apiblaze 0.4.1 → 0.4.2

package/README.md

@@ -53,7 +53,7 @@ apiblaze throttle myapi --rate 50 --verbose
 
 ## Commands
 
-### Chat (the easy way)
+### Chat
 
 | Command | What it does |
 |---|---|
@@ -64,19 +64,32 @@ apiblaze throttle myapi --rate 50 --verbose
 
 Every chat turn shows its cost.
 
-### Getting started
+### Setup
 
 | Command | What it does |
 |---|---|
 | `apiblaze create --target <url>` | Make an API from a backend (no account needed) |
 | `apiblaze dev [port]` | Put your localhost behind a public URL |
-| `apiblaze login` / `logout` | Sign in / out |
-| `apiblaze whoami` | Who am I, and which team |
+| `apiblaze login` / `logout` | Sign in / out (logout asks producer or consumer) |
+| `apiblaze whoami` | Who am I — both Producer and Consumer |
 | `apiblaze team [name]` | Switch team |
-| `apiblaze projects` | List your APIs |
 | `apiblaze claim [code]` | Claim an API you made before signing in |
 
-### Manage an API
+### Producer — your APIs
+
+| Command | What it does |
+|---|---|
+| `apiblaze projects` | List your APIs |
+| `apiblaze delete <project>` | Delete it and everything under it (asks first) |
+| `apiblaze domain add <project> --domain <host>` | Add your own domain (shows the DNS records to set) |
+| `apiblaze domain status / list / rm <project>` | Check / list / remove custom domains |
+| `apiblaze domain set-base <project> [--env <e>]` | Pick which version/env your main URL serves |
+| `apiblaze tenant create --name <name>` | Create a tenant (a separate group of your API's users) |
+| `apiblaze tenant attach <project> --tenant <slug>` | Give a proxy its own set of users |
+| `apiblaze tenant cors --tenant <slug> --origins <a,b>` | Set which websites can call it |
+| `apiblaze tenant list / delete <slug>` | List / delete tenants |
+
+### Producer — change a proxy's config
 
 | Command | What it does |
 |---|---|
@@ -85,30 +98,26 @@ Every chat turn shows its cost.
 | `apiblaze rename <project> --display-name <name>` | Rename it |
 | `apiblaze spec get <project>` | Print its OpenAPI spec |
 | `apiblaze spec set <project> --file <path>` | Replace its OpenAPI spec from a file |
-| `apiblaze delete <project>` | Delete it and everything under it (asks first) |
 
-### Your own domain
+> Every command in these two sections accepts `--verbose` (see the equivalent API
+> calls), plus `--team`, `--apiversion`, and `--json`.
 
-| Command | What it does |
-|---|---|
-| `apiblaze domain add <project> --domain <host>` | Add your domain (shows the DNS records to set) |
-| `apiblaze domain status <project> --id <id>` | Check if it's verified yet |
-| `apiblaze domain list <project>` / `rm <project> --id <id>` | List / remove |
-| `apiblaze domain set-base <project> [--env <e>]` | Pick which version/env your main URL serves |
+### Consumer — use an API
 
-### Users & keys
+Log in to one of your tenants' portals **as a consumer** — handy for testing auth
+and keys end-to-end. This is a separate identity from your producer login; `whoami`
+shows both, and `logout` asks which to drop.
 
