apiblaze 0.4.15 → 0.6.0

package/README.md

@@ -69,6 +69,7 @@ Every chat turn shows its cost.
 | Command | What it does |
 |---|---|
 | `apiblaze create --target <url>` | Make an API from a backend (no account needed) |
+| `apiblaze sidecar` | Route a Next.js app's external `fetch()` calls through APIblaze (one command) |
 | `apiblaze dev [port]` | Put your localhost behind a public URL |
 | `apiblaze login` / `logout` | Sign in / out (logout asks producer or consumer) |
 | `apiblaze whoami` | Who am I — both Producer and Consumer |
@@ -130,7 +131,37 @@ shows both, and `logout` asks which to drop.
 
 On Ctrl+C the tunnel is cleanly deregistered.
 
-### Zero-setup conveniences
+## Sidecar — proxy a Next.js app's egress
+
+`apiblaze sidecar` wires your Next.js backend so its outbound `fetch()` calls
+transparently route through APIblaze. Each distinct upstream origin (Stripe, an
+internal API, anything) lazily becomes a first-class APIblaze proxy on first use
+— so you get identity, rate-limits, quotas, and audit wrapped around APIs that
+have none of it, with no per-call changes.
+
+```bash
+cd my-next-app
+npx apiblaze sidecar     # logs you in, mints a scoped key, wires it up
+npm install apiblaze
+npm run dev              # then open http://localhost:3000/abz-inspector
+```
+
+The command mints a **scoped data-plane key** (create/use proxies for one team,
+nothing else) into gitignored `.env.local` as `APIBLAZE_TOKEN` + `APIBLAZE_TENANT`.
+Your control-plane login stays in `~/.apiblaze` and never enters the project. It
+also writes `instrumentation.ts`:
+
+```ts
+import { register as apiblaze } from "apiblaze/sidecar";
+export function register() { apiblaze(); }
+```
+
+The interceptor is stateless and fail-open: if it can't reach APIblaze it falls
+back to a direct fetch, so it never breaks your app. External HTTPS origins are
+intercepted; same-origin, localhost/private, and known analytics/CDN noise are
+left alone.
+
+## How it works
 
 - **No project yet?** If none of your projects point at this machine, `apiblaze dev`
   offers to spin up a throwaway dev proxy (random name like `braveotter42`) pointed at

