apiblaze 0.21.6 → 0.21.8

package/README.md

@@ -96,9 +96,13 @@ The skill teaches Claude to ask "where do your users sign in today?" before crea
 npx apiblaze create --target https://api.example.com
 
 # 2. YOUR OWN OAuth app on a hosted login page — the agent's users sign in exactly where
-#    your users already do. provider is one of: auth0 · google · github · microsoft · facebook.
+#    your users already do. provider is one of: oidc · auth0 · google · github · microsoft · facebook.
+#    clientSecret is optional for every provider except github and facebook (public client, PKCE is always on).
 npx apiblaze create --target https://api.example.com \
-  --oauth «'{"provider":"auth0","clientId":"AbC123…","clientSecret":"s3cr3t…"}'»
+  --oauth «'{"provider":"auth0","issuer":"https://acme.auth0.com/","clientId":"AbC123…","clientSecret":"s3cr3t…"}'»
+#    Any OpenID Connect IdP (Okta, Entra, Keycloak, Cognito, …) is `oidc` + its issuer URL:
+npx apiblaze create --target https://api.example.com \
+  --oauth «'{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"0oa…"}'»
 
 # 3. YOUR OWN JWT issuer — no login page at all; the proxy verifies the tokens you already
 #    issue. All three fields are required; jwks is that issuer's JWKS URL.

package/dist/index.js

@@ -1149,7 +1149,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     message: "Which login provider?",
     pageSize: 10,
     choices: [
-      ...PROVIDERS.map((p) => ({ name: p.label, value: p.id })),
+      ...PROVIDERS2.map((p) => ({ name: p.label, value: p.id })),
       ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk44.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
     ]
   }]);
@@ -1157,7 +1157,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     console.log(import_chalk44.default.dim("  No login method yet \u2014 add one later under Login methods."));
     return false;
   }
-  const opt = PROVIDERS.find((p) => p.id === provider);
+  const opt = PROVIDERS2.find((p) => p.id === provider);
   let providerBody;
   if (!opt.own) {
     providerBody = { type: "github", managed: true };
@@ -1215,14 +1215,14 @@ async function createTenantInteractive(teamId) {
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk44, import_ora17, PROVIDERS, DEFAULT_SCOPES;
+var import_chalk44, import_ora17, PROVIDERS2, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
     import_chalk44 = __toESM(require("chalk"));
     import_ora17 = __toESM(require("ora"));
     init_admin();
-    PROVIDERS = [
+    PROVIDERS2 = [
       { id: "apiblaze", label: "APIblaze (via GitHub) \u2014 zero setup, recommended", own: false },
       { id: "google", label: "Google", own: true },
       { id: "github", label: "GitHub", own: true },
@@ -1337,7 +1337,7 @@ var import_commander = require("commander");
 var import_chalk62 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.21.6";
+var version = "0.21.8";
 
 // src/index.ts
 init_types();
@@ -4675,6 +4675,44 @@ init_api();
 var import_chalk13 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
 init_caller();
+var HOLDER_HELP = {
+  backend: "Lives on your server; says who is calling with X-End-User-Id.",
+  client: "Safe to ship in a browser, app or widget; cannot name a user; calls are anonymous unless the user signs in."
