apiblaze 0.3.8 → 0.4.1

package/README.md

@@ -1,66 +1,114 @@
 # apiblaze
 
-CLI for [APIblaze](https://apiblaze.com) — instantly tunnel localhost to your APIblaze projects during development.
+CLI for [APIblaze](https://apiblaze.com) — turn any backend into a managed API: add a key, auth, rate limits, a spec, and your own domain, in seconds.
 
-## Installation
+## Install
 
 ```bash
-npm install -g apiblaze
+npx apiblaze --help        # run without installing
+npm install -g apiblaze    # or install globally
 ```
 
-Or run without installing:
+Requires Node.js 18+.
+
+## Quick start
+
+The easiest way is to just chat with it:
 
 ```bash
-npx apiblaze --help
+npx apiblaze agent
 ```
 
-## Requirements
-
-- Node.js 18+
+> Talk in plain English — "make an API for httpbin.org", "rate-limit it to 50/sec",
+> "give me a key". It does the work and shows what each step costs.
 
-## Quick start
+Prefer commands? A few one-liners:
 
 ```bash
-# Create a proxy (no account needed)
+# Make an API in one line — no account needed (prints a claim URL)
 npx apiblaze create --target https://api.example.com
 
-# Optional: sign in if you want it under your team
-npx apiblaze login
-
-# Create a proxy under your team
-npx apiblaze create --name myapi --target https://api.example.com --auth api_key
-
-# Start a dev tunnel (defaults to port 3000)
-npx apiblaze dev
-
-# Or specify a port
+# Run your localhost through a public URL
 npx apiblaze dev 3000
 
-# Stream full request/response traffic to a file (JSON lines)
-npx apiblaze dev 3000 --capture-file traffic.jsonl
-
+# Sign in to manage APIs under your team
+npx apiblaze login
 ```
 
 ## Help
 
 ```bash
-apiblaze --help
-apiblaze help create
-apiblaze help dev
+apiblaze --help            # all commands
+apiblaze help create       # help for one command
+apiblaze domain --help     # subcommands of a group (domain/tenant/key/spec)
+```
+
+Add `--verbose` (or `-v`) to **any** command to print the exact series of API
+calls it makes — as copy-pasteable `curl` you could run yourself with your own
+login token, plus the underlying admin-api leaf each one drives:
+
+```bash
+apiblaze throttle myapi --rate 50 --verbose
 ```
 
 ## Commands
 
-| Command | Description |
+### Chat (the easy way)
+
+| Command | What it does |
+|---|---|
+| `apiblaze agent` | Chat about anything — create, configure, and inspect your APIs |
+| `apiblaze agent openapi <project>` | Chat to build your API spec from real traffic |
+| `apiblaze agent authz <project>` | Chat to design and turn on access rules |
+| `apiblaze agent mcp <project>` | Chat to build an MCP server for your API |
+
+Every chat turn shows its cost.
+
+### Getting started
+
+| Command | What it does |
+|---|---|
+| `apiblaze create --target <url>` | Make an API from a backend (no account needed) |
+| `apiblaze dev [port]` | Put your localhost behind a public URL |
+| `apiblaze login` / `logout` | Sign in / out |
+| `apiblaze whoami` | Who am I, and which team |
+| `apiblaze team [name]` | Switch team |
+| `apiblaze projects` | List your APIs |
+| `apiblaze claim [code]` | Claim an API you made before signing in |
+
+### Manage an API
+
+| Command | What it does |
+|---|---|
+| `apiblaze target <project> --url <url> [--env <e>]` | Change where it forwards requests |
+| `apiblaze throttle <project> [--rate n] [--quota n] [--period daily\|weekly\|monthly]` | Set rate limits and quotas |
+| `apiblaze rename <project> --display-name <name>` | Rename it |
+| `apiblaze spec get <project>` | Print its OpenAPI spec |
+| `apiblaze spec set <project> --file <path>` | Replace its OpenAPI spec from a file |
+| `apiblaze delete <project>` | Delete it and everything under it (asks first) |
+
+### Your own domain
+
+| Command | What it does |
+|---|---|
+| `apiblaze domain add <project> --domain <host>` | Add your domain (shows the DNS records to set) |
+| `apiblaze domain status <project> --id <id>` | Check if it's verified yet |
+| `apiblaze domain list <project>` / `rm <project> --id <id>` | List / remove |
+| `apiblaze domain set-base <project> [--env <e>]` | Pick which version/env your main URL serves |
+
+### Users & keys
+
+| Command | What it does |
 |---|---|
-| `apiblaze login` | Authenticate with your APIblaze account |
-| `apiblaze create [options]` | Create a new API proxy (anonymous if not logged in) |
-| `apiblaze claim [code]` | Claim an anonymously-created proxy into your team |
-| `apiblaze projects` | List your team projects |
-| `apiblaze dev [port]` | Start a dev tunnel for your localhost projects |
-| `apiblaze team [team]` | Switch the active team |
-| `apiblaze whoami` | Show the signed-in identity and active team |
-| `apiblaze logout` | Sign out and remove stored credentials |
+| `apiblaze tenant create --name <name>` | Create a tenant (a separate group of your API's users) |
+| `apiblaze tenant attach <project> --tenant <slug>` | Give a proxy its own set of users |
+| `apiblaze tenant cors --tenant <slug> --origins <a,b>` | Set which websites can call it |
+| `apiblaze tenant list` / `delete <slug>` | List / delete |
+| `apiblaze key mint [--desc <text>]` | Make a key to manage your account from scripts |
+| `apiblaze key list` / `revoke <id>` | List / revoke |
+
+> See what any command does under the hood with `--verbose`. Most management
+> commands take `--team`, `--apiversion`, and `--json`.
 