 | Command | What it does |
 |---|---|
-| `apiblaze tenant create --name <name>` | Create a tenant (a separate group of your API's users) |
-| `apiblaze tenant attach <project> --tenant <slug>` | Give a proxy its own set of users |
-| `apiblaze tenant cors --tenant <slug> --origins <a,b>` | Set which websites can call it |
-| `apiblaze tenant list` / `delete <slug>` | List / delete |
-| `apiblaze key mint [--desc <text>]` | Make a key to manage your account from scripts |
-| `apiblaze key list` / `revoke <id>` | List / revoke |
-
-> See what any command does under the hood with `--verbose`. Most management
-> commands take `--team`, `--apiversion`, and `--json`.
+| `apiblaze consumer login` | Pick a tenant and log in to its portal (device flow in your browser) |
+| `apiblaze consumer tokens` | Show your consumer access / refresh / id tokens |
+| `apiblaze consumer apikeys` | List your API keys (reveals expiring ones in clear), then offer to create one |
+
+> A standalone consumer (no producer account) can log in with
+> `apiblaze consumer login --tenant <slug> --client <appClientId>`.
+>
+> Advanced: `apiblaze apikeys` manages producer control-plane keys for scripting.
 
 ## How it works
 

package/dist/index.js

@@ -8,9 +8,9 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key2 of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key2) && key2 !== except)
-        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
   return to;
 };
@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk26 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.4.1";
+var version = "0.4.2";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -105,9 +105,9 @@ async function createProxyAnonymous(body) {
   }
   return res.json();
 }
-async function apiFetch(path2, options = {}) {
+async function apiFetch(path3, options = {}) {
   const token = getAccessToken();
-  const url = `${DASHBOARD_BASE}${path2}`;
+  const url = `${DASHBOARD_BASE}${path3}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -132,12 +132,12 @@ async function apiFetch(path2, options = {}) {
   }
   return res.json();
 }
-async function agentCall(path2, method, body) {
+async function agentCall(path3, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path2, method, body })
+    body: JSON.stringify({ path: path3, method, body })
   });
   let data = null;
   try {
@@ -420,11 +420,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path2) {
-  const q = path2.indexOf("?");
-  if (q < 0) return path2;
-  const base = path2.slice(0, q);
-  const query = path2.slice(q + 1);
+function maskPath(path3) {
+  const q = path3.indexOf("?");
+  if (q < 0) return path3;
+  const base = path3.slice(0, q);
+  const query = path3.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -586,8 +586,8 @@ var STRIP_HEADERS = /* @__PURE__ */ new Set([
 ]);
 function stripHeaders(headers) {
   const out = {};
-  for (const key2 of Object.keys(headers)) {
-    if (!STRIP_HEADERS.has(key2.toLowerCase())) out[key2] = headers[key2];
+  for (const key of Object.keys(headers)) {
+    if (!STRIP_HEADERS.has(key.toLowerCase())) out[key] = headers[key];
   }
   return out;
 }
@@ -702,8 +702,8 @@ function startTunnelClient(opts) {
       const status = resp.status;
       const buf = Buffer.from(await resp.arrayBuffer());
       const headers = {};
-      resp.headers.forEach((value, key2) => {
-        if (!STRIP_HEADERS.has(key2.toLowerCase())) headers[key2] = value;
+      resp.headers.forEach((value, key) => {
+        if (!STRIP_HEADERS.has(key.toLowerCase())) headers[key] = value;
       });
       if (capturing) {
         capturing = false;
@@ -822,9 +822,9 @@ async function offerAutoCreate(teamId, port) {
     throw err;
   }
   if (auth === "api_key") {
-    const key2 = result.api_keys?.dev ?? Object.values(result.api_keys ?? {})[0];
-    if (key2) {
-      console.log(`  ${import_chalk4.default.dim("API key (dev):")} ${import_chalk4.default.bold.green(key2)}`);
+    const key = result.api_keys?.dev ?? Object.values(result.api_keys ?? {})[0];
+    if (key) {
+      console.log(`  ${import_chalk4.default.dim("API key (dev):")} ${import_chalk4.default.bold.green(key)}`);
       console.log(import_chalk4.default.dim("  Send it as the X-API-Key header. It may not be shown again."));
     }
   }
@@ -1452,51 +1452,204 @@ async function runClaim(claimCodeArg, opts) {
 