+};
+function holderPermissions(kind) {
+  return kind === "backend" ? ["call", "assert-end-user"] : ["call"];
+}
+function resolveHolder(opts) {
+  const who = (opts.for ?? "").trim();
+  if (opts.backend && opts.client) throw new Error("--backend and --client are mutually exclusive: a key is either kept on your server or shipped to users.");
+  if (who && (opts.backend || opts.client)) throw new Error(`--for issues the key to ${who} (a person-bound key): drop --backend / --client.`);
+  if (who) return "person";
+  return opts.client ? "client" : "backend";
+}
+function holderKindOf(record) {
+  const cm = record.creation_method;
+  if (cm === "self" || cm === "on_behalf") return "person";
+  let perms = record.permissions ?? record.permissions_json;
+  if (typeof perms === "string") {
+    try {
+      perms = JSON.parse(perms);
+    } catch {
+      perms = void 0;
+    }
+  }
+  if (!Array.isArray(perms)) return cm == null ? void 0 : "client";
+  return perms.includes("assert-end-user") ? "backend" : "client";
+}
+function holderLine(kind, person) {
+  switch (kind) {
+    case "backend":
+      return "backend key \u2014 send X-API-Key and say who is calling with X-End-User-Id";
+    case "client":
+      return "client key \u2014 safe to ship to users; it cannot name a user (calls are anonymous unless they sign in)";
+    case "person":
+      return `issued to: ${person ?? "?"} \u2014 calls made with this key count as this person; an X-End-User-Id naming anyone else is refused`;
+  }
+}
 async function runApikeysMenu(opts) {
   await runKeyList(opts);
   if (opts.json) return;
@@ -4706,11 +4744,14 @@ async function runKeyList(opts) {
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk13.default.bold(k.key_id ?? k.id)}  ${import_chalk13.default.dim(k.description ?? "")}  ${import_chalk13.default.dim(k.expires_at ?? "no expiry")}`);
+    const kind = holderKindOf(k);
+    const kindCol = kind ? `${import_chalk13.default.cyan(kind.padEnd(7))}  ` : "";
+    console.log(`  ${import_chalk13.default.bold(k.key_id ?? k.id)}  ${kindCol}${import_chalk13.default.dim(k.description ?? "")}  ${import_chalk13.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
-  if (opts.tenant || opts.for) return runConsumerKeyMint(opts);
+  resolveHolder(opts);
+  if (opts.tenant || opts.for || opts.client) return runConsumerKeyMint(opts);
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const body = { role: "consumer-admin" };
@@ -4739,14 +4780,22 @@ async function runKeyMint(opts) {
 }
 async function mintConsumerKey(o) {
   const tenant2 = (o.tenant ?? "").trim();
-  if (!tenant2) throw new Error("--for needs a tenant: add --tenant <slug> (the tenant whose person this key is for).");
   const who = (o.for ?? "").trim();
+  if (!tenant2) {
+    throw new Error(who ? "--for needs a tenant: add --tenant <slug> (the tenant whose person this key is for)." : `a ${o.holder ?? "backend"} key is a consumer key: add --tenant <slug> (the tenant it calls).`);
+  }
   const environment = (o.env ?? "").trim() || "dev";
+  const holder = who ? "person" : o.holder ?? "backend";
+  const permissions = holder === "person" ? void 0 : holderPermissions(holder);
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, o.team);
   const body = { tenant: tenant2, environment };
   if (o.desc) body.description = o.desc;
   if (o.expiresDays) body.expires_in_seconds = Number(o.expiresDays) * 24 * 60 * 60;
+  if (permissions) {
+    body.holder = holder;
+    body.permissions = permissions;
+  }
   const headers = { "Content-Type": "application/json" };
   if (who) {
     headers["X-End-User-Id"] = who;
@@ -4767,16 +4816,35 @@ async function mintConsumerKey(o) {
   });
   const key = out?.key ?? out?.fullKey;
   if (typeof key !== "string" || !key) throw new Error("Mint failed: the apikeys plane returned no key.");
-  return { key, keyId: out?.metadata?.key_id, expiresAt: out?.metadata?.expires_at, tenant: tenant2, environment, ...who ? { person: who } : {}, raw: out };