 ## How it works
 

package/dist/index.js

@@ -8,9 +8,9 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    for (let key2 of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key2) && key2 !== except)
+        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
   }
   return to;
 };
@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk15 = __toESM(require("chalk"));
+var import_chalk25 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.3.8";
+var version = "0.4.1";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -586,8 +586,8 @@ var STRIP_HEADERS = /* @__PURE__ */ new Set([
 ]);
 function stripHeaders(headers) {
   const out = {};
-  for (const key of Object.keys(headers)) {
-    if (!STRIP_HEADERS.has(key.toLowerCase())) out[key] = headers[key];
+  for (const key2 of Object.keys(headers)) {
+    if (!STRIP_HEADERS.has(key2.toLowerCase())) out[key2] = headers[key2];
   }
   return out;
 }
@@ -702,8 +702,8 @@ function startTunnelClient(opts) {
       const status = resp.status;
       const buf = Buffer.from(await resp.arrayBuffer());
       const headers = {};
-      resp.headers.forEach((value, key) => {
-        if (!STRIP_HEADERS.has(key.toLowerCase())) headers[key] = value;
+      resp.headers.forEach((value, key2) => {
+        if (!STRIP_HEADERS.has(key2.toLowerCase())) headers[key2] = value;
       });
       if (capturing) {
         capturing = false;
@@ -822,9 +822,9 @@ async function offerAutoCreate(teamId, port) {
     throw err;
   }
   if (auth === "api_key") {
-    const key = result.api_keys?.dev ?? Object.values(result.api_keys ?? {})[0];
-    if (key) {
-      console.log(`  ${import_chalk4.default.dim("API key (dev):")} ${import_chalk4.default.bold.green(key)}`);
+    const key2 = result.api_keys?.dev ?? Object.values(result.api_keys ?? {})[0];
+    if (key2) {
+      console.log(`  ${import_chalk4.default.dim("API key (dev):")} ${import_chalk4.default.bold.green(key2)}`);
       console.log(import_chalk4.default.dim("  Send it as the X-API-Key header. It may not be shown again."));
     }
   }
@@ -1647,11 +1647,11 @@ async function runAuthz(projectArg, apiVersionArg) {
   }
   const projectId = match.projectId;
   const apiVersion = apiVersionArg || match.apiVersion;
-  const tenant = match.tenant || projectId;
+  const tenant2 = match.tenant || projectId;
   async function apply(ctx, enable) {
     const proposal = ctx.proposal;
     if (!enable) {
-      const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant)}`, "POST", proposal.model);
+      const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant2)}`, "POST", proposal.model);
       if (m.status === 404) {
         ctx.log(import_chalk12.default.red("  Authorization store not provisioned yet. Open the dashboard Authorization tab for this project once (it auto-provisions the store), then re-run.\n"));
         return;
@@ -1684,7 +1684,7 @@ async function runAuthz(projectArg, apiVersionArg) {
       else fail4++;
     }
     if (enable) {
-      const e = await agentCall(`/${projectId}/${apiVersion}/config`, "PATCH", { authorization: { enforce_authorization: true }, tenant });
+      const e = await agentCall(`/${projectId}/${apiVersion}/config`, "PATCH", { authorization: { enforce_authorization: true }, tenant: tenant2 });
       if (e.status >= 400) {
         ctx.log(import_chalk12.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
 `));
@@ -1699,7 +1699,7 @@ async function runAuthz(projectArg, apiVersionArg) {
   }
   await runAgentChatRepl({
     title: `Authorization assistant \u2014 ${projectId} ${apiVersion}`,
-    subtitle: `tenant ${tenant} \xB7 discuss what authorization fits this API, then make it official.`,
+    subtitle: `tenant ${tenant2} \xB7 discuss what authorization fits this API, then make it official.`,
     endpoint: `/projects/${projectId}/${apiVersion}/authz/chat`,
     buildBody: () => ({ included_sample_ids: [], existing_model: null, existing_routes: [] }),
     seedPrompt: "Analyze this API and tell me what authorization is feasible. If it is read-only, say so plainly. Then propose options \u2014 do not generate rules yet.",
@@ -1794,8 +1794,8 @@ async function runMcp(projectArg, apiVersionArg, opts) {
   const environment = opts.environment || "prod";
   const mcpHost = match.tenant ? `${projectId}-${match.tenant}` : projectId;
   async function publish(ctx) {
-    const spec = ctx.proposal;
-    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec });
+    const spec2 = ctx.proposal;
+    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec: spec2 });
     if (pub.status >= 400) {
       ctx.log(import_chalk14.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
@@ -1811,8 +1811,8 @@ async function runMcp(projectArg, apiVersionArg, opts) {
     buildBody: () => ({ environment, included_sample_ids: [] }),
     seedPrompt: "Look at this API's routes and recommend which should become MCP tools, with good names and descriptions. Don't finalize yet \u2014 explain first.",
     summarizeProposal: (data) => {
-      const spec = data.proposal;
-      const tools = Array.isArray(spec.tools) ? spec.tools : [];
+      const spec2 = data.proposal;
+      const tools = Array.isArray(spec2.tools) ? spec2.tools : [];
       const names = tools.slice(0, 12).map((t) => t.name ?? "(unnamed)").join(", ");
       return `Catalogue ready: ${tools.length} tool(s)${names ? ` \u2014 ${names}${tools.length > 12 ? ", \u2026" : ""}` : ""}.`;
     },
@@ -1822,137 +1822,930 @@ async function runMcp(projectArg, apiVersionArg, opts) {
   });
 }
 
