apiblaze 0.21.44 → 0.21.45

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.44";
+    version = "0.21.45";
   }
 });
 
@@ -8923,7 +8923,7 @@ async function claimJourney(work, checks, env) {
   if (res.claimed) {
     try {
       await admin({ method: "DELETE", path: `/teams/${encodeURIComponent(teamId)}`, summary: "delete the promoted demo team" });
-      for (let i = 0; i < 60 && !gone; i++) {
+      for (let i = 0; i < 180 && !gone; i++) {
         try {
           await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}` });
         } catch (e) {
@@ -8931,7 +8931,7 @@ async function claimJourney(work, checks, env) {
         }
         if (!gone) await new Promise((r) => setTimeout(r, 1e3));
       }
-      detail = gone ? "cascade done" : "still present after 60 s";
+      detail = gone ? "cascade done" : "still present after 180 s";
     } catch (e) {
       detail = `delete \u2192 ${fail7(e).status} ${fail7(e).error}`;
     }
@@ -9108,13 +9108,26 @@ async function defaultName(openapi, teamId) {
   }
   return randomProxyName();
 }
+function saltedName(name) {
+  return `${name}${Math.random().toString(36).slice(2, 6)}`;
+}
 async function chooseName(opts, openapi, teamId, interactive2) {
   if (opts.name !== void 0) {
     const name = normalizeName2(opts.name);
     if (name.length < 3) throw new Error(`${cap(B.thingShort)} name must be at least 3 characters (letters and digits only).`);
     const check = await checkProxyName(name, teamId).catch(() => null);
     if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
-      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
+      if (opts.auto || !interactive2) {
+        for (let attempt = 0; attempt < 4; attempt++) {
+          const candidate = saltedName(name);
+          const again = await checkProxyName(candidate, teamId).catch(() => null);
+          if (!again || again.canUseProjectName && again.canUseApiVersion) {
+            console.log(import_chalk20.default.dim(`  "${name}" is taken (names are global) \u2014 using "${candidate}" instead.`));
+            return candidate;
+          }
+        }
+      }
+      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Omit --name and a free one is chosen for you.`);
     }
     return name;
   }
@@ -9972,7 +9985,6 @@ their own app).
 }
 function shipMarkdown() {
   const legacy = legacySkillMarkdown();
-  const at = legacy.indexOf("## Adopt");
   const backendRules = `## What their backend does \u2014 and nothing else
 
 The gateway does sign-in, keys, tenancy and single-record ownership. The backend does only:
@@ -9993,7 +10005,7 @@ No code yet? Write the smallest plain backend that does exactly that, plus its \
   return withLatest(`# Put ${B.product} in front of their app
 