package/dist/index.js

@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk28 = __toESM(require("chalk"));
+var import_chalk30 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.4.15";
+var version = "0.6.0";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -105,9 +105,9 @@ async function createProxyAnonymous(body) {
   }
   return res.json();
 }
-async function apiFetch(path3, options = {}) {
+async function apiFetch(path4, options = {}) {
   const token = getAccessToken();
-  const url = `${DASHBOARD_BASE}${path3}`;
+  const url = `${DASHBOARD_BASE}${path4}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -132,12 +132,12 @@ async function apiFetch(path3, options = {}) {
   }
   return res.json();
 }
-async function agentCall(path3, method, body) {
+async function agentCall(path4, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path3, method, body })
+    body: JSON.stringify({ path: path4, method, body })
   });
   let data = null;
   try {
@@ -420,11 +420,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path3) {
-  const q = path3.indexOf("?");
-  if (q < 0) return path3;
-  const base = path3.slice(0, q);
-  const query = path3.slice(q + 1);
+function maskPath(path4) {
+  const q = path4.indexOf("?");
+  if (q < 0) return path4;
+  const base = path4.slice(0, q);
+  const query = path4.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -2485,15 +2485,15 @@ async function runTenantCors(opts) {
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-  const cors = origins.length ? { allowed_origins: origins } : null;
+  const origins2 = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const cors = origins2.length ? { allowed_origins: origins2 } : null;
   const spinner = (0, import_ora8.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
       path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(opts.tenant)}/cors`,
       body: { cors },
-      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins.length ? origins.join(", ") : "(cleared)"}`
+      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins2.length ? origins2.join(", ") : "(cleared)"}`
     });
     spinner.succeed(`CORS updated for ${opts.tenant}.`);
   } catch (err) {
@@ -3037,6 +3037,227 @@ async function runConsumerApikeys(opts) {
   else console.log(import_chalk27.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
+// src/commands/sidecar.ts
+var import_chalk28 = __toESM(require("chalk"));
+var import_ora13 = __toESM(require("ora"));
+var fs6 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+function detectNextProject(root) {
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs6.existsSync(path3.join(root, f)));
+  let hasDep = false;
+  try {
+    const pkg = JSON.parse(fs6.readFileSync(path3.join(root, "package.json"), "utf8"));
+    hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
+  } catch {
+  }
+  const appDir = fs6.existsSync(path3.join(root, "app")) || fs6.existsSync(path3.join(root, "src", "app"));
+  const pagesDir = fs6.existsSync(path3.join(root, "pages")) || fs6.existsSync(path3.join(root, "src", "pages"));
+  return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
+}
+function upsertEnvLocal(root, token) {
+  const p = path3.join(root, ".env.local");
+  let existing = "";
+  try {
+    existing = fs6.readFileSync(p, "utf8");
+  } catch {
+  }
+  const had = /^APIBLAZE_TOKEN=/m.test(existing);
+  const next = had ? existing.replace(/^APIBLAZE_TOKEN=.*$/m, `APIBLAZE_TOKEN=${token}`) : (existing && !existing.endsWith("\n") ? existing + "\n" : existing) + `APIBLAZE_TOKEN=${token}
+`;
+  fs6.writeFileSync(p, next);
+  return had ? "rotated" : "created";
+}
+function ensureGitignored(root) {
+  const p = path3.join(root, ".gitignore");
+  let c = "";
+  try {
+    c = fs6.readFileSync(p, "utf8");
+  } catch {
+  }
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs6.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+}
+function wireInstrumentation(root) {
+  const existing = ["instrumentation.ts", "instrumentation.js", path3.join("src", "instrumentation.ts")].map((c) => path3.join(root, c)).find((f) => fs6.existsSync(f));
+  const body = `import { register as apiblaze } from "apiblaze/sidecar";
+
+export function register() {
+  apiblaze();
+}
+`;
+  if (!existing) {
+    fs6.writeFileSync(path3.join(root, "instrumentation.ts"), body);
+    return "created";
+  }
+  const cur = fs6.readFileSync(existing, "utf8");
+  if (cur.includes("apiblaze/sidecar")) return "present";
+  if (/export\s+function\s+register\s*\(/.test(cur)) {
+    fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
+  apiblaze();`));
+    return "patched";
+  }
+  fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+${cur}
+// call apiblaze() inside your register() export.
+`);
+  return "patched";
+}
+var INSPECTOR_PAGE = `// AUTO-GENERATED by \`apiblaze init\` \u2014 dev-only. Safe to delete (rm this folder).
+// Proves the observe\u2192approve model: an approved origin routes + keeps its auth;
+// an un-approved origin goes direct and shows up as a candidate to approve.
+export const dynamic = "force-dynamic";
+
+async function probe(u: string) {
+  try {
+    const res = await fetch(u, { headers: { "x-api-key": "demo-secret-value" }, cache: "no-store" });
+    return { url: u, status: res.status, echo: await res.json().catch(() => ({})) };
+  } catch (e: any) { return { url: u, error: e?.message ?? String(e) }; }
+}
+
+export default async function Page() {
+  if (process.env.NODE_ENV === "production") return <main style={{padding:24}}>Inspector disabled in production.</main>;
+  const r = await probe("https://httpbingo.org/headers");
+  return (
+    <main style={{ fontFamily: "ui-monospace, monospace", padding: 24, lineHeight: 1.6 }}>
+      <h1>APIblaze sidecar inspector</h1>
+      <p>Fetched httpbingo through the interceptor. If httpbingo.org is <b>not yet approved</b>, this went
+         <b> direct</b> and now appears as a candidate in your dashboard \u2014 approve it, wait ~5 min, reload,
+         and it will route through APIblaze (the echo below will show it arrived via your proxy).</p>
+      <pre>{JSON.stringify(r, null, 2)}</pre>
+      <p style={{opacity:.6}}>Delete this folder before shipping.</p>
+    </main>
+  );
+}
+`;
+function generateInspector(root, router) {
+  try {
+    if (router === "pages") {
+      const dir2 = fs6.existsSync(path3.join(root, "src", "pages")) ? path3.join(root, "src", "pages") : path3.join(root, "pages");
+      const f2 = path3.join(dir2, "abz-inspector.tsx");
