     init_brand();
+    init_core();
     init_create();
     init_files();
     DIR_NAME = `${B.cli}-demo`;
@@ -8765,6 +8872,72 @@ async function journey(label3, work, home, checks) {
   }
   return env;
 }
+async function claimJourney(work, checks, env) {
+  const add = (id, ok, detail2) => checks.push({ id: `claim:${id}`, ok, detail: detail2 });
+  let code = "";
+  let teamId = "";
+  try {
+    const st = JSON.parse(import_fs10.default.readFileSync(import_path7.default.join(work, `${B.cli}-demo`, ".demo", "state.json"), "utf8"));
+    code = st.claimCode ?? "";
+    teamId = st.teamId ?? "";
+  } catch {
+  }
+  if (!code || !teamId || !env) {
+    add("code", false, "no claim code in the demo state");
+    return;
+  }
+  const fail7 = (e) => ({ status: e instanceof ApiError ? e.status : 0, error: e instanceof ApiError ? String(e.body?.error ?? "") : String(e.message) });
+  const api = env.APIBLAZE_URL;
+  const key = env.APIBLAZE_SERVER_KEY;
+  const ana = { "x-api-key": key, "x-end-user-id": "ana", "content-type": "application/json" };
+  const before = await http(`${api}/reservations`, { method: "POST", headers: ana, body: JSON.stringify({ time: "21:00" }) });
+  const bookedId = before.status === 201 && before.body?.id ? String(before.body.id) : null;
+  const seenBefore = await http(`${api}/reservations`, { headers: ana });
+  const ownersBefore = new Map((Array.isArray(seenBefore.body) ? seenBefore.body : []).map((r) => [String(r.id), String(r.owner)]));
+  let refused = { status: 200, error: "MERGED" };
+  try {
+    await claimTeam(code, SANDBOX_TEAM);
+  } catch (e) {
+    refused = fail7(e);
+  }
+  add("merge-refused", refused.status === 409 && refused.error === "merge_not_supported_with_iam", `HTTP ${refused.status} ${refused.error}`);
+  let res = {};
+  let err = { status: 0, error: "" };
+  try {
+    res = await claimTeam(code);
+  } catch (e) {
+    err = fail7(e);
+  }
+  add("promote", res.claimed === true && !res.merged && res.team_id === teamId, res.claimed ? `team ${res.team_id}` : `HTTP ${err.status} ${err.error}`);
+  const list = await http(`${api}/reservations`, { headers: ana });
+  const after = new Map((Array.isArray(list.body) ? list.body : []).map((r) => [String(r.id), String(r.owner)]));
+  const missing = [...ownersBefore.keys()].filter((id) => !after.has(id));
+  const changed = [...ownersBefore].filter(([id, owner]) => after.has(id) && after.get(id) !== owner).map(([id]) => id);
+  add(
+    "identity-continuity",
+    list.status === 200 && !!bookedId && ownersBefore.has(bookedId) && missing.length === 0 && changed.length === 0,
+    `${ownersBefore.size} booking(s) before (incl. ${bookedId ?? "-"}) \xB7 list ${list.status} after \xB7 ${missing.length ? `MISSING ${missing.join(",")}` : "all still hers"}${changed.length ? ` \xB7 OWNER ID CHANGED ${changed.join(",")}` : ""}`
+  );
+  let gone = false;
+  let detail = "";
+  if (res.claimed) {
+    try {
+      await admin({ method: "DELETE", path: `/teams/${encodeURIComponent(teamId)}`, summary: "delete the promoted demo team" });
+      for (let i = 0; i < 60 && !gone; i++) {
+        try {
+          await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}` });
+        } catch (e) {
+          if (e instanceof ApiError && (e.status === 404 || e.status === 403)) gone = true;
+        }
+        if (!gone) await new Promise((r) => setTimeout(r, 1e3));
+      }
+      detail = gone ? "cascade done" : "still present after 60 s";
+    } catch (e) {
+      detail = `delete \u2192 ${fail7(e).status} ${fail7(e).error}`;
+    }
+  } else detail = "nothing to delete (claim failed)";
+  add("cleanup", gone, detail);
+}
 async function runOpAnon(o = {}) {
   const t0 = Date.now();
   const root = import_fs10.default.mkdtempSync(import_path7.default.join(import_os3.default.tmpdir(), `${B.cli}-op-anon-`));
@@ -8779,7 +8952,8 @@ async function runOpAnon(o = {}) {
   log4(import_chalk70.default.bold(`${B.cli} op anon \u2014 a first-time visitor's demo, against production`));
   try {
     await journey("first", work, home, checks);
-    await journey("rerun", work, home, checks);
+    const env = await journey("rerun", work, home, checks);
+    await claimJourney(work, checks, env);
   } finally {
     const stop = await runCli(["demo", "stop"], work, home, 3e4);
     const demoFolder = import_path7.default.join(work, `${B.cli}-demo`);
@@ -8809,7 +8983,7 @@ async function runOpAnon(o = {}) {
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
 }
-var import_fs10, import_os3, import_path7, import_child_process6, import_chalk70, SECRET;
+var import_fs10, import_os3, import_path7, import_child_process6, import_chalk70, SECRET, SANDBOX_TEAM;
 var init_op_anon = __esm({
   "src/commands/op-anon.ts"() {
     "use strict";
@@ -8819,7 +8993,11 @@ var init_op_anon = __esm({
     import_child_process6 = require("child_process");
     import_chalk70 = __toESM(require("chalk"));
     init_brand();
+    init_api();
+    init_admin();
+    init_types();
     SECRET = /\bsk_(?:dev|test|prod)_[A-Za-z0-9]{6,}/;
+    SANDBOX_TEAM = "team_1782844865835_zujrf";
   }
 });
 
@@ -9798,6 +9976,9 @@ function shipMarkdown() {
   const backendRules = `## What their backend does \u2014 and nothing else
 
 The gateway does sign-in, keys, tenancy and single-record ownership. The backend does only:
+- provision each person before their first call (what the Users widget's \`ensureEndUser\` does): an
+  unprovisioned caller arrives as the raw id the app asserted, a provisioned one as their stable id, and
+  a row stamped with the former is not found by the latter;
 - stamp each new row's \`tenant\` with the \`x-abz-tenant-id\` header and its \`owner\` with the
   \`x-abz-user-id\` header;
 - filter every collection GET to rows whose \`tenant\` AND \`owner\` match those headers. Both,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.43",
+  "version": "0.21.44",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",