-// src/index.ts
-var program = new import_commander.Command();
-program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version);
-program.command("login").description("Authenticate with APIblaze").action(async () => {
+// src/commands/delete.ts
+var import_chalk18 = __toESM(require("chalk"));
+var import_ora5 = __toESM(require("ora"));
+
+// src/lib/admin.ts
+var import_chalk16 = __toESM(require("chalk"));
+
+// src/lib/trace.ts
+var import_chalk15 = __toESM(require("chalk"));
+var verbose = false;
+var entries = [];
+function setVerbose(v) {
+  verbose = v;
+}
+function recordCall(e) {
+  if (verbose) entries.push(e);
+}
+var SECRET_KEY = /secret|token|password|api[_-]?key|client_secret/i;
+function maskBody(body) {
+  if (body === void 0) return void 0;
+  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
+}
+function renderTrace() {
+  if (!verbose || entries.length === 0) return;
+  console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
+  console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
+  console.log(
+    import_chalk15.default.dim("Copy/paste the curl below to do it yourself \u2014 it uses your own login token.\n")
+  );
+  entries.forEach((e, i) => {
+    const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
+    if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    const masked = maskBody(e.body);
+    const payload = JSON.stringify({ path: e.path, method: e.method, ...masked ? { body: JSON.parse(masked) } : {} });
+    console.log(import_chalk15.default.green("  curl -sS -X POST https://dashboard.apiblaze.com/api/cli/admin \\"));
+    console.log(import_chalk15.default.green('    -H "Authorization: Bearer $(jq -r .accessToken ~/.apiblaze/credentials.json)" \\'));
+    console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
+    console.log(import_chalk15.default.green(`    -d '${payload}'`));
+    console.log(
+      import_chalk15.default.dim(
+        `  # \u2192 admin-api leaf (Lane 3, X-User-Assertion minted server-side): ${e.method} ${e.path}`
+      )
+    );
+    if (i < entries.length - 1) console.log();
+  });
+}
+
+// src/lib/admin.ts
+var DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+async function admin(call) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE3}/api/cli/admin`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
+  });
+  let data = null;
   try {
-    await runLogin();
+    data = await res.json();
+  } catch {
+  }
+  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
+  maybePrintBilling(data);
+  if (!res.ok) {
+    const msg = data?.details ?? data?.error ?? res.statusText;
+    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
+  }
+  return data;
+}
+function maybePrintBilling(data) {
+  const b = data?.billing;
+  if (b && typeof b.charged_cents === "number") {
+    const usd = (b.charged_cents / 100).toFixed(2);
+    const rem = typeof b.credits_remaining === "number" ? ` \xB7 $${(b.credits_remaining / 100).toFixed(2)} credit left` : "";
+    console.log(import_chalk16.default.magenta(`  \u{1F4B3} Charged $${usd}${rem}`));
+  }
+}
+
+// src/lib/resolve.ts
+var import_chalk17 = __toESM(require("chalk"));
+function requireAuth() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error(import_chalk17.default.red("Not logged in. Run `apiblaze login` first."));
+    process.exit(1);
+  }
+  return creds;
+}
+async function resolveTeam(opt) {
+  const creds = requireAuth();
+  if (!opt) {
+    if (!creds.teamId) {
+      console.error(import_chalk17.default.red("No active team. Run `apiblaze login` or pass --team."));
+      process.exit(1);
+    }
+    return { teamId: creds.teamId, teamName: creds.teamName };
+  }
+  if (opt.startsWith("team_")) return { teamId: opt };
+  const teams = await getTeams().catch(() => []);
+  const match = teams.find((t) => t.name === opt || t.teamId === opt);
+  if (!match) {
+    console.error(import_chalk17.default.red(`Team "${opt}" not found.${teams.length ? " Available: " + teams.map((t) => t.name).join(", ") : ""}`));
+    process.exit(1);
+  }
+  return { teamId: match.teamId, teamName: match.name };
+}
+async function resolveProject(teamId, nameOrId, version2) {
+  const projects = await getProjects(teamId).catch(() => []);
+  const candidates = projects.filter(
+    (p) => p.projectId === nameOrId || p.projectName === nameOrId
+  );
+  if (candidates.length === 0) {
+    console.error(import_chalk17.default.red(`Project "${nameOrId}" not found in this team.`));
+    if (projects.length) console.error(import_chalk17.default.dim("  Known: " + projects.map((p) => p.projectName).join(", ")));
+    process.exit(1);
+  }
+  const chosen = version2 ? candidates.find((p) => p.apiVersion === version2) : candidates[0];
+  if (!chosen) {
+    console.error(import_chalk17.default.red(`Project "${nameOrId}" has no version ${version2}. Versions: ${candidates.map((p) => p.apiVersion).join(", ")}`));
+    process.exit(1);
+  }
+  return {
+    projectId: chosen.projectId,
+    projectName: chosen.projectName,
+    apiVersion: chosen.apiVersion,
+    teamId,
+    tenant: chosen.tenant
+  };
+}
+
+// src/commands/delete.ts
+async function runDelete(project, version2, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, version2);
+  const spinner = (0, import_ora5.default)("Checking delete impact...").start();
+  let impact;
+  try {
+    impact = await admin({
+      method: "GET",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}/delete-impact`,
+      summary: `Preview what deleting ${proj2.projectName} v${proj2.apiVersion} removes`
+    });
+    spinner.stop();
   } catch (err) {
-    printError(err);
+    spinner.stop();
+    impact = null;
+  }
+  if (opts.json) {
+    if (!opts.yes) {
+      console.log(JSON.stringify({ project_id: proj2.projectId, api_version: proj2.apiVersion, impact, deleted: false, hint: "pass --yes to delete" }));
+      return;
+    }
+  } else {
+    console.log(`${import_chalk18.default.red.bold("Delete")} ${import_chalk18.default.bold(proj2.projectName)} ${import_chalk18.default.dim("v" + proj2.apiVersion)} ${import_chalk18.default.dim("(" + proj2.projectId + ")")}`);
+    if (impact && typeof impact === "object") {
+      const counts = impact.counts ?? impact.impact ?? impact;
+      console.log(import_chalk18.default.dim("  This removes (cascade): ") + import_chalk18.default.yellow(JSON.stringify(counts)));
+    }
+    if (!opts.yes) {
+      const { default: inquirer2 } = await import("inquirer");
+      const { confirm } = await inquirer2.prompt([
+        { type: "confirm", name: "confirm", message: `Permanently delete ${proj2.projectName} v${proj2.apiVersion}? This cannot be undone.`, default: false }
+      ]);
+      if (!confirm) {
+        console.log(import_chalk18.default.dim("Aborted."));
+        return;
+      }
+    }
+  }
+  const s2 = (0, import_ora5.default)("Deleting...").start();
+  try {
+    await admin({
+      method: "DELETE",
+      path: `/${proj2.projectId}/${proj2.apiVersion}`,
+      summary: `Delete proxy ${proj2.projectName} v${proj2.apiVersion} (full cascade)`
+    });
+    s2.succeed(`Deleted ${proj2.projectName} v${proj2.apiVersion}.`);
+  } catch (err) {
+    s2.fail("Delete failed.");
+    throw err;
+  }
+  if (opts.json) console.log(JSON.stringify({ project_id: proj2.projectId, api_version: proj2.apiVersion, deleted: true }));
+}
+
+// src/commands/config.ts
+var import_chalk19 = __toESM(require("chalk"));
+var import_ora6 = __toESM(require("ora"));
+async function patchConfig(project, opts, body, summary) {
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora6.default)(summary + "...").start();
+  try {
+    const out = await admin({
+      method: "PATCH",
+      path: `/${proj2.projectId}/${proj2.apiVersion}/config`,