+      fs6.writeFileSync(f2, INSPECTOR_PAGE);
+      return path3.relative(root, f2);
+    }
+    const base = fs6.existsSync(path3.join(root, "src", "app")) ? path3.join(root, "src", "app") : path3.join(root, "app");
+    const dir = path3.join(base, "abz-inspector");
+    fs6.mkdirSync(dir, { recursive: true });
+    const f = path3.join(dir, "page.tsx");
+    fs6.writeFileSync(f, INSPECTOR_PAGE);
+    return path3.relative(root, f);
+  } catch {
+    return null;
+  }
+}
+async function runSidecar(opts) {
+  const root = path3.resolve(opts.dir ?? process.cwd());
+  if (!loadCredentials()) {
+    console.log(import_chalk28.default.dim("Not logged in \u2014 starting APIblaze login..."));
+    await runLogin();
+  }
+  const detected = detectNextProject(root);
+  if (!detected.found) {
+    console.log(import_chalk28.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
+    return;
+  }
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora13.default)("Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+  let token;
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/sidecar/setup`,
+      summary: `Set up sidecar for team ${teamName ?? teamId}`
+    });
+    token = out.token;
+    spinner.succeed("Sidecar ready.");
+  } catch (err) {
+    spinner.fail("Setup failed.");
+    throw err;
+  }
+  const envState = upsertEnvLocal(root, token);
+  ensureGitignored(root);
+  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_TOKEN) \u2014 gitignored`);
+  const wireState = wireInstrumentation(root);
+  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  let inspectorPath = null;
+  if (!opts.noInspector) {
+    inspectorPath = generateInspector(root, detected.router);
+    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}`);
+  }
+  console.log("");
+  console.log(import_chalk28.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk28.default.cyan("npm install apiblaze")}`);
+  console.log(`  2. ${import_chalk28.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  3. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze origins")}`);
+  console.log(`  4. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path3.dirname(inspectorPath)} before shipping)`);
+  console.log("");
+  console.log(import_chalk28.default.yellow("  \u26A0 APIBLAZE_TOKEN is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk28.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+}
+
+// src/commands/origins.ts
+var import_chalk29 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
+async function runOriginsList(opts) {
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/sidecar/candidates`,
+    summary: `List sidecar origins for team ${teamName ?? teamId}`
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  const routed = out.routed ?? [];
+  const candidates = out.candidates ?? [];
+  console.log(import_chalk29.default.bold(`
+Routed through APIblaze (${routed.length})`));
+  if (!routed.length) console.log(import_chalk29.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk29.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk29.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk29.default.bold(`
+Candidates \u2014 going direct, not yet approved (${candidates.length})`));
+  if (!candidates.length) console.log(import_chalk29.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  for (const c of candidates) {
+    console.log(`  ${import_chalk29.default.yellow("\u25CB")} ${c.origin}  ${import_chalk29.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+  }
+  if (candidates.length) {
+    console.log(import_chalk29.default.dim(`
+  Approve:  apiblaze origins approve ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk29.default.dim(`  Dismiss:  apiblaze origins deny ${candidates[0].origin.replace("https://", "")}`));
+  }
+}
+async function runOriginsApprove(origin, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora14.default)(`Approving ${origin}...`).start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/sidecar/approve`,
+      body: { origin },
+      summary: `Approve sidecar origin ${origin}`
+    });
+    spinner.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Your app will route it within ~5 min.`);
+    if (opts.json) console.log(JSON.stringify(out));
+  } catch (err) {
+    spinner.fail("Approve failed.");
+    throw err;
+  }
+}
+async function runOriginsDeny(origin, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora14.default)(`Dismissing ${origin}...`).start();
+  try {
+    await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
+    spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
+  } catch (err) {
+    spinner.fail("Dismiss failed.");
+    throw err;
+  }
+}
+
 // src/index.ts
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
@@ -3076,11 +3297,15 @@ var agent = program.command("agent").description("Chat with an assistant that bu
 agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
+program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false })));
+var origins = program.command("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
+origins.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
+origins.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
 program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk28.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk30.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -3153,7 +3378,7 @@ spec.command("get").description("Print the current OpenAPI document").argument("
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
 var HELP_GROUPS = [
   { title: "Chat", commands: ["agent"] },
-  { title: "Setup", commands: ["login", "create", "dev", "claim", "team", "whoami", "logout"] },
+  { title: "Setup", commands: ["login", "create", "init", "origins", "dev", "claim", "team", "whoami", "logout"] },
   { title: "Control plane commands", commands: ["projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
@@ -3173,7 +3398,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk28.default.bold(g.title)}
+    return `${import_chalk30.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -3199,13 +3424,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk28.default.red(`
+    console.error(import_chalk30.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk28.default.red(`
+    console.error(import_chalk30.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk28.default.red("\nUnknown error"));
+    console.error(import_chalk30.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/dist/sidecar/index.d.mts