+  return {
+    key,
+    keyId: out?.metadata?.key_id,
+    expiresAt: out?.metadata?.expires_at,
+    tenant: tenant2,
+    environment,
+    holder,
+    ...permissions ? { permissions } : {},
+    ...who ? { person: who } : {},
+    raw: out
+  };
 }
 async function runConsumerKeyMint(opts) {
+  const kind = resolveHolder(opts);
   const who = (opts.for ?? "").trim();
   const tenant2 = (opts.tenant ?? "").trim();
-  const spinner = (0, import_ora3.default)(who ? `Minting a key for ${who} in ${tenant2}...` : `Minting a key in ${tenant2}...`).start();
+  const spinner = (0, import_ora3.default)(who ? `Minting a key for ${who} in ${tenant2}...` : `Minting a ${kind} key in ${tenant2}...`).start();
   let out;
   try {
-    out = await mintConsumerKey({ tenant: tenant2, for: who || void 0, env: opts.env, team: opts.team, desc: opts.desc, expiresDays: opts.expiresDays });
-    spinner.succeed(who ? `Key minted for ${who}.` : "Key minted.");
+    out = await mintConsumerKey({
+      tenant: tenant2,
+      for: who || void 0,
+      env: opts.env,
+      team: opts.team,
+      desc: opts.desc,
+      expiresDays: opts.expiresDays,
+      ...kind === "person" ? {} : { holder: kind }
+    });
+    spinner.succeed(who ? `Key minted for ${who}.` : `${kind === "client" ? "Client" : "Backend"} key minted.`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
@@ -4789,10 +4857,11 @@ async function runConsumerKeyMint(opts) {
   console.log(`  ${import_chalk13.default.bold("key")}:     ${import_chalk13.default.green(out.key)}  ${import_chalk13.default.dim("(shown once \u2014 store it now)")}`);
   console.log(`  ${import_chalk13.default.dim("tenant:")}  ${out.tenant}   ${import_chalk13.default.dim("env:")} ${out.environment}`);
   if (out.expiresAt) console.log(`  ${import_chalk13.default.dim("expires:")} ${out.expiresAt}`);
-  if (out.person) {
+  if (out.holder === "person") {
     console.log(`  ${import_chalk13.default.dim("issued to:")} ${out.person} ${import_chalk13.default.dim("\u2014 calls made with this key count as this person; an X-End-User-Id naming anyone else is refused")}`);
   } else {
-    console.log(import_chalk13.default.dim("  Not issued to anyone: send X-End-User-Id on each call to say who is calling (or re-mint with --for <email>)."));
+    console.log(`  ${import_chalk13.default.cyan(holderLine(out.holder))}`);
+    console.log(import_chalk13.default.dim(out.holder === "backend" ? "  (For a key you ship to users, re-mint with --client; to bind one to a person, --for <email>.)" : "  (For your server, re-mint with --backend; to bind one to a person, --for <email>.)"));
   }
 }
 async function runKeyRevoke(keyId, opts) {
@@ -4961,12 +5030,18 @@ var MANAGED_GITHUB = {
 };
 var API_KEY = { auth: "api_key", doors: ["api_key"], bodyPatch: {}, summary: "callers send the API key (X-API-Key) \u2014 no sign-in" };
 var OPEN = { auth: "none", doors: [], bodyPatch: {}, summary: "open \u2014 no credential required" };
+var PROVIDERS = ["github", "google", "microsoft", "facebook", "auth0", "oidc"];
+var ISSUER_PROVIDERS = /* @__PURE__ */ new Set(["oidc", "auth0"]);
+var SECRET_REQUIRED_TYPES = /* @__PURE__ */ new Set(["github", "facebook"]);
 var OAUTH_SHAPES = `Shapes:
   --oauth                                          ${B.product}-hosted GitHub sign-in
   --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'
                                                    your own hosted login: the proxy trusts JWTs from that issuer
   --oauth '{"provider":"google","clientId":"\u2026","clientSecret":"\u2026"}'
-                                                   ${B.product}-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0)`;
+                                                   ${B.product}-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc)
+  --oauth '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}'
+                                                   any OpenID Connect IdP (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026) by issuer; clientSecret is optional