+      body,
+      summary
+    });
+    spinner.succeed(`${summary} \u2014 ${proj2.projectName} v${proj2.apiVersion}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+  } catch (err) {
+    spinner.fail(summary + " failed.");
+    throw err;
+  }
+}
+async function runTargetSet(project, opts) {
+  if (!opts.url) {
+    console.error(import_chalk19.default.red("--url is required."));
     process.exit(1);
   }
-});
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.apiblaze.com)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant slug (anonymous create; generated if omitted)").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+  const body = opts.env ? { environments: { [opts.env]: { target: opts.url } } } : { target_url: opts.url };
+  await patchConfig(project, opts, body, `Set target${opts.env ? ` for env ${opts.env}` : ""} \u2192 ${opts.url}`);
+}
+async function runThrottleSet(project, opts) {
+  const throttling = {};
+  if (opts.rate !== void 0) throttling.userRateLimit = Number(opts.rate);
+  if (opts.endUserRate !== void 0) throttling.endUserRateLimit = Number(opts.endUserRate);
+  if (opts.quota !== void 0) throttling.proxyQuota = Number(opts.quota);
+  if (opts.period !== void 0) {
+    if (!["daily", "weekly", "monthly"].includes(opts.period)) {
+      console.error(import_chalk19.default.red("--period must be daily, weekly, or monthly."));
+      process.exit(1);
+    }
+    throttling.quotaPeriod = opts.period;
+  }
+  if (Object.keys(throttling).length === 0) {
+    console.error(import_chalk19.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
+    process.exit(1);
+  }
+  await patchConfig(project, opts, { throttling }, `Update throttling ${JSON.stringify(throttling)}`);
+}
+async function runRename(project, opts) {
+  if (!opts.displayName) {
+    console.error(import_chalk19.default.red("--display-name is required."));
+    process.exit(1);
+  }
+  await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
+}
+
+// src/commands/domain.ts
+var import_chalk20 = __toESM(require("chalk"));
+var import_ora7 = __toESM(require("ora"));
+async function runDomainAdd(project, opts) {
+  if (!opts.domain) {
+    console.error(import_chalk20.default.red("--domain is required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora7.default)(`Registering ${opts.domain}...`).start();
   try {
-    await runCreate(opts);
+    const out = await admin({
+      method: "POST",
+      path: `/projects/${proj2.projectId}/cf-domains`,
+      body: { hostname: opts.domain, api_version: proj2.apiVersion, ...opts.tenant ? { tenant_name: opts.tenant } : {} },
+      summary: `Add custom domain ${opts.domain} to ${proj2.projectName} v${proj2.apiVersion}`
+    });
+    spinner.succeed(`Registered ${opts.domain}. Add these DNS records, then run \`apiblaze domain status\`:`);
+    if (opts.json) {
+      console.log(JSON.stringify(out));
+      return;
+    }
+    if (out?.cnameRecord) console.log(`  ${import_chalk20.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
+    if (out?.dcv) console.log(`  ${import_chalk20.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (out?.id) console.log(import_chalk20.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
-    printError(err);
+    spinner.fail("Domain registration failed.");
+    throw err;
+  }
+}
+async function runDomainList(project, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const out = await admin({
+    method: "GET",
+    path: `/projects/${proj2.projectId}/cf-domains?api_version=${encodeURIComponent(proj2.apiVersion)}`,
+    summary: `List custom domains for ${proj2.projectName} v${proj2.apiVersion}`
+  });
+  const domains = out?.domains ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify(domains));
+    return;
+  }
+  if (!domains.length) {
+    console.log(import_chalk20.default.yellow("No custom domains."));
+    return;
+  }
+  for (const d of domains) console.log(`  ${import_chalk20.default.bold(d.hostname)}  ${import_chalk20.default.dim(d.status ?? "")}  ${import_chalk20.default.dim(d.id ?? "")}`);
+}
+async function runDomainStatus(project, opts) {
+  if (!opts.id) {
+    console.error(import_chalk20.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-});
-program.command("logout").description("Sign out \u2014 remove stored credentials from this machine").action(async () => {
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const out = await admin({
+    method: "GET",
+    path: `/projects/${proj2.projectId}/cf-domains/${encodeURIComponent(opts.id)}/status`,
+    summary: `Check custom-domain status`
+  });
+  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk20.default.bold(out?.hostname ?? opts.id)}: ${import_chalk20.default.cyan(out?.status ?? "unknown")}`);
+}
+async function runDomainRemove(project, opts) {
+  if (!opts.id) {
+    console.error(import_chalk20.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora7.default)("Removing domain...").start();
   try {
-    await runLogout();
+    await admin({
+      method: "DELETE",
+      path: `/projects/${proj2.projectId}/cf-domains/${encodeURIComponent(opts.id)}`,
+      summary: `Remove custom domain ${opts.id}`
+    });
+    spinner.succeed("Removed.");
   } catch (err) {
-    printError(err);
+    spinner.fail("Remove failed.");
+    throw err;
+  }
+}
+async function runDomainSetBase(project, opts) {
+  const env = opts.env ?? "prod";
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora7.default)("Setting base domain...").start();
+  try {
+    await admin({
+      method: "PUT",
+      path: `/projects/${proj2.projectId}/base-domain`,
+      body: { api_version: proj2.apiVersion, environment: env },
+      summary: `Point bare hostname \u2192 v${proj2.apiVersion} / ${env}`
+    });
+    spinner.succeed(`Bare hostname now serves ${proj2.projectName} v${proj2.apiVersion} (${env}).`);
+  } catch (err) {
+    spinner.fail("set-base failed.");
+    throw err;
+  }
+}
+
+// src/commands/tenant.ts
+var import_chalk21 = __toESM(require("chalk"));
+var import_ora8 = __toESM(require("ora"));
+async function runTenantList(opts) {
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1`,
+    summary: `List tenants for team ${teamName ?? teamId}`
+  });
+  const tenants = out?.tenants ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify(tenants));
+    return;
+  }
+  if (!tenants.length) {
+    console.log(import_chalk21.default.yellow("No tenants."));
+    return;
+  }
+  for (const t of tenants) {
+    const name = typeof t === "string" ? t : t.tenant_name;
+    const display = typeof t === "string" ? "" : import_chalk21.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk21.default.bold(name)}${display}`);
+  }
+}
+async function runTenantCreate(opts) {
+  if (!opts.name) {
+    console.error(import_chalk21.default.red("--name (display name) is required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora8.default)("Creating tenant...").start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants`,
+      body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
+      summary: `Create tenant "${opts.name}"`
+    });
+    spinner.succeed(`Created tenant ${import_chalk21.default.bold(out?.tenant_name ?? opts.name)}.`);
+    if (opts.json) console.log(JSON.stringify(out));
+  } catch (err) {
+    spinner.fail("Tenant create failed.");
+    throw err;
+  }
+}
+async function runTenantAttach(project, opts) {
+  if (!opts.tenant) {
+    console.error(import_chalk21.default.red("--tenant <slug> is required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora8.default)("Attaching tenant...").start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`,
+      body: { tenant_name: opts.tenant, ...opts.authConfig ? { auth_config_id: opts.authConfig } : {} },