 // src/commands/logout.ts
 var import_chalk8 = __toESM(require("chalk"));
-async function runLogout() {
+
+// src/lib/consumer-auth.ts
+var fs4 = __toESM(require("fs"));
+var os2 = __toESM(require("os"));
+var path2 = __toESM(require("path"));
+var crypto = __toESM(require("crypto"));
+var import_child_process = require("child_process");
+var AUTH_BASE = process.env.APIBLAZE_AUTH_BASE || "https://auth.apiblaze.com";
+var APIBLAZE_DIR2 = path2.join(os2.homedir(), ".apiblaze");
+var CONSUMER_PATH = path2.join(APIBLAZE_DIR2, "consumer.json");
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function loadConsumer() {
+  try {
+    return JSON.parse(fs4.readFileSync(CONSUMER_PATH, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function saveConsumer(creds) {
+  fs4.mkdirSync(APIBLAZE_DIR2, { recursive: true });
+  fs4.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
+  fs4.chmodSync(CONSUMER_PATH, 384);
+}
+function clearConsumer() {
+  try {
+    fs4.unlinkSync(CONSUMER_PATH);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function pkce() {
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function decodeJwt2(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+  } catch {
+    return null;
+  }
+}
+function openBrowser2(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    (0, import_child_process.spawn)(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function deviceLogin(clientId, scope, onPrompt) {
+  const { verifier, challenge } = pkce();
+  const startRes = await fetch(`${AUTH_BASE}/device_authorization`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256" })
+  });
+  const start = await startRes.json().catch(() => ({}));
+  if (!startRes.ok) {
+    throw new Error(`device_authorization failed (${startRes.status}): ${start.error_description ?? start.error ?? startRes.statusText}`);
+  }
+  const deviceCode = String(start.device_code);
+  const userCode = String(start.user_code);
+  const verificationUri = String(start.verification_uri_complete ?? start.verification_uri);
+  const interval = Math.max(2, Number(start.interval) || 5);
+  const expiresIn = Number(start.expires_in) || 900;
+  onPrompt({ verificationUri, userCode });
+  openBrowser2(verificationUri);
+  const deadline = Date.now() + expiresIn * 1e3;
+  while (true) {
+    if (Date.now() > deadline) throw new Error("Login timed out. Run the command again.");
+    await new Promise((r) => setTimeout(r, interval * 1e3));
+    const tokRes = await fetch(`${AUTH_BASE}/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier })
+    });
+    const tok = await tokRes.json().catch(() => ({}));
+    if (tokRes.ok && tok.access_token) {
+      return {
+        accessToken: String(tok.access_token),
+        refreshToken: tok.refresh_token ? String(tok.refresh_token) : void 0,
+        idToken: tok.id_token ? String(tok.id_token) : void 0,
+        expiresIn: tok.expires_in ? Number(tok.expires_in) : void 0,
+        scope: tok.scope ? String(tok.scope) : void 0
+      };
+    }
+    if (tok.error === "authorization_pending" || tok.error === "slow_down") continue;
+    throw new Error(`Login failed: ${tok.error_description ?? tok.error ?? tokRes.statusText}`);
+  }
+}
+async function refreshConsumer(creds) {
+  if (!creds.refreshToken) return null;
+  const res = await fetch(`${AUTH_BASE}/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refresh_token: creds.refreshToken })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.access_token) return null;
+  const updated = {
+    ...creds,
+    accessToken: String(data.access_token),
+    refreshToken: data.refresh_token ? String(data.refresh_token) : creds.refreshToken,
+    idToken: data.id_token ? String(data.id_token) : creds.idToken,
+    expiresAt: Date.now() + (Number(data.expires_in) || 3600) * 1e3,
+    obtainedAt: Date.now()
+  };
+  saveConsumer(updated);
+  return updated;
+}
+async function validConsumerToken(creds) {
+  if (Date.now() < creds.expiresAt - 3e4) return creds;
+  return refreshConsumer(creds);
+}
+
+// src/commands/logout.ts
+async function runLogout(opts = {}) {
   const creds = loadCredentials();
-  const removed = clearCredentials();
-  if (!removed) {
+  const consumer2 = loadConsumer();
+  if (!creds && !consumer2) {
     console.log(import_chalk8.default.yellow("You were not logged in."));
     return;
   }
-  const who = creds?.githubHandle ?? creds?.email;
-  console.log(import_chalk8.default.green(`\u2714 Logged out${who ? ` (${who})` : ""}.`));
+  let target;
+  if (opts.all) target = "all";
+  else if (opts.producer) target = "producer";
+  else if (opts.consumer) target = "consumer";
+  else if (creds && !consumer2) target = "producer";
+  else if (consumer2 && !creds) target = "consumer";
+  else {
+    const { default: inquirer2 } = await import("inquirer");
+    const { chosen } = await inquirer2.prompt([
+      {
+        type: "list",
+        name: "chosen",
+        message: "Log out of which identity?",
+        choices: [
+          { name: `API Producer (${creds?.githubHandle ?? creds?.email ?? "producer"})`, value: "producer" },
+          { name: `API Consumer (${consumer2?.email ?? consumer2?.tenant})`, value: "consumer" },
+          { name: "Both", value: "all" }
+        ]
+      }
+    ]);
+    target = chosen;
+  }
+  if (target === "producer" || target === "all") {
+    clearCredentials();
+    console.log(import_chalk8.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
+  }
+  if (target === "consumer" || target === "all") {
+    clearConsumer();
+    console.log(import_chalk8.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
+  }
 }
 
