apiblaze 0.21.9 → 0.21.11

package/dist/index.js

@@ -1342,7 +1342,7 @@ var import_commander = require("commander");
 var import_chalk63 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.21.9";
+var version = "0.21.11";
 
 // src/index.ts
 init_types();
@@ -4848,10 +4848,30 @@ async function mintConsumerKey(o) {
     raw: out
   };
 }
+async function tenantKeyEndUserMode(caller, teamId, tenant2) {
+  try {
+    const p = await producer(caller, {
+      method: "GET",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/key-policy`,
+      summary: "Read the tenant key policy (default holder)"
+    });
+    return p?.key_end_user_mode === "one" ? "one" : "many";
+  } catch {
+    return "many";
+  }
+}
+function defaultHolderRefusal(tenant2) {
+  return `Tenant ${tenant2} issues one key per end user (1 API key = 1 end user): add --for <email|id>. To create a different key anyway, pass --backend (a server key that names each caller) or --client.`;
+}
 async function runConsumerKeyMint(opts) {
   const kind = resolveHolder(opts);
   const who = (opts.for ?? "").trim();
   const tenant2 = (opts.tenant ?? "").trim();
+  if (tenant2 && !who && !opts.backend && !opts.client) {
+    const caller = requireCaller();
+    const { teamId } = await resolveActingTeam(caller, opts.team);
+    if (await tenantKeyEndUserMode(caller, teamId, tenant2) === "one") throw new Error(defaultHolderRefusal(tenant2));
+  }
   const spinner = (0, import_ora3.default)(who ? `Minting a key for ${who} in ${tenant2}...` : `Minting a ${kind} key in ${tenant2}...`).start();
   let out;
   try {
@@ -10156,29 +10176,74 @@ var import_chalk44 = __toESM(require("chalk"));
 var import_ora16 = __toESM(require("ora"));
 init_admin();
 init_resolve();
+var KINDS = ["api", "mcp", "portal", "auth"];
+var TENANT_KINDS = ["portal", "auth"];
+async function scopeFor(project, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  if (project) {
+    const proj2 = await resolveProject(teamId, project, opts.apiversion);
+    return { kind: "project", base: `/projects/${proj2.projectId}/domains`, label: `${proj2.projectName} v${proj2.apiVersion}`, apiVersion: proj2.apiVersion };
+  }
+  if (!opts.tenant) {
+    console.error(import_chalk44.default.red("Give a <project> (api / mcp domains) or --tenant <slug> (portal / auth domains)."));
+    process.exit(1);
+  }
+  const tenant2 = opts.tenant.toLowerCase();
+  return {
+    kind: "tenant",
+    base: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/domains`,
+    label: `tenant ${tenant2}`
+  };
+}
+function describeKind(d) {
+  return d?.target ? `${d.kind ?? "api"} \u2192 stands in for ${d.target}` : d?.kind ?? "api";
+}
+function statusColor2(s) {
+  if (s === "active") return import_chalk44.default.green(s);
+  if (s === "failed" || s === "missing" || s === "suspended") return import_chalk44.default.red(s);
+  return import_chalk44.default.yellow(s ?? "unknown");
+}
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
     console.error(import_chalk44.default.red("--domain is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const kind = (opts.kind ?? (project ? "api" : "")).toLowerCase();
+  if (!KINDS.includes(kind)) {
+    console.error(import_chalk44.default.red(`--kind must be one of ${KINDS.join(", ")}${project ? "" : " (portal or auth for a --tenant)"}.`));
+    process.exit(1);
+  }
+  const tenantKind = TENANT_KINDS.includes(kind);
+  if (tenantKind && project) {
+    console.error(import_chalk44.default.red(`A ${kind} domain belongs to a tenant, not a proxy: apiblaze domain add --tenant <slug> --kind ${kind} --domain ${opts.domain}`));
+    process.exit(1);
+  }
+  if (tenantKind && !opts.tenant) {
+    console.error(import_chalk44.default.red(`--tenant <slug> is required for a ${kind} domain.`));
+    process.exit(1);
+  }
+  if (!tenantKind && !project) {
+    console.error(import_chalk44.default.red(`A ${kind} domain belongs to a proxy: apiblaze domain add <project> --kind ${kind} --domain ${opts.domain}`));
+    process.exit(1);
+  }
+  const scope = await scopeFor(project, opts);
   const spinner = (0, import_ora16.default)(`Registering ${opts.domain}...`).start();
   try {
+    const body = scope.kind === "project" ? { hostname: opts.domain, api_version: scope.apiVersion, kind, ...opts.tenant ? { tenant_name: opts.tenant.toLowerCase() } : {} } : { hostname: opts.domain, kind };
     const out = await admin({
       method: "POST",
-      path: `/projects/${proj2.projectId}/domains`,
-      // --tenant binds the domain to one of the project's tenants (per-tenant scope).