+                                                   for every provider except github and facebook (public client, PKCE); "scopes":[\u2026] overrides the default`;
 function parseOauthFlag(raw) {
   if (raw === void 0 || raw === false) return null;
   if (raw === true || typeof raw === "string" && raw.trim() === "") return MANAGED_GITHUB;
@@ -4999,21 +5074,34 @@ function parseOauthFlag(raw) {
   }
   if (typeof parsed.provider === "string") {
     const provider = parsed.provider.trim().toLowerCase();
-    const PROVIDERS2 = ["github", "google", "microsoft", "facebook", "auth0"];
-    if (!PROVIDERS2.includes(provider)) fail4(`--oauth: unknown provider "${provider}". One of: ${PROVIDERS2.join(" \xB7 ")}.`);
+    if (!PROVIDERS.includes(provider)) fail4(`--oauth: unknown provider "${provider}". One of: ${PROVIDERS.join(" \xB7 ")}.`, OAUTH_SHAPES);
     const clientId = typeof parsed.clientId === "string" ? parsed.clientId.trim() : typeof parsed.client_id === "string" ? parsed.client_id.trim() : "";
     const clientSecret = typeof parsed.clientSecret === "string" ? parsed.clientSecret.trim() : typeof parsed.client_secret === "string" ? parsed.client_secret.trim() : "";
-    if (!clientId || !clientSecret) fail4("--oauth provider shape needs clientId and clientSecret (from your OAuth app).");
+    if (!clientId) fail4("--oauth provider shape needs clientId (from your OAuth app).", OAUTH_SHAPES);
+    if (SECRET_REQUIRED_TYPES.has(provider) && !clientSecret) fail4(`--oauth provider "${provider}" needs clientSecret too (its OAuth apps cannot be public clients).`, OAUTH_SHAPES);
+    const issuer = typeof parsed.issuer === "string" ? parsed.issuer.trim() : "";
+    if (ISSUER_PROVIDERS.has(provider) && !issuer) fail4(`--oauth provider "${provider}" needs "issuer" (your IdP's issuer URL, e.g. https://acme.okta.com/oauth2/default).`, OAUTH_SHAPES);
+    if (issuer && !isHttpUrl3(issuer)) fail4("--oauth: issuer must be an http(s) URL.", OAUTH_SHAPES);
+    if (parsed.scopes !== void 0 && (!Array.isArray(parsed.scopes) || !parsed.scopes.every((s) => typeof s === "string" && s.trim()))) {
+      fail4('--oauth: scopes must be an array of non-empty strings, e.g. ["openid","email","profile"].', OAUTH_SHAPES);
+    }
+    const scopes = Array.isArray(parsed.scopes) ? parsed.scopes.map((s) => s.trim()) : void 0;
     return {
       auth: "oauth",
       doors: ["oauth"],
       bodyPatch: {
         login: {
-          providers: [{ type: provider, client_id: clientId, client_secret: clientSecret }]
+          providers: [{
+            type: provider,
+            client_id: clientId,
+            ...clientSecret ? { client_secret: clientSecret } : {},
+            ...issuer ? { issuer } : {},
+            ...scopes && scopes.length ? { scopes } : {}
+          }]
         }
       },
-      summary: `callers sign in with your own ${provider} app (${B.product}-hosted page)`,
-      provider: cap(provider),
+      summary: provider === "oidc" ? `callers sign in through your OpenID Connect provider (${issuer}, ${B.product}-hosted page)` : `callers sign in with your own ${provider} app (${B.product}-hosted page)`,
+      provider: provider === "oidc" ? "OpenID Connect" : cap(provider),
       ownApp: true
     };
   }
@@ -5372,7 +5460,7 @@ async function printDevOutcome(o, port) {
   if (!o.adminEmail) console.log(`  ${import_chalk16.default.dim("\u2013")} ${import_chalk16.default.dim(`no admin yet \u2014 npx ${B.cli} admins add you@example.com --tenant ${o.tenant ?? "<tenant>"}`)}`);
   if (o.auth.doors.includes("api_key") && o.apiKey) {
     console.log();
-    console.log(`  ${import_chalk16.default.dim("API key (for your frontend-server, shown once):")} ${import_chalk16.default.bold.green(o.apiKey)}   ${import_chalk16.default.dim("\u2192 send it as X-API-Key and say who is calling with X-End-User-Id")}`);