 // src/commands/whoami.ts
 var import_chalk9 = __toESM(require("chalk"));
 async function runWhoami(opts = {}) {
   const creds = loadCredentials();
-  if (!creds) {
-    if (opts.json) {
-      console.log(JSON.stringify({ loggedIn: false }, null, 2));
-    } else {
-      console.log(import_chalk9.default.yellow("Not logged in. Run `apiblaze login` first."));
-    }
-    return;
-  }
-  const expired = Date.now() >= creds.expiresAt;
+  const consumer2 = loadConsumer();
   if (opts.json) {
     console.log(JSON.stringify({
-      loggedIn: true,
-      expired,
-      apiblazeUserId: creds.apiblazeUserId ?? null,
-      githubHandle: creds.githubHandle ?? null,
-      email: creds.email ?? null,
-      teamId: creds.teamId ?? null,
-      teamName: creds.teamName ?? null
+      producer: creds ? {
+        loggedIn: true,
+        expired: Date.now() >= creds.expiresAt,
+        apiblazeUserId: creds.apiblazeUserId ?? null,
+        githubHandle: creds.githubHandle ?? null,
+        email: creds.email ?? null,
+        teamId: creds.teamId ?? null,
+        teamName: creds.teamName ?? null
+      } : { loggedIn: false },
+      consumer: consumer2 ? { loggedIn: true, expired: Date.now() >= consumer2.expiresAt, tenant: consumer2.tenant, email: consumer2.email ?? null } : { loggedIn: false }
     }, null, 2));
     return;
   }
-  const who = creds.githubHandle ?? creds.email ?? creds.apiblazeUserId ?? "unknown";
-  console.log(`${import_chalk9.default.cyan("Signed in as")} ${import_chalk9.default.bold(who)}`);
-  if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
-  if (creds.apiblazeUserId) console.log(`  User ID: ${creds.apiblazeUserId}`);
-  if (creds.teamName || creds.teamId) {
-    console.log(`  Team:    ${import_chalk9.default.bold(creds.teamName ?? creds.teamId)}${creds.teamName && creds.teamId ? import_chalk9.default.gray(` (${creds.teamId})`) : ""}`);
-  }
-  if (expired) {
-    console.log(import_chalk9.default.yellow("\n\u26A0 Session expired. Run `apiblaze login` to re-authenticate."));
+  console.log(import_chalk9.default.bold("API Producer"));
+  if (!creds) {
+    console.log(import_chalk9.default.dim("  Not logged in. Run `apiblaze login`."));
+  } else {
+    const who = creds.githubHandle ?? creds.email ?? creds.apiblazeUserId ?? "unknown";
+    console.log(`  ${import_chalk9.default.cyan("Signed in as")} ${import_chalk9.default.bold(who)}`);
+    if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
+    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk9.default.bold(creds.teamName ?? creds.teamId)}`);
+    if (Date.now() >= creds.expiresAt) console.log(import_chalk9.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
+  }
+  console.log(import_chalk9.default.bold("\nAPI Consumer"));
+  if (!consumer2) {
+    console.log(import_chalk9.default.dim("  Not logged in. Run `apiblaze consumer login`."));
+  } else {
+    console.log(`  ${import_chalk9.default.cyan("Signed in as")} ${import_chalk9.default.bold(consumer2.email ?? consumer2.tenant)}`);
+    console.log(`  Tenant:  ${import_chalk9.default.bold(consumer2.tenant)}`);
+    if (Date.now() >= consumer2.expiresAt) console.log(import_chalk9.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
   }
 }
 