@@ -0,0 +1,28 @@
+/**
+ * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
+ *
+ *   // instrumentation.ts
+ *   import { register as apiblaze } from "apiblaze/sidecar";
+ *   export function register() { apiblaze(); }
+ *
+ * At boot it loads the team's APPROVED origins (GET sidecar.abz.run/routes) into
+ * an in-memory map. Per request: if the origin is approved it routes through that
+ * origin's proxy (carrying the call's own auth); otherwise it goes DIRECT,
+ * untouched, and reports the origin once as a candidate. Reads only APIBLAZE_TOKEN.
+ * Fail-open: any error → direct. Never breaks the app.
+ */
+interface SidecarOptions {
+    token?: string;
+    exclude?: string[];
+    include?: string[];
+    quiet?: boolean;
+}
+declare function register(opts?: SidecarOptions): void;
+declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;
+declare const _default: {
+    register: typeof register;
+    withApiblaze: typeof withApiblaze;
+};
+
+export { type SidecarOptions, _default as default, register, withApiblaze };

package/dist/sidecar/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
+ *
+ *   // instrumentation.ts
+ *   import { register as apiblaze } from "apiblaze/sidecar";
+ *   export function register() { apiblaze(); }
+ *
+ * At boot it loads the team's APPROVED origins (GET sidecar.abz.run/routes) into
+ * an in-memory map. Per request: if the origin is approved it routes through that
+ * origin's proxy (carrying the call's own auth); otherwise it goes DIRECT,
+ * untouched, and reports the origin once as a candidate. Reads only APIBLAZE_TOKEN.
+ * Fail-open: any error → direct. Never breaks the app.
+ */
+interface SidecarOptions {
+    token?: string;
+    exclude?: string[];
+    include?: string[];
+    quiet?: boolean;
+}
+declare function register(opts?: SidecarOptions): void;
+declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;
+declare const _default: {
+    register: typeof register;
+    withApiblaze: typeof withApiblaze;
+};
+
+export { type SidecarOptions, _default as default, register, withApiblaze };