+    console.log(`  ${import_chalk16.default.dim("API key (backend key, for your frontend-server, shown once):")} ${import_chalk16.default.bold.green(o.apiKey)}   ${import_chalk16.default.dim("\u2192 send it as X-API-Key and say who is calling with X-End-User-Id")}`);
   }
   const okLines = agentPrompts(locked, o.openapi, null).filter((l) => l.ok);
   const tryHint = okLines[1]?.say ?? okLines[0]?.say;
@@ -5415,7 +5503,7 @@ async function printOutcome(o) {
   }
   if (o.auth.doors.includes("api_key") && o.apiKey) {
     console.log();
-    console.log(`  ${import_chalk16.default.dim("API key (for your backend and widget \u2014 shown once, save it now):")}`);
+    console.log(`  ${import_chalk16.default.dim("API key (backend key \u2014 for your backend and widget; shown once, save it now):")}`);
     console.log(`    ${import_chalk16.default.bold.green(o.apiKey)}`);
     console.log(import_chalk16.default.dim("  Send it as X-API-Key and say who is calling with X-End-User-Id."));
     const otherEnvs = Object.keys(o.keys).filter((e) => o.keys[e] !== o.apiKey);
@@ -5425,6 +5513,7 @@ async function printOutcome(o) {
   printTryIt(buildTryItCurl(url, o.auth.auth, o.apiKey, o.tenant, o.auth.ownIssuer), [o.tenant, "$TOKEN", o.apiKey, "X-End-User-Id: you"]);
   if (o.auth.auth === "api_key" && o.apiKey) {
     console.log(import_chalk16.default.dim("    X-End-User-Id = who your server is acting for; the rules check that person (any handle works for a test)."));
+    console.log(import_chalk16.default.dim(`    Keys you ship to users (browser, app, widget) must not name anyone:  npx ${B.cli} apikeys mint --client --tenant ${o.tenant ?? "<tenant>"}`));
   }
   if (mcp !== shown) {
     console.log();
@@ -13307,6 +13396,18 @@ async function runnerCall(body, timeoutS) {
   return data;
 }
 var call = runnerCall;
+var TEARDOWN_GUT_ID = "sandbox-key-scrub";
+async function scrubSandboxKeys(timeoutS = 150) {
+  try {
+    const r = await runnerCall({ action: "gut", id: TEARDOWN_GUT_ID }, timeoutS);
+    const first = r.results?.[0]?.detail ?? r.error ?? "";
+    log(import_chalk58.default.dim(`teardown: ${first || (r.ok ? "sandbox fixture keys scrubbed" : "scrub reported a problem")}`));
+    return r.ok;
+  } catch (e) {
+    log(import_chalk58.default.dim(`teardown: sandbox key scrub skipped (${e instanceof Error ? e.message : String(e)}) \u2014 leftovers expire within 14 days; scripts/purge-test-keys.mjs reaps them`));
+    return false;
+  }
+}
 var matches = (id, group2, o) => {
   if (o.only) {
     const wanted = o.only.split(",").map((s) => s.trim()).filter(Boolean);
@@ -13322,7 +13423,7 @@ async function runOpTest(o = {}) {
   const timeoutS = o.timeout && o.timeout > 0 ? o.timeout : 150;
   const listing = await call({ action: "list" }, 60);
   const specs = o.gutsOnly ? [] : listing.specs.filter((s) => matches(s.id, s.group, o));
-  const guts = o.skipGuts ? [] : listing.guts.filter((g) => matches(g.id, void 0, { ...o, group: void 0 }));
+  const guts = o.skipGuts ? [] : listing.guts.filter((g) => g.id !== TEARDOWN_GUT_ID && matches(g.id, void 0, { ...o, group: void 0 }));
   const total = specs.length + guts.length;
   if (total === 0) {
     log(import_chalk58.default.yellow("nothing matched"));
@@ -13344,27 +13445,31 @@ async function runOpTest(o = {}) {
       else for (const x of r.results.filter((x2) => x2 && x2.ok === false)) log(import_chalk58.default.red(`   \u2717 ${x.name ?? ""}: ${x.detail ?? JSON.stringify(x)}`));
     }
   };
-  for (const s of specs) {
-    let r;
-    try {
-      r = await call({ action: "spec", id: s.id }, timeoutS);
-    } catch (e) {
-      r = { kind: "spec", id: s.id, label: s.label, group: s.group, ok: false, cases: [{ name: "runner", ok: false, detail: e instanceof Error ? e.message : String(e) }], duration_ms: 0 };
-    }
-    record(r);
-    if (!r.ok && o.failFast) break;
-  }
-  if (!(o.failFast && failed)) {
-    for (const g of guts) {
+  try {
+    for (const s of specs) {
       let r;
       try {