+      summary: `Attach tenant ${opts.tenant} \u2192 ${proj2.projectName} v${proj2.apiVersion}`
+    });
+    spinner.succeed(`Attached ${opts.tenant} to ${proj2.projectName} v${proj2.apiVersion}.`);
+    if (opts.json) console.log(JSON.stringify(out));
+  } catch (err) {
+    spinner.fail("Attach failed.");
+    throw err;
+  }
+}
+async function runTenantDelete(slug, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  if (!opts.yes && !opts.json) {
+    const { default: inquirer2 } = await import("inquirer");
+    const { confirm } = await inquirer2.prompt([
+      { type: "confirm", name: "confirm", message: `Permanently delete tenant "${slug}" and everything under it? This cannot be undone.`, default: false }
+    ]);
+    if (!confirm) {
+      console.log(import_chalk21.default.dim("Aborted."));
+      return;
+    }
+  }
+  const spinner = (0, import_ora8.default)("Deleting tenant...").start();
+  try {
+    await admin({
+      method: "DELETE",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(slug)}`,
+      summary: `Delete tenant ${slug} (full cascade)`
+    });
+    spinner.succeed(`Deleted tenant ${slug}.`);
+  } catch (err) {
+    spinner.fail("Tenant delete failed.");
+    throw err;
+  }
+}
+async function runTenantCors(opts) {
+  if (!opts.tenant) {
+    console.error(import_chalk21.default.red("--tenant <slug> is required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const cors = origins.length ? { allowed_origins: origins } : null;
+  const spinner = (0, import_ora8.default)("Updating CORS...").start();
+  try {
+    await admin({
+      method: "PUT",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(opts.tenant)}/cors`,
+      body: { cors },
+      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins.length ? origins.join(", ") : "(cleared)"}`
+    });
+    spinner.succeed(`CORS updated for ${opts.tenant}.`);
+  } catch (err) {
+    spinner.fail("CORS update failed.");
+    throw err;
+  }
+}
+
+// src/commands/key.ts
+var import_chalk22 = __toESM(require("chalk"));
+var import_ora9 = __toESM(require("ora"));
+async function runKeyList(opts) {
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
+    summary: `List developer keys for team ${teamName ?? teamId}`
+  });
+  const keys = out?.keys ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify(keys));
+    return;
+  }
+  if (!keys.length) {
+    console.log(import_chalk22.default.yellow("No developer keys."));
+    return;
+  }
+  for (const k of keys) {
+    console.log(`  ${import_chalk22.default.bold(k.key_id ?? k.id)}  ${import_chalk22.default.dim(k.description ?? "")}  ${import_chalk22.default.dim(k.expires_at ?? "no expiry")}`);
+  }
+}
+async function runKeyMint(opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const body = { role: "consumer-admin" };
+  if (opts.desc) body.description = opts.desc;
+  if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
+  const spinner = (0, import_ora9.default)("Minting key...").start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
+      body,
+      summary: `Mint a consumer-admin developer key`
+    });
+    spinner.succeed("Key minted.");
+    if (opts.json) {
+      console.log(JSON.stringify(out));
+      return;
+    }
+    console.log(`  ${import_chalk22.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk22.default.bold("key")}:     ${import_chalk22.default.green(out?.key)}  ${import_chalk22.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk22.default.dim("expires:")} ${out.expires_at}`);
+  } catch (err) {
+    spinner.fail("Mint failed.");
+    throw err;
+  }
+}
+async function runKeyRevoke(keyId, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora9.default)("Revoking key...").start();
+  try {
+    await admin({
+      method: "DELETE",
+      path: `/teams/${encodeURIComponent(teamId)}/developer-keys/${encodeURIComponent(keyId)}`,
+      summary: `Revoke developer key ${keyId}`
+    });
+    spinner.succeed(`Revoked ${keyId}.`);
+  } catch (err) {
+    spinner.fail("Revoke failed.");
+    throw err;
+  }
+}
+
+// src/commands/spec.ts
+var fs4 = __toESM(require("fs"));
+var import_chalk23 = __toESM(require("chalk"));
+var import_ora10 = __toESM(require("ora"));
+async function runSpecGet(project, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const out = await admin({
+    method: "GET",
+    path: `/projects/${proj2.projectId}/${proj2.apiVersion}/openapi`,
+    summary: `Get OpenAPI spec for ${proj2.projectName} v${proj2.apiVersion}`
+  });
+  console.log(JSON.stringify(out, null, opts.json ? 0 : 2));
+}
+async function runSpecSet(project, opts) {
+  if (!opts.file) {
+    console.error(import_chalk23.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    process.exit(1);
+  }
+  let specContent;
+  try {
+    specContent = fs4.readFileSync(opts.file, "utf-8");
+  } catch {
+    console.error(import_chalk23.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora10.default)("Uploading spec...").start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`,
+      body: { specContent },
+      summary: `Set OpenAPI spec for ${proj2.projectName} v${proj2.apiVersion} from ${opts.file}`
+    });
+    spinner.succeed(`Spec updated for ${proj2.projectName} v${proj2.apiVersion}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+  } catch (err) {
+    spinner.fail("Spec update failed.");
+    throw err;
+  }
+}
+
+// src/commands/agent.ts
+var import_chalk24 = __toESM(require("chalk"));
+var import_ora11 = __toESM(require("ora"));
+
+// src/lib/tools.ts
+async function proj(teamId, name, version2) {
+  return resolveProject(teamId, name, version2);
+}
+var TOOLS = [
+  {
+    name: "list_projects",
+    description: "List the proxies (projects) in the active team.",
+    params: {},
+    run: async (_a, { teamId }) => getProjects(teamId)
+  },
+  {
+    name: "set_target",
+    description: "Set a proxy's target URL. Use env to scope to one environment (e.g. prod).",
+    params: { project: "project name or id", url: "target URL", env: "optional environment" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      const body = a.env ? { environments: { [a.env]: { target: a.url } } } : { target_url: a.url };
+      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body, summary: `Set target for ${p.projectName}` });
+    }
+  },
+  {
+    name: "set_throttle",
+    description: "Set per-proxy throttling. rate=req/sec, quota=req/period, period=daily|weekly|monthly.",
+    params: { project: "project name or id", rate: "optional req/sec", quota: "optional req/period", period: "optional daily|weekly|monthly" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      const throttling = {};
+      if (a.rate != null) throttling.userRateLimit = Number(a.rate);
+      if (a.quota != null) throttling.proxyQuota = Number(a.quota);
+      if (a.period) throttling.quotaPeriod = a.period;
+      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body: { throttling }, summary: `Throttle ${p.projectName}` });
+    }
+  },
+  {
+    name: "rename_proxy",
+    description: "Change a proxy's display name.",
+    params: { project: "project name or id", display_name: "new display name" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body: { display_name: a.display_name }, summary: `Rename ${p.projectName}` });
+    }
+  },
+  {
+    name: "delete_proxy",
+    description: "Delete a proxy (full cascade). Irreversible \u2014 confirm with the user first.",
+    params: { project: "project name or id", version: "optional api version" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.version);
+      return admin({ method: "DELETE", path: `/${p.projectId}/${p.apiVersion}`, summary: `Delete ${p.projectName} (cascade)` });