-      body: { hostname: opts.domain, api_version: proj2.apiVersion, ...opts.tenant ? { tenant_name: opts.tenant } : {} },
-      summary: `Add custom domain ${opts.domain} to ${proj2.projectName} v${proj2.apiVersion}${opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
+      path: scope.base,
+      body,
+      summary: `Add custom ${kind} domain ${opts.domain} to ${scope.label}${scope.kind === "project" && opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
     });
-    spinner.succeed(`Registered ${opts.domain}. Add these DNS records, then run \`apiblaze domain status\`:`);
+    spinner.succeed(`Registered ${out?.hostname ?? opts.domain} (${describeKind(out)}). Add these DNS records, then run \`apiblaze domain status\`:`);
     if (opts.json) {
       console.log(JSON.stringify(out));
       return;
     }
-    if (out?.cnameRecord) console.log(`  ${import_chalk44.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
+    if (out?.cnameRecord) console.log(`  ${import_chalk44.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value}`);
     if (out?.dcv) console.log(`  ${import_chalk44.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (typeof out?.monthlyCents === "number") console.log(import_chalk44.default.dim(`  billed $${(out.monthlyCents / 100).toFixed(2)}/month (first month pro rata)`));
     if (out?.id) console.log(import_chalk44.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
     spinner.fail("Domain registration failed.");
@@ -10186,12 +10251,11 @@ async function runDomainAdd(project, opts) {
   }
 }
 async function runDomainList(project, opts) {
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const scope = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/domains?api_version=${encodeURIComponent(proj2.apiVersion)}`,
-    summary: `List custom domains for ${proj2.projectName} v${proj2.apiVersion}`
+    path: scope.kind === "project" ? `${scope.base}?api_version=${encodeURIComponent(scope.apiVersion)}` : scope.base,
+    summary: `List custom domains for ${scope.label}`
   });
   const domains = out?.domains ?? [];
   if (opts.json) {
@@ -10202,37 +10266,50 @@ async function runDomainList(project, opts) {
     console.log(import_chalk44.default.yellow("No custom domains."));
     return;
   }
-  for (const d of domains) console.log(`  ${import_chalk44.default.bold(d.hostname)}  ${import_chalk44.default.dim(d.status ?? "")}  ${import_chalk44.default.dim(d.id ?? "")}`);
+  for (const d of domains) {
+    const pin = scope.kind === "project" && d.tenant ? import_chalk44.default.dim(` tenant ${d.tenant}`) : "";
+    console.log(`  ${import_chalk44.default.bold(d.hostname)}  ${statusColor2(d.status)}  ${import_chalk44.default.dim(describeKind(d))}${pin}  ${import_chalk44.default.dim(d.id ?? "")}`);
+  }
 }
 async function runDomainStatus(project, opts) {
   if (!opts.id) {
     console.error(import_chalk44.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const scope = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
+    path: `${scope.base}/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
-  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk44.default.bold(out?.hostname ?? opts.id)}: ${import_chalk44.default.cyan(out?.status ?? "unknown")}`);
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  console.log(`  ${import_chalk44.default.bold(out?.hostname ?? opts.id)}: ${statusColor2(out?.status)}  ${import_chalk44.default.dim(describeKind(out))}`);
+  if (out?.status !== "active") {
+    if (out?.status === "suspended") console.log(import_chalk44.default.red("  Suspended for non-payment \u2014 add credit to restore it."));
+    else if (out?.status === "missing") console.log(import_chalk44.default.red("  No longer registered at Cloudflare \u2014 remove it and add it again."));
+    else {
+      if (out?.cnameRecord) console.log(`  ${import_chalk44.default.cyan("CNAME")}  ${out.cnameRecord.name}  \u2192  ${out.cnameRecord.value}`);
+      if (out?.dcv) console.log(`  ${import_chalk44.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    }
+  }
 }
 async function runDomainRemove(project, opts) {
   if (!opts.id) {
     console.error(import_chalk44.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const scope = await scopeFor(project, opts);
   const spinner = (0, import_ora16.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