@@ -2283,6 +2436,19 @@ async function runTenantCors(opts) {
 // src/commands/key.ts
 var import_chalk22 = __toESM(require("chalk"));
 var import_ora9 = __toESM(require("ora"));
+async function runApikeysMenu(opts) {
+  await runKeyList(opts);
+  if (opts.json) return;
+  const { default: inquirer2 } = await import("inquirer");
+  const { make } = await inquirer2.prompt([
+    { type: "confirm", name: "make", message: "Generate a new control-plane API key?", default: false }
+  ]);
+  if (!make) return;
+  const { desc } = await inquirer2.prompt([
+    { type: "input", name: "desc", message: "Description (optional):" }
+  ]);
+  await runKeyMint({ ...opts, desc: desc || void 0 });
+}
 async function runKeyList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
   const out = await admin({
@@ -2346,7 +2512,7 @@ async function runKeyRevoke(keyId, opts) {
 }
 
 // src/commands/spec.ts
-var fs4 = __toESM(require("fs"));
+var fs5 = __toESM(require("fs"));
 var import_chalk23 = __toESM(require("chalk"));
 var import_ora10 = __toESM(require("ora"));
 async function runSpecGet(project, opts) {
@@ -2366,7 +2532,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs4.readFileSync(opts.file, "utf-8");
+    specContent = fs5.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk23.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -2398,6 +2564,12 @@ async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
 var TOOLS = [
+  {
+    name: "create_proxy",
+    description: "Create a new API proxy (project) from a backend URL. auth is one of: api_key, none, oauth.",
+    params: { name: "proxy name (becomes its subdomain)", target: "backend URL to forward to", auth: "api_key | none | oauth (default api_key)" },
+    run: async (a, { teamId }) => createProxy({ name: a.name, target_url: a.target ?? a.target_url ?? a.url, auth_type: a.auth ?? a.auth_type ?? "api_key", team_id: teamId })
+  },
   {
     name: "list_projects",
     description: "List the proxies (projects) in the active team.",
@@ -2604,6 +2776,175 @@ async function runAgent(opts) {
   console.log(import_chalk24.default.dim("\nBye."));
 }
 