-        r = await call({ action: "gut", id: g.id }, timeoutS);
+        r = await call({ action: "spec", id: s.id }, timeoutS);
       } catch (e) {
-        r = { kind: "gut", id: g.id, label: g.label, ok: false, results: [], error: e instanceof Error ? e.message : String(e), duration_ms: 0 };
+        r = { kind: "spec", id: s.id, label: s.label, group: s.group, ok: false, cases: [{ name: "runner", ok: false, detail: e instanceof Error ? e.message : String(e) }], duration_ms: 0 };
       }
       record(r);
       if (!r.ok && o.failFast) break;
     }
+    if (!(o.failFast && failed)) {
+      for (const g of guts) {
+        let r;
+        try {
+          r = await call({ action: "gut", id: g.id }, timeoutS);
+        } catch (e) {
+          r = { kind: "gut", id: g.id, label: g.label, ok: false, results: [], error: e instanceof Error ? e.message : String(e), duration_ms: 0 };
+        }
+        record(r);
+        if (!r.ok && o.failFast) break;
+      }
+    }
+  } finally {
+    await scrubSandboxKeys(timeoutS);
   }
   const summary = { ran: results.length, passed: results.length - failed, failed, duration_ms: Date.now() - started, sandbox_team: listing.sandbox_team };
   log("");
@@ -13772,6 +13877,7 @@ async function runOpPerf(o = {}) {
         log3(import_chalk60.default.red(`teardown of ${fixture.proxy} failed: ${e instanceof Error ? e.message : String(e)} \u2014 run \`apiblaze op residue\` / clean the sandbox`));
         process.exitCode = 1;
       }
+      await scrubSandboxKeys(120);
     }
   }
 }
@@ -14214,7 +14320,7 @@ program.command("login").description(`Authenticate with ${B.product}`).option("-
     process.exit(1);
   }
 });
-program.command("create").description(`Create a new ${B.thing} \u2014 both doors open by default (an API key for your backend and widget, GitHub sign-in for people and agents) and resources locked to their creator (no login needed: logged out it creates an anonymous ${B.thingShort} you can claim)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description(`Create a new ${B.thing} \u2014 both doors open by default (an API key for your backend and widget, GitHub sign-in for people and agents) and resources locked to their creator (no login needed: logged out it creates an anonymous ${B.thingShort} you can claim)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -14348,10 +14454,10 @@ admins.command("add").description("Add an email as a tenant admin (e.g. yourself
 admins.command("remove").description("Remove a tenant admin").argument("<email>", "Email to remove").option("--tenant <slug>", "Tenant slug").option("--team <id|name>", "Team").option("--json", "JSON").action(action((email, opts, cmd) => runAdminsRemove(email, { ...cmd.parent?.opts(), ...opts })));
 program.addCommand(admins);
 program.command("iam").description("Turn users & groups on/off for a proxy's tenant (identified calls get their user's groups applied)").argument("<project>", "Project name or id").argument("<state>", "on | off").option("--tenant <name>", "Tenant to toggle (defaults to the project's tenant)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, state, opts) => runIamToggle(project, state, opts)));
-program.command("identified").description("Require calls to identify their end user (X-End-User-Id or a login token) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
+program.command("identified").description("Require calls to identify their end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
 var apikeys = new import_commander.Command("apikeys").description("Producer control-plane API keys (list, then offer to create one)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
 apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyList({ ...cmd.parent?.opts(), ...opts })));
-apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. Needs --tenant.").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
+apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant: a backend key (default), a client key (--client) or a person-bound key (--for)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--backend", `Backend key (default). ${HOLDER_HELP.backend}`).option("--client", `Client key. ${HOLDER_HELP.client} Needs --tenant.`).option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. Needs --tenant.").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
 apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts, cmd) => runKeyRevoke(keyId, { ...cmd.parent?.opts(), ...opts })));
 program.addCommand(apikeys, { hidden: true });
 var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "latency | billing | mark | credits | residue | sweep | test | perf (omit for the menu)").argument("[view]", "for `latency`: slow | llm | compare | grades \xB7 for `billing`: doors | meter \xB7 for `mark`: the change name, quoted").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").option("--hours <n>", "Look-back window in hours (default 1)").option("--team <id>", "Filter to one team").option("--only <ids>", "for `test`: comma-separated spec/gut ids or prefixes").option("--group <name>", "for `test`: only specs whose group matches").option("--skip-guts", "for `test`: contract specs only").option("--guts-only", "for `test`: server-side gut checks only").option("--fail-fast", "for `test`: stop at the first failure").option("--timeout <s>", "for `test`: seconds to wait per check (default 150)").option("--perf", "for `test`: run the performance gate instead of the suite (fixed-rate load on a sandbox proxy)").option("--consumer", "for `test`: probe the data plane with the stored `consumer login` token instead of the suite").option("--path <p>", "for `test --consumer`: request path on the proxy (default /get)").option("--proxy <name@version>", "for `test --consumer`: the OAuth-door proxy to knock on (default: the sandbox proxy for a sandbox-tenant session)").option("--rps <n>", "for `test --perf`: requests per second (default 100, max 300)").option("--seconds <n>", "for `test --perf`: how long to send for (default 60, max 300)").option("--url <url>", "for `test --perf`: load this fixture URL instead of provisioning one (with --key; nothing is torn down)").option("--max-p50 <ms>", "for `test --perf`: client p50 threshold (default 250)").option("--max-p95 <ms>", "for `test --perf`: client p95 threshold (default 800)").option("--max-error-rate <pct>", "for `test --perf`: error-rate threshold in percent (default 0.5)").option("--max-gateway-p50 <ms>", "for `test --perf`: apiblaze-overhead p50 threshold (default 60)").option("--max-gateway-p95 <ms>", "for `test --perf`: apiblaze-overhead p95 threshold (default 250)").option("--project <name>", "Filter to one proxy").option("--api-version <v>", "Filter to one API version").option("--tenant <name>", "Filter to one tenant").option("--route <path>", "Filter to one route").option("--environment <env>", "Filter to one environment").option("--status-class <c>", "Filter to a status class (2xx/4xx/5xx)").option("--min-ms <n>", "For `latency slow`: minimum duration (default 1000)").option("--days <n>", "For `latency grades`: how many days back (default 7)").option("--excellent <ms>", "Grade threshold: under this is excellent (default 250)").option("--okay <ms>", "Grade threshold: under this is okay (default 500)").option("--bad <ms>", "Grade threshold: under this is bad, at/over is terrible (default 1000)").option("--key <key>", "For `billing meter`: a data-plane API key for the sandbox proxy (without it the served-request checks are SKIPPED) \xB7 for `test --perf --url`: the fixture's API key").option("--count <n>", "For `billing meter`: requests per check (default 3, max 10)").option("--mcp-host <host>", "For `billing meter`: an MCP host to check tools/call is charged once").action(action((sub, view, opts) => runOp(sub, opts, view))).addHelpText("after", () => `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.6",
+  "version": "0.21.8",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",