+    }
+  },
+  {
+    name: "list_tenants",
+    description: "List tenants in the active team.",
+    params: {},
+    run: async (_a, { teamId }) => admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1`, summary: "List tenants" })
+  },
+  {
+    name: "create_tenant",
+    description: "Create a tenant (consumer scope) in the active team.",
+    params: { name: "display name", slug: "optional explicit slug" },
+    run: async (a, { teamId }) => admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/tenants`, body: { display_name: a.name, ...a.slug ? { tenant_name: a.slug } : {} }, summary: `Create tenant ${a.name}` })
+  },
+  {
+    name: "attach_tenant",
+    description: "Attach a tenant to a proxy.",
+    params: { project: "project name or id", tenant: "tenant slug" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      return admin({ method: "POST", path: `/projects/${p.projectId}/${p.apiVersion}/tenants`, body: { tenant_name: a.tenant }, summary: `Attach ${a.tenant} \u2192 ${p.projectName}` });
+    }
+  },
+  {
+    name: "list_keys",
+    description: "List control-plane developer keys for the active team.",
+    params: {},
+    run: async (_a, { teamId }) => admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/developer-keys`, summary: "List developer keys" })
+  },
+  {
+    name: "mint_key",
+    description: "Mint a consumer-admin developer key (secret returned once).",
+    params: { desc: "optional description", expires_days: "optional expiry in days" },
+    run: async (a, { teamId }) => {
+      const body = { role: "consumer-admin" };
+      if (a.desc) body.description = a.desc;
+      if (a.expires_days) body.expires_in_seconds = Number(a.expires_days) * 86400;
+      return admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/developer-keys`, body, summary: "Mint developer key" });
+    }
+  },
+  {
+    name: "list_domains",
+    description: "List custom domains for a proxy.",
+    params: { project: "project name or id" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      return admin({ method: "GET", path: `/projects/${p.projectId}/cf-domains?api_version=${encodeURIComponent(p.apiVersion)}`, summary: `List domains for ${p.projectName}` });
+    }
+  },
+  {
+    name: "set_base_domain",
+    description: "Point the bare hostname of a proxy at a (version, environment).",
+    params: { project: "project name or id", env: "environment (default prod)" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      return admin({ method: "PUT", path: `/projects/${p.projectId}/base-domain`, body: { api_version: p.apiVersion, environment: a.env ?? "prod" }, summary: `Base domain \u2192 ${p.projectName}` });
+    }
+  },
+  {
+    name: "get_spec",
+    description: "Fetch the OpenAPI spec of a proxy.",
+    params: { project: "project name or id" },
+    run: async (a, { teamId }) => {
+      const p = await proj(teamId, a.project, a.apiversion);
+      return admin({ method: "GET", path: `/projects/${p.projectId}/${p.apiVersion}/openapi`, summary: `Get spec for ${p.projectName}` });
+    }
+  }
+];
+function toolCatalogue() {
+  return TOOLS.map(({ name, description, params }) => ({ name, description, params }));
+}
+function findTool(name) {
+  return TOOLS.find((t) => t.name === name);
+}
+
+// src/commands/agent.ts
+var DASHBOARD_BASE4 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+var MAX_TOOL_STEPS = 6;
+async function callAgent(messages, teamId) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE4}/api/cli/agent`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ messages: messages.slice(-20), tools: toolCatalogue(), team_id: teamId })
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  if (!res.ok) throw new ApiError(res.status, data?.error ?? res.statusText, data);
+  return data;
+}
+function truncate(value, max = 1500) {
+  let s;
+  try {
+    s = typeof value === "string" ? value : JSON.stringify(value);
+  } catch {
+    s = String(value);
+  }
+  if (s.length <= max) return s;
+  return s.slice(0, max) + `\u2026 [truncated ${s.length - max} chars]`;
+}
+function printCost(llm) {
+  const usd = llm.cost > 0 ? `$${llm.cost.toFixed(4)}` : "<$0.0001";
+  console.log(import_chalk24.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk24.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
+}
+async function runAgent(opts) {
+  requireAuth();
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const { default: inquirer2 } = await import("inquirer");
+  console.log(import_chalk24.default.bold("APIblaze agent") + import_chalk24.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk24.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  const history = [];
+  while (true) {
+    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk24.default.cyan("you") + " \u203A" }]);
+    const text = (input ?? "").trim();
+    if (!text) continue;
+    if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
+    history.push({ role: "user", content: text });
+    for (let step = 0; step < MAX_TOOL_STEPS; step++) {
+      const spinner = (0, import_ora11.default)({ text: "thinking...", color: "magenta" }).start();
+      let resp;
+      try {
+        resp = await callAgent(history, teamId);
+        spinner.stop();
+      } catch (err) {
+        spinner.stop();
+        if (err instanceof ApiError && err.status === 402) {
+          console.log(import_chalk24.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          break;
+        }
+        throw err;
+      }
+      history.push({ role: "assistant", content: resp.raw });
+      printCost(resp.llm);
+      if (resp.reply) console.log(import_chalk24.default.green("agent") + " \u203A " + resp.reply);
+      if (!resp.action) break;
+      const tool = findTool(resp.action.tool);
+      if (!tool) {
+        history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
+        continue;
+      }
+      const runSpinner = (0, import_ora11.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      try {
+        const result = await tool.run(resp.action.args, { teamId });
+        runSpinner.succeed(`${tool.name} \u2713`);
+        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: ${truncate(result)}` });
+      } catch (err) {
+        runSpinner.fail(`${tool.name} failed`);
+        const msg = err instanceof Error ? err.message : String(err);
+        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: error \u2014 ${truncate(msg, 400)}` });
+      }
+      if (step === MAX_TOOL_STEPS - 1) {
+        console.log(import_chalk24.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+      }
+    }
+  }
+  console.log(import_chalk24.default.dim("\nBye."));
+}
+
+// src/index.ts
+var program = new import_commander.Command();
+program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
+program.hook("preAction", () => {
+  if (program.opts().verbose) setVerbose(true);
 });
-program.command("whoami").description("Show the signed-in identity and active team").option("--json", "Output machine-readable JSON").action(async (opts) => {
+process.on("exit", () => renderTrace());
+function action(fn) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      printError(err);
+      process.exit(1);
+    }
+  };
+}
+program.command("login").description("Authenticate with APIblaze").action(async () => {
   try {
-    await runWhoami(opts);
+    await runLogin();
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("claim").description("Claim an anonymously-created proxy into one of your teams (requires login)").argument("[code]", "Claim code from `create` output / claim URL (prompted if omitted)").option("--team <id|name>", "Team to claim into (defaults to your active team)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (code, opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.apiblaze.com)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant slug (anonymous create; generated if omitted)").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