 ${backendRules}${blockedMarkdown()}
-${at >= 0 ? legacy.slice(at) : legacy}`);
+${legacy}`);
 }
 function skillMarkdown() {
   return `${heroMarkdown()}
@@ -10003,121 +10015,7 @@ function legacySkillMarkdown() {
   const P = B.product;
   const cli = B.cli;
   const LIB = "apiblaze";
-  const other = BRAND === "mcpblaze" ? "APIblaze" : "MCPblaze";
-  const doors = BRAND === "mcpblaze" ? `${P} ships your code to agents (an MCP server); ${other} ships the same code to users (API keys + sign-in).` : `${P} ships your code to users (API keys + sign-in); ${other} ships the same code to agents (an MCP server).`;
-  return `---
-name: ${SKILL_NAME}
-description: Use when the user asks what ${P} (or ${cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share, expose or make an API public; says "serve my backend behind a proxy and MCP"; wants auth, API keys, sign-in, multi-tenant registration, users and groups, rate limits (throttling), quotas or spend caps; wants agents to use the API through an MCP; or says users can reach each other's records or admin functions. Puts the ${P} gateway in front of the API instead of hand-rolling auth and tenancy in the backend.
----
-
-# Ship safely with ${P}
-
-One gateway, two doors. ${doors}
-Same rules, one command. Nothing about auth, tenancy or ownership goes into the backend's
-business logic: the gateway sits in front of the code and enforces it.
-
-## Which mode \u2014 decide this first
-
-- They ask what ${P} does or can do \u2192 **Explain**. Glance at the workspace first (see
-  Explain), answer, then offer either the demo or their own app. Run no \`npx ${cli}\`
-  command \u2014 the whole answer is in this file.
-- They say yes to the demo, or ask to see / try / demo it \u2192 **Demo app**. It lives in its own
-  folder and never touches their code.
-- They say yes to "can I read the code" \u2192 **Adopt**: scan their app, ask only what the scan
-  could not find, then ship it through the Ship steps.
-- They have a backend, just wrote one, or ask you to BUILD one and then ship it \u2192 **Ship**.
-  No code yet? First write the smallest plain backend that serves the resources they named,
-  plus its \`openapi.yaml\`, start it on their port, then continue at Ship \xA71. Do NOT build
-  the Demo app for this. The gateway does auth, tenancy and item ownership; the backend does
-  only these three things:
-  - stamp each new row's \`tenant\` with the \`x-abz-tenant-id\` header and its \`owner\` with
-    the \`x-abz-user-id\` header;
-  - filter every collection GET to rows whose \`tenant\` AND \`owner\` match those headers (the
-    gateway's rules lock single records, never lists \u2014 a list route has no one record to
-    check). Both, always: a user id is not unique across tenants ("ana" at one customer and
-    "ana" at another are two people);
-  - answer 401 to any call whose \`x-target-api-key\` is not \`process.env.TARGET_SERVER_SECRET\`
-    (generate it with \`openssl rand -hex 24\`, put it in \`.env.local\`, start the backend with
-    it; Ship \xA73b makes the proxy send it). If they say "use
-  ${cli} on this" or "ship it with ${cli}" and point at a backend, skip any pitch and run it.
-
-Tie-breaks: a question ("what can it do", "what is it") is always **Explain**, whatever else the
-message names. Mentioning \`npx ${cli} skills\` is NOT a request to run anything \u2014 it is the
-command that installed this file. If a message fits two modes, the earliest bullet wins.
-
-## Explain
-
-Say this, in these words or close to them, then stop:
-
-"${P} puts a gateway in front of your backend in one command: a proxy (every request passes
-through it first) and an MCP server (the same API, callable by AI agents like Claude). No auth
-or ownership logic goes into your code \u2014 your backend only has to trust one header. Each of
-your customers \u2014 a tenant \u2014 gets their own API key, created from a widget you drop into your
-site. People and agents sign in with hosted GitHub, or your own OAuth app. Each user can only
-touch the records they created; those rules come from your OpenAPI spec (the file listing your
-endpoints), and if you have none I draft one from your routes and show it to you first. One
-more command sets a rate limit, a daily quota and a spend cap. In dev it tunnels to localhost;
-in prod it points at your deploy."
-
-Before answering, look at the workspace \u2014 file names and \`package.json\` only, no reading of
-code yet. It "has an app" if ANY of these is present: an \`openapi.*\` / \`swagger.*\` file; a
-server framework (express, fastify, hono, koa, nest, fastapi, flask, django, rails, gin, chi,
-net/http); or a frontend (next, react, vue, svelte, remix, nuxt) whose \`.env*\` file NAMES an
-API base-URL variable (\`API_URL\`, \`NEXT_PUBLIC_API_URL\`, \`VITE_API_URL\`, or similar) \u2014
-\`grep -l\` the env files, open nothing else. Then end with exactly one of these two lines:
-
-- No app \u2192 **"Would you like me to spin up a demo app?"**
-- An app \u2192 **"I see you have an app already coded. Can I read the code to see how to ready it
-  for human and agent traffic with ${P}?"**
-
-## Demo app \u2014 the same reservation system, before and after
-
-One Next.js app on port 3000. Two routes, same UI, same data: \`/before\` is how most apps
-ship; \`/\` is the same thing behind ${P}. Narrate each step in one line and show every
-\`npx ${cli}\` command \u2014 the commands are the product. Everything goes in \`${cli}-demo/\`.
-
-1. **Scaffold.** \`npx create-next-app@latest ${cli}-demo\` (TypeScript, App Router). Then
-   \`npm i hono ${LIB}\`.
-2. **The backend.** Hono mounted at \`app/api/[[...route]]/route.ts\` (\`import { handle } from
-   'hono/vercel'\`). Three resources \u2014 restaurants, tables, reservations \u2014 in an in-memory Map,
-   every row stamped with \`owner\` = the \`x-abz-user-id\` header (${P} sets it on every call it
-   forwards). Every route requires \`X-Api-Secret: demo-secret\` OR an \`x-abz-user-id\` header \u2014
-   the first is how /before gets in, the second is how the gateway gets in. Write
-   \`openapi.yaml\` at the repo root: every path and method, and the \`id\` each POST returns \u2014
-   the ownership rules are read from it.
-3. **/before.** \`app/before/page.tsx\`: list and create reservations through one server route,
-   \`app/before/api/route.ts\`, which holds \`demo-secret\` and calls \`/api/...\` directly. Put the
-   caption on the page: "Before \u2014 one shared secret, anyone holding it can do anything."
-4. **Put ${P} in front.** In the BACKGROUND, and leave it running \u2014 it is the tunnel:
-   \`npx ${cli} dev --port 3000 --openapi ./openapi.yaml --name demo --auto\`
-   It prints the API URL, the MCP URL, the tenant, and the bootstrap key ONCE. Write them to
-   \`.env.local\` as \`APIBLAZE_URL\`, \`APIBLAZE_SERVER_KEY\`, \`APIBLAZE_TENANT\`. \`--auto\` locks
-   all three resources to their creator \u2014 say so.
-5. **Users and groups.** Turn them on and make the group the demo is about:
-   \`npx ${cli} iam demo on\`
-   \`npx ${cli} group create reservationists --tenant <tenant>\`
-   \`npx ${cli} group add-user <the demo user> reservationists --tenant <tenant>\`
-   \`npx ${cli} admins add <the user's email> --tenant <tenant>\` (so the widget has an admin).
-   Optional, billed per turn: \`npx ${cli} rule demo "only members of reservationists can create
-   or change reservations"\`. If the user is logged out or their wallet has nothing available
-   (\`npx ${cli} billing balance\`), keep the free creator-lock rules and say so \u2014 do not pretend
-   the group rule applied.
-6. **/.** \`app/page.tsx\`: the same UI, plus a **user picker** (ana \xB7 ben \xB7 admin \u2014 a select, no
-   real login; the demo is about authorization, not building sign-in). Its server route calls
-   \`process.env.APIBLAZE_URL\` with \`X-API-Key: APIBLAZE_SERVER_KEY\` and \`X-End-User-Id: <the
-   picked user>\`. Add the three widgets from \`${LIB}/react\`, each with its server route:
-   - \`<ApiKeyWidget />\` + \`app/api/apiblaze/keys/route.ts\` (\`createApiblazeKeys\` from \`${LIB}/server\`)
-   - \`<UsersGroupsWidget />\` + \`app/api/apiblaze/groups/route.ts\` (\`createApiblazeGroups\` \u2014
-     the keys route with one word changed)
-   - \`<ChatWidget />\` + \`app/api/apiblaze/chat/route.ts\` (\`createApiblazeChat\`)
-   Exact snippets for the keys and chat pair: \`npx ${cli} integration demo --stack nextjs\`.
-   Caption: "After \u2014 a key per tenant, every call names its user, and ${P} decides."
-7. **Prove it, in the browser.** \`npm run dev\`, open \`http://localhost:3000/before\` then
-   \`http://localhost:3000/\`. On \`/\`: create a reservation as ana, switch to ben, try to cancel
-   it \u2014 show the 403 in the UI. Open the groups widget: reservationists is there. Ask the chat
-   widget to list reservations. Then say what each \`npx ${cli}\` command did, in order.
-
-## Adopt \u2014 reading their code first
+  return `## Adopt \u2014 reading their code first
 