+// src/commands/consumer.ts
+var import_chalk25 = __toESM(require("chalk"));
+var import_ora12 = __toESM(require("ora"));
+var APIKEYS_VER = "1.0.0";
+var DEFAULT_SCOPE = "openid email profile offline_access";
+function apikeysBase(tenant2) {
+  const tmpl = process.env.APIBLAZE_APIKEYS_BASE_TMPL;
+  return tmpl ? tmpl.replace("{tenant}", tenant2) : `https://${tenant2}.apikeys.apiblaze.com`;
+}
+async function consumerFetch(creds, suffix, init) {
+  const fresh = await validConsumerToken(creds) ?? creds;
+  const res = await fetch(`${apikeysBase(fresh.tenant)}/${APIKEYS_VER}${suffix}`, {
+    ...init,
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${fresh.accessToken}`, ...init?.headers ?? {} }
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  return { status: res.status, data, creds: fresh };
+}
+function requireConsumer() {
+  const c = loadConsumer();
+  if (!c) {
+    console.error(import_chalk25.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    process.exit(1);
+  }
+  return c;
+}
+async function runConsumerLogin(opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  let tenant2 = opts.tenant;
+  let clientId = opts.client;
+  if (clientId) {
+    if (!tenant2) {
+      console.error(import_chalk25.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      process.exit(1);
+    }
+  } else {
+    requireAuth();
+    const { teamId, teamName } = await resolveTeam(opts.team);
+    const spinner = (0, import_ora12.default)("Loading your tenants...").start();
+    const tdata = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1`, summary: `List tenants for ${teamName ?? teamId}` });
+    spinner.stop();
+    const tenants = (tdata?.tenants ?? []).map(
+      (t) => typeof t === "string" ? { tenant_name: t } : t
+    );
+    if (!tenants.length) {
+      console.error(import_chalk25.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      process.exit(1);
+    }
+    if (!tenant2) {
+      if (tenants.length === 1) tenant2 = tenants[0].tenant_name;
+      else {
+        const { chosen } = await inquirer2.prompt([{ type: "list", name: "chosen", message: "Which tenant portal?", choices: tenants.map((t) => ({ name: t.display_name ? `${t.display_name} (${t.tenant_name})` : t.tenant_name, value: t.tenant_name })) }]);
+        tenant2 = chosen;
+      }
+    }
+    const s2 = (0, import_ora12.default)("Finding the login app...").start();
+    const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
+    s2.stop();
+    const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
+    const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
+    if (!pick2) {
+      console.error(import_chalk25.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      process.exit(1);
+    }
+    clientId = pick2.client_id ?? pick2.clientId;
+  }
+  console.log(`${import_chalk25.default.cyan("\u2192")} Logging in to ${import_chalk25.default.bold(tenant2)} as a consumer...`);
+  const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
+    console.log(`
+  Open: ${import_chalk25.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk25.default.bold(userCode)}
+`);
+    console.log(import_chalk25.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+  });
+  const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
+  const creds = {
+    tenant: tenant2,
+    clientId,
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    idToken: result.idToken,
+    expiresAt: Date.now() + (result.expiresIn ?? 3600) * 1e3,
+    scope: result.scope,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    obtainedAt: Date.now()
+  };
+  saveConsumer(creds);
+  console.log(import_chalk25.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+}
+async function runConsumerTokens(opts) {
+  const creds = requireConsumer();
+  const fresh = await validConsumerToken(creds) ?? creds;
+  const exp = (t) => {
+    const p = t ? decodeJwt2(t) : null;
+    return p && typeof p.exp === "number" ? new Date(p.exp * 1e3).toISOString() : void 0;
+  };
+  if (opts.json) {
+    console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
+    return;
+  }
+  console.log(`${import_chalk25.default.cyan("Consumer")} ${import_chalk25.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk25.default.bold(fresh.tenant)}
+`);
+  console.log(`${import_chalk25.default.bold("access_token")}  ${import_chalk25.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  ${fresh.accessToken}
+`);
+  if (fresh.idToken) console.log(`${import_chalk25.default.bold("id_token")}      ${import_chalk25.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  ${fresh.idToken}
+`);
+  if (fresh.refreshToken) console.log(`${import_chalk25.default.bold("refresh_token")}
+  ${fresh.refreshToken}
+`);