-    await runClaim(code, opts);
+    await runCreate(opts);
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("team").description("Switch the active team").argument("[team]", "Team name or id to switch to (omit to choose interactively)").action(async (team) => {
+var agent = program.command("agent").description("Chat with an assistant that builds and runs your APIs (billed per turn)").option("--team <id|name>", "Team to work in (defaults to your active team)").action(action((opts) => runAgent(opts)));
+agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
+agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
+agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
+program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
-    await runTeam(team);
+    const resolved = parseInt(port ?? opts.port, 10);
+    if (Number.isNaN(resolved)) {
+      console.error(import_chalk25.default.red(`Invalid port: ${port ?? opts.port}`));
+      process.exit(1);
+    }
+    await runDev({ port: resolved, captureFile: opts.captureFile });
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("projects").description("List the projects in your team").action(async () => {
+program.command("logout").description("Sign out \u2014 remove stored credentials from this machine").action(async () => {
   try {
-    await runProjects();
+    await runLogout();
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("authz").description("Design API authorization interactively (chat), then publish + enable it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").action(async (project, apiVersion) => {
+program.command("whoami").description("Show the signed-in identity and active team").option("--json", "Output machine-readable JSON").action(async (opts) => {
   try {
-    await runAuthz(project, apiVersion);
+    await runWhoami(opts);
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("openapi").description("Design your OpenAPI spec from captured traffic interactively (chat), then publish it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").action(async (project, apiVersion) => {
+program.command("claim").description("Claim an anonymously-created proxy into one of your teams (requires login)").argument("[code]", "Claim code from `create` output / claim URL (prompted if omitted)").option("--team <id|name>", "Team to claim into (defaults to your active team)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (code, opts) => {
   try {
-    await runOpenapi(project, apiVersion);
+    await runClaim(code, opts);
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("mcp").description("Design an MCP server from the spec + traffic interactively (chat), then publish it").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[apiVersion]", "API version (defaults to the project's version)").option("--environment <env>", "Environment to publish (default: prod)").action(async (project, apiVersion, opts) => {
+program.command("team").description("Switch the active team").argument("[team]", "Team name or id to switch to (omit to choose interactively)").action(async (team) => {
   try {
-    await runMcp(project, apiVersion, opts);
+    await runTeam(team);
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
-program.command("dev").description("Start a dev tunnel for your localhost projects").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
+program.command("projects").description("List the projects in your team").action(async () => {
   try {
-    const resolved = parseInt(port ?? opts.port, 10);
-    if (Number.isNaN(resolved)) {
-      console.error(import_chalk15.default.red(`Invalid port: ${port ?? opts.port}`));
-      process.exit(1);
-    }
-    await runDev({ port: resolved, captureFile: opts.captureFile });
+    await runProjects();
   } catch (err) {
     printError(err);
     process.exit(1);
   }
 });
+program.command("delete").description("Delete a proxy and everything under it (asks first)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--team <id|name>", "Team the project is in (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON").action(action((project, version2, opts) => runDelete(project, version2, opts)));
+program.command("target").description("Change where a proxy forwards requests").argument("<project>", "Project name or id").requiredOption("--url <url>", "Target URL to forward to").option("--env <env>", "Environment to scope the target to (e.g. prod, dev)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTargetSet(project, opts)));
+program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
+program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
+var domain = program.command("domain").description("Use your own domain for a proxy");
+domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("<project>", "Project name or id").requiredOption("--domain <host>", "Custom hostname to add").option("--tenant <slug>", "Tenant to scope the domain to").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainAdd(project, opts)));
+domain.command("list").description("List custom domains for a proxy").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
+domain.command("status").description("Check a custom domain's validation status").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
+domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
+domain.command("set-base").description("Choose which version/environment your main URL serves").argument("<project>", "Project name or id").option("--env <env>", "Environment (default: prod)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainSetBase(project, opts)));
+var tenant = program.command("tenant").description("Manage tenants \u2014 separate groups of your API's users");
+tenant.command("list").description("List tenants in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
+tenant.command("create").description("Create a tenant in your team").requiredOption("--name <display>", "Display name").option("--slug <tenant_name>", "Explicit tenant slug (generated if omitted)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
+tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
+tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
+tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
+var key = program.command("key").description("Create keys to manage your account from scripts or curl");
+key.command("list").description("List developer keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyList(opts)));
+key.command("mint").description("Mint a consumer-admin developer key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
+key.command("revoke").description("Revoke a developer key").argument("<keyId>", "Key id (see `key list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts) => runKeyRevoke(keyId, opts)));
+var spec = program.command("spec").description("View or update a proxy's OpenAPI spec (or build one by chatting: apiblaze agent openapi)");
+spec.command("get").description("Print the current OpenAPI document").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Compact JSON output").action(action((project, opts) => runSpecGet(project, opts)));
+spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
 program.addHelpText(
   "after",
   `
 Examples:
-  # No account needed \u2014 create an anonymous proxy, get a claim URL:
-  $ npx apiblaze create --target https://api.example.com
+  # Just talk to it \u2014 create, configure, inspect your APIs by chatting:
+  $ npx apiblaze agent
 