package/dist/sidecar/index.js

@@ -0,0 +1,179 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/sidecar/index.ts
+var sidecar_exports = {};
+__export(sidecar_exports, {
+  default: () => sidecar_default,
+  register: () => register,
+  withApiblaze: () => withApiblaze
+});
+module.exports = __toCommonJS(sidecar_exports);
+var SIDECAR_HOST = "https://sidecar.abz.run";
+var REFRESH_MS = 5 * 60 * 1e3;
+var NOISE_DENYLIST = [
+  "google-analytics.com",
+  "googletagmanager.com",
+  "segment.io",
+  "sentry.io",
+  "ingest.sentry.io",
+  "posthog.com",
+  "mixpanel.com",
+  "amplitude.com",
+  "datadoghq.com",
+  "newrelic.com",
+  "nr-data.net",
+  "launchdarkly.com",
+  "statsigapi.net",
+  "plausible.io",
+  "avatars.githubusercontent.com",
+  "gravatar.com",
+  "googleusercontent.com",
+  "cloudfront.net",
+  "akamaihd.net",
+  "fastly.net",
+  "imgix.net",
+  "cloudinary.com",
+  "registry.npmjs.org",
+  "pypi.org"
+];
+var installed = false;
+function canonicalOrigin(input) {
+  try {
+    const u = new URL(input);
+    if (u.protocol !== "https:") return null;
+    const port = u.port && u.port !== "443" ? `:${u.port}` : "";
+    return `https://${u.hostname.toLowerCase()}${port}`;
+  } catch {
+    return null;
+  }
+}
+function hostMatchesGlob(host, glob) {
+  const g = glob.toLowerCase();
+  if (g.startsWith("*.")) {
+    const b = g.slice(2);
+    return host === b || host.endsWith(`.${b}`);
+  }
+  return host === g;
+}
+function isNoise(host) {
+  return NOISE_DENYLIST.some((d) => host === d || host.endsWith(`.${d}`));
+}
+function isPrivateOrLocal(host) {
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
+  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
+  return false;
+}
+function register(opts) {
+  if (installed) return;
+  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  if (!token) {
+    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    return;
+  }
+  const original = globalThis.fetch;
+  if (typeof original !== "function") return;
+  const exclude = opts?.exclude ?? [];
+  const include = opts?.include ?? [];
+  let routes = {};
+  const seen = /* @__PURE__ */ new Set();
+  const refresh = async () => {
+    try {
+      const res = await original(`${SIDECAR_HOST}/routes`, { headers: { "x-api-key": token }, cache: "no-store" });
+      if (res.ok) routes = await res.json();
+    } catch {
+    }
+  };
+  void refresh();
+  const timer = setInterval(refresh, REFRESH_MS);
+  if (typeof timer?.unref === "function") timer.unref();
+  const reportObserved = (origin) => {
+    original(`${SIDECAR_HOST}/observed`, {
+      method: "POST",
+      headers: { "x-api-key": token, "content-type": "application/json" },
+      body: JSON.stringify({ origin })
+    }).catch(() => {
+    });
+  };
+  const shouldConsider = (url) => {
+    if (url.protocol !== "https:") return false;
+    const host = url.hostname.toLowerCase();
+    if (host.endsWith("abz.run") || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
+    if (isPrivateOrLocal(host) || isNoise(host)) return false;
+    if (exclude.some((g) => hostMatchesGlob(host, g))) return false;
+    if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
+    return true;
+  };
+  const wrapped = async (input, init) => {
+    try {
+      const req = new Request(input, init);
+      const url = new URL(req.url);
+      if (shouldConsider(url)) {
+        const origin = canonicalOrigin(url.origin);
+        if (origin) {
+          const base = routes[origin];
+          if (base) {
+            if (!seen.has(origin)) {
+              seen.add(origin);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+            }
+            const headers = new Headers(req.headers);
+            const appKey = headers.get("x-api-key");
+            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+            headers.set("x-api-key", token);
+            const target = `${base}${url.pathname}${url.search}`;
+            return original(target, {
+              method: req.method,
+              headers,
+              body: req.body,
+              redirect: "manual",
+              duplex: req.body ? "half" : void 0
+              // streaming request bodies
+            });
+          }
+          if (!seen.has(origin)) {
+            seen.add(origin);
+            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
+            reportObserved(origin);
+          }
+        }
+      }
+    } catch (err) {
+      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
+    }
+    return original(input, init);
+  };
+  wrapped.__apiblaze = true;
+  globalThis.fetch = wrapped;
+  installed = true;
+  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
+}
+function withApiblaze(nextConfig = {}) {
+  register();
+  const experimental = { ...nextConfig.experimental };
+  if (experimental.instrumentationHook === void 0) experimental.instrumentationHook = true;
+  return { ...nextConfig, experimental };
+}
+var sidecar_default = { register, withApiblaze };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register,
+  withApiblaze
+});