+  console.log(import_chalk25.default.dim("These are your own tokens \u2014 keep them secret."));
+}
+async function runConsumerApikeys(opts) {
+  const creds = requireConsumer();
+  const { default: inquirer2 } = await import("inquirer");
+  const spinner = (0, import_ora12.default)("Loading your API keys...").start();
+  const list = await consumerFetch(creds, "/apikeys");
+  const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
+  spinner.stop();
+  if (list.status >= 400) {
+    console.error(import_chalk25.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk25.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    process.exit(1);
+  }
+  const keys = list.data?.keys ?? [];
+  const revealMap = revealed.data?.keys ?? {};
+  if (opts.json) {
+    console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
+  } else if (!keys.length) {
+    console.log(import_chalk25.default.yellow("No API keys yet."));
+  } else {
+    for (const k of keys) {
+      const clear = revealMap[k.environment]?.key;
+      const shown = clear ? import_chalk25.default.green(clear) : import_chalk25.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk25.default.dim(`exp ${k.expires_at}`) : import_chalk25.default.dim("no expiry");
+      console.log(`  ${import_chalk25.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk25.default.dim(k.description ?? "")}`);
+    }
+    if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
+      console.log(import_chalk25.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+    }
+  }
+  if (opts.json) return;
+  const { make } = await inquirer2.prompt([{ type: "confirm", name: "make", message: "Create a new API key?", default: false }]);
+  if (!make) return;
+  const answers = await inquirer2.prompt([
+    { type: "input", name: "environment", message: "Environment:", default: "production" },
+    { type: "input", name: "description", message: "Description (optional):" },
+    { type: "input", name: "expiresDays", message: "Expires in how many days? (blank = no expiry):" }
+  ]);
+  const body = { environment: answers.environment };
+  if (answers.description) body.description = answers.description;
+  if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
+  const s2 = (0, import_ora12.default)("Creating key...").start();
+  const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
+  if (created.status >= 400) {
+    s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
+    return;
+  }
+  s2.succeed("Key created.");
+  const key = created.data?.key ?? created.data?.fullKey;
+  if (key) console.log(`  ${import_chalk25.default.green(key)}  ${import_chalk25.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk25.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+}
+
 // src/index.ts
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
@@ -2645,7 +2986,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk25.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk26.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -2654,15 +2995,12 @@ program.command("dev").description("Put your localhost behind a public URL (dev
     process.exit(1);
   }
 });
-program.command("logout").description("Sign out \u2014 remove stored credentials from this machine").action(async () => {
-  try {
-    await runLogout();
-  } catch (err) {
-    printError(err);
-    process.exit(1);
-  }
-});
-program.command("whoami").description("Show the signed-in identity and active team").option("--json", "Output machine-readable JSON").action(async (opts) => {
+var consumer = program.command("consumer").description("Act as a consumer of your API \u2014 log in, get tokens, manage API keys");
+consumer.command("login").description("Log in to a tenant's portal as a consumer (device flow)").option("--team <id|name>", "Team whose tenants to choose from (producer mode)").option("--tenant <slug>", "Tenant to log in to (skips the picker)").option("--client <clientId>", "App client id \u2014 for standalone login without a producer session").action(action((opts) => runConsumerLogin(opts)));
+consumer.command("tokens").description("Show the logged-in consumer access / refresh / id tokens").option("--json", "Output machine-readable JSON").action(action((opts) => runConsumerTokens(opts)));
+consumer.command("apikeys").description("List your consumer API keys (reveals expiring ones), then offer to create one").option("--json", "Output machine-readable JSON").action(action((opts) => runConsumerApikeys(opts)));
+program.command("logout").description("Sign out (asks whether to drop the Producer or Consumer login)").option("--producer", "Log out of the API Producer identity").option("--consumer", "Log out of the API Consumer identity").option("--all", "Log out of both").action(action((opts) => runLogout(opts)));