-  # Non-interactive (CI / scripts):
-  $ npx apiblaze create --target https://api.example.com --name myapi --json
-
-  # Sign in, then create under your team:
-  $ npx apiblaze login
-  $ npx apiblaze create --name myapi --target https://api.example.com --auth api_key
+  # Make an API in one line (no account needed; prints a claim URL):
+  $ npx apiblaze create --target https://api.example.com
 
-  # Dev tunnel \u2014 auto-creates a proxy if none point here, and captures
-  # traffic (full headers + body, secrets masked) until your server is up:
+  # Run your localhost through a public URL:
   $ npx apiblaze dev 3000
-  $ npx apiblaze dev 3000 --capture-file traffic.jsonl
 
-  # Manage:
-  $ npx apiblaze whoami
-  $ npx apiblaze projects
-  $ npx apiblaze team
-  $ npx apiblaze logout
+  # Or drive it yourself (add --verbose to see the equivalent API calls):
+  $ npx apiblaze target myapi --url https://api.example.com
+  $ npx apiblaze throttle myapi --rate 50
+  $ npx apiblaze domain add myapi --domain api.mysite.com
+  $ npx apiblaze delete myapi --verbose
 `
 );
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk15.default.red(`
+    console.error(import_chalk25.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk15.default.red(`
+    console.error(import_chalk25.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk15.default.red("\nUnknown error"));
+    console.error(import_chalk25.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.3.8",
+  "version": "0.4.1",
   "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
   "keywords": [
     "apiblaze",