package/dist/sidecar/index.mjs

@@ -0,0 +1,153 @@
+// src/sidecar/index.ts
+var SIDECAR_HOST = "https://sidecar.abz.run";
+var REFRESH_MS = 5 * 60 * 1e3;
+var NOISE_DENYLIST = [
+  "google-analytics.com",
+  "googletagmanager.com",
+  "segment.io",
+  "sentry.io",
+  "ingest.sentry.io",
+  "posthog.com",
+  "mixpanel.com",
+  "amplitude.com",
+  "datadoghq.com",
+  "newrelic.com",
+  "nr-data.net",
+  "launchdarkly.com",
+  "statsigapi.net",
+  "plausible.io",
+  "avatars.githubusercontent.com",
+  "gravatar.com",
+  "googleusercontent.com",
+  "cloudfront.net",
+  "akamaihd.net",
+  "fastly.net",
+  "imgix.net",
+  "cloudinary.com",
+  "registry.npmjs.org",
+  "pypi.org"
+];
+var installed = false;
+function canonicalOrigin(input) {
+  try {
+    const u = new URL(input);
+    if (u.protocol !== "https:") return null;
+    const port = u.port && u.port !== "443" ? `:${u.port}` : "";
+    return `https://${u.hostname.toLowerCase()}${port}`;
+  } catch {
+    return null;
+  }
+}
+function hostMatchesGlob(host, glob) {
+  const g = glob.toLowerCase();
+  if (g.startsWith("*.")) {
+    const b = g.slice(2);
+    return host === b || host.endsWith(`.${b}`);
+  }
+  return host === g;
+}
+function isNoise(host) {
+  return NOISE_DENYLIST.some((d) => host === d || host.endsWith(`.${d}`));
+}
+function isPrivateOrLocal(host) {
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
+  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
+  return false;
+}
+function register(opts) {
+  if (installed) return;
+  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  if (!token) {
+    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    return;
+  }
+  const original = globalThis.fetch;
+  if (typeof original !== "function") return;
+  const exclude = opts?.exclude ?? [];
+  const include = opts?.include ?? [];
+  let routes = {};
+  const seen = /* @__PURE__ */ new Set();
+  const refresh = async () => {
+    try {
+      const res = await original(`${SIDECAR_HOST}/routes`, { headers: { "x-api-key": token }, cache: "no-store" });
+      if (res.ok) routes = await res.json();
+    } catch {
+    }
+  };
+  void refresh();
+  const timer = setInterval(refresh, REFRESH_MS);
+  if (typeof timer?.unref === "function") timer.unref();
+  const reportObserved = (origin) => {
+    original(`${SIDECAR_HOST}/observed`, {
+      method: "POST",
+      headers: { "x-api-key": token, "content-type": "application/json" },
+      body: JSON.stringify({ origin })
+    }).catch(() => {
+    });
+  };
+  const shouldConsider = (url) => {
+    if (url.protocol !== "https:") return false;
+    const host = url.hostname.toLowerCase();
+    if (host.endsWith("abz.run") || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
+    if (isPrivateOrLocal(host) || isNoise(host)) return false;
+    if (exclude.some((g) => hostMatchesGlob(host, g))) return false;
+    if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
+    return true;
+  };
+  const wrapped = async (input, init) => {
+    try {
+      const req = new Request(input, init);
+      const url = new URL(req.url);
+      if (shouldConsider(url)) {
+        const origin = canonicalOrigin(url.origin);
+        if (origin) {
+          const base = routes[origin];
+          if (base) {
+            if (!seen.has(origin)) {
+              seen.add(origin);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+            }
+            const headers = new Headers(req.headers);
+            const appKey = headers.get("x-api-key");
+            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+            headers.set("x-api-key", token);
+            const target = `${base}${url.pathname}${url.search}`;
+            return original(target, {
+              method: req.method,
+              headers,
+              body: req.body,
+              redirect: "manual",
+              duplex: req.body ? "half" : void 0
+              // streaming request bodies
+            });
+          }
+          if (!seen.has(origin)) {
+            seen.add(origin);
+            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
+            reportObserved(origin);
+          }
+        }
+      }
+    } catch (err) {
+      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
+    }
+    return original(input, init);
+  };
+  wrapped.__apiblaze = true;
+  globalThis.fetch = wrapped;
+  installed = true;
+  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
+}
+function withApiblaze(nextConfig = {}) {
+  register();
+  const experimental = { ...nextConfig.experimental };
+  if (experimental.instrumentationHook === void 0) experimental.instrumentationHook = true;
+  return { ...nextConfig, experimental };
+}
+var sidecar_default = { register, withApiblaze };
+export {
+  sidecar_default as default,
+  register,
+  withApiblaze
+};

package/package.json

@@ -1,13 +1,16 @@
 {
   "name": "apiblaze",
-  "version": "0.4.15",
-  "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
+  "version": "0.6.0",
+  "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",
     "dev-tunnel",
     "cloudflared",
     "api",
-    "proxy"
+    "proxy",
+    "sidecar",
+    "nextjs",
+    "egress"
   ],
   "license": "MIT",
   "author": "APIblaze",
@@ -15,6 +18,15 @@
     "apiblaze": "dist/index.js"
   },
   "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./sidecar": {
+      "types": "./dist/sidecar/index.d.ts",
+      "import": "./dist/sidecar/index.mjs",
+      "require": "./dist/sidecar/index.js",
+      "default": "./dist/sidecar/index.js"
+    }
+  },
   "files": [
     "dist/",
     "README.md"