+program.command("whoami").description("Show who you are \u2014 both API Producer and API Consumer").option("--json", "Output machine-readable JSON").action(async (opts) => {
   try {
     await runWhoami(opts);
   } catch (err) {
@@ -2710,42 +3048,62 @@ tenant.command("create").description("Create a tenant in your team").requiredOpt
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
-var key = program.command("key").description("Create keys to manage your account from scripts or curl");
-key.command("list").description("List developer keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyList(opts)));
-key.command("mint").description("Mint a consumer-admin developer key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
-key.command("revoke").description("Revoke a developer key").argument("<keyId>", "Key id (see `key list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts) => runKeyRevoke(keyId, opts)));
+var apikeys = new import_commander.Command("apikeys").description("Producer control-plane API keys (list, then offer to create one)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
+apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyList(opts)));
+apikeys.command("mint").description("Create a control-plane API key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
+apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts) => runKeyRevoke(keyId, opts)));
+program.addCommand(apikeys, { hidden: true });
 var spec = program.command("spec").description("View or update a proxy's OpenAPI spec (or build one by chatting: apiblaze agent openapi)");
 spec.command("get").description("Print the current OpenAPI document").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Compact JSON output").action(action((project, opts) => runSpecGet(project, opts)));
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
-program.addHelpText(
-  "after",
-  `
-Examples:
-  # Just talk to it \u2014 create, configure, inspect your APIs by chatting:
-  $ npx apiblaze agent
-
-  # Make an API in one line (no account needed; prints a claim URL):
-  $ npx apiblaze create --target https://api.example.com
+var HELP_GROUPS = [
+  { title: "Chat", commands: ["agent"] },
+  { title: "Setup", commands: ["login", "create", "dev", "claim", "team", "whoami", "logout"] },
+  { title: "Producer \xB7 your APIs", commands: ["projects", "tenant", "domain", "delete"] },
+  { title: "Producer \xB7 change a proxy", commands: ["target", "throttle", "rename", "spec"] },
+  { title: "Consumer \xB7 use an API", commands: ["consumer"] }
+];
+function groupedCommandHelp() {
+  const byName = new Map(program.commands.map((c) => [c.name(), c]));
+  const width = Math.max(...HELP_GROUPS.flatMap((g) => g.commands).map((n) => n.length)) + 2;
+  return HELP_GROUPS.map((g) => {
+    const rows = g.commands.map((n) => {
+      const c = byName.get(n);
+      return c ? `  ${n.padEnd(width)}${c.description()}` : "";
+    }).filter(Boolean).join("\n");
+    return `${import_chalk26.default.bold(g.title)}
+${rows}`;
+  }).join("\n\n");
+}
+program.configureHelp({
+  visibleCommands(cmd) {
+    const all = import_commander.Help.prototype.visibleCommands.call(this, cmd);
+    return cmd === program ? [] : all;
+  }
+});
+program.addHelpText("after", () => `
+${groupedCommandHelp()}
 
-  # Run your localhost through a public URL:
-  $ npx apiblaze dev 3000
+Tips:
+  \u2022 Add --verbose to any command to see the equivalent API calls.
+  \u2022 Run \`apiblaze <command> --help\` (e.g. \`apiblaze consumer --help\`) for sub-commands.
 
-  # Or drive it yourself (add --verbose to see the equivalent API calls):
-  $ npx apiblaze target myapi --url https://api.example.com
-  $ npx apiblaze throttle myapi --rate 50
-  $ npx apiblaze domain add myapi --domain api.mysite.com
-  $ npx apiblaze delete myapi --verbose
-`
-);
+Examples:
+  $ npx apiblaze agent                                   # just chat
+  $ npx apiblaze create --target https://api.example.com # one-line API
+  $ npx apiblaze dev 3000                                # localhost \u2192 public URL
+  $ npx apiblaze throttle myapi --rate 50 --verbose      # configure + show the API call
+  $ npx apiblaze consumer login                          # act as a consumer of your API
+`);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk25.default.red(`
+    console.error(import_chalk26.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk25.default.red(`
+    console.error(import_chalk26.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk25.default.red("\nUnknown error"));
+    console.error(import_chalk26.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
   "keywords": [
     "apiblaze",