 They said yes. Scan properly now (routes, env files, auth, network calls), classify, then ask
 ONLY for what the scan could not find \u2014 one short list of questions, not an interview.
@@ -10178,12 +10076,14 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    the report. Only ask "where do your users sign in today?" when they mention an existing
    login. Their own OAuth app \u2192 \`--apikey --oauth '{"provider":"auth0","clientId":"\u2026","clientSecret":"\u2026"}'\`
    (both doors: keys for tenants, their login for people and agents). Shapes below.
-3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --name <name> --auto <door flags>\`,
+3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --auto <door flags>\`,
    left running \u2014 it is the tunnel. Start it as its own detached process, never \`cmd &\` inside
    a shell call that ends: \`nohup npx ${cli} dev \u2026 > ${cli}-dev.log 2>&1 < /dev/null &\`, then
-   read the log. If it stops, re-run the SAME command: the same \`--name\` reattaches and
-   creates nothing. Never pick a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
-   \`npx ${cli} create --target <url-or-spec> --name <name> --auto <door flags>\`. Both print the
+   read the log. Leave \`--name\` out: names are global, so a free one is chosen and printed
+   (\`--name\` only for a name the user asked for; a taken one is salted). If the tunnel stops,
+   run the \`--project <name>\` line it printed: that reattaches and creates nothing. Never start
+   a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
+   \`npx ${cli} create --target <url-or-spec> --auto <door flags>\`. Both print the
    URL, the MCP URL (the "agents:" line) and what is locked. Run by you (no terminal), \`dev\`
    saves the bootstrap key to \`.env.local\` as \`APIBLAZE_SERVER_KEY\` and never prints it;
    \`create\` prints it ONCE \u2014 save it there yourself. Either way say only "saved your key to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.44",
+  "version": "0.21.45",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",