-      path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}`,
+      path: `${scope.base}/${encodeURIComponent(opts.id)}`,
       summary: `Remove custom domain ${opts.id}`
     });
-    spinner.succeed("Removed.");
+    spinner.succeed("Removed. Billing for it stops now.");
   } catch (err) {
     spinner.fail("Remove failed.");
     throw err;
@@ -14446,11 +14523,16 @@ program.command("config").description("Browse and change every proxy setting & f
 program.command("target").description("Change where a proxy forwards requests").argument("<project>", "Project name or id").requiredOption("--url <url>", "Target URL to forward to").option("--env <env>", "Environment to scope the target to (e.g. prod, dev)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTargetSet(project, opts)));
 program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
 program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
-var domain = program.command("domain").description("Use your own domain for a proxy");
-domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("<project>", "Project name or id").requiredOption("--domain <host>", "Custom hostname to add").option("--tenant <slug>", "Bind the domain to one of the project's tenants (per-tenant scope)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainAdd(project, opts)));
-domain.command("list").description("List custom domains for a proxy").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
-domain.command("status").description("Check a custom domain's validation status").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
-domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
+var domain = program.command("domain").description("Use your own domain for your API, MCP server, developer portal or login pages (billed monthly)");
+domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("[project]", "Project name or id (for api / mcp domains; omit with --tenant for portal / auth)").requiredOption("--domain <host>", "Custom hostname to add, e.g. api.example.com").option("--kind <kind>", "api (default) | mcp \u2014 on a project; portal | auth \u2014 on a --tenant").option("--tenant <slug>", "portal/auth: the tenant the domain belongs to. api/mcp: pin the domain to one of the project's tenants").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").addHelpText("after", `
+Examples:
+  apiblaze domain add shop --domain api.acme.com                       # the API
+  apiblaze domain add shop --domain mcp.acme.com --kind mcp            # the MCP server
+  apiblaze domain add --tenant acme --kind portal --domain developers.acme.com
+  apiblaze domain add --tenant acme --kind auth --domain login.acme.com`).action(action((project, opts) => runDomainAdd(project, opts)));
+domain.command("list").description("List a project's custom domains, or a tenant's portal/login domains").argument("[project]", "Project name or id (omit with --tenant)").option("--tenant <slug>", "List the tenant's portal / auth domains").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
+domain.command("status").description("Check a custom domain's validation status (and show the DNS records still needed)").argument("[project]", "Project name or id (omit with --tenant)").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--tenant <slug>", "The tenant, for a portal / auth domain").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
+domain.command("rm").description("Remove a custom domain (billing for it stops)").argument("[project]", "Project name or id (omit with --tenant)").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--tenant <slug>", "The tenant, for a portal / auth domain").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
 domain.command("set-base").description("Choose which version/environment your main URL serves").argument("<project>", "Project name or id").option("--env <env>", "Environment (default: prod)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainSetBase(project, opts)));
 var group = program.command("group").description("Manage a tenant's users & groups \u2014 bare command lists groups").action(action(() => runGroupList({})));
 group.command("list").description("List groups").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((opts) => runGroupList(opts)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.9",
+  "version": "0.21.11",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",