apiblaze 0.4.2 → 0.4.7

package/dist/index.js

@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk26 = __toESM(require("chalk"));
+var import_chalk27 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.4.2";
+var version = "0.4.7";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -1104,14 +1104,23 @@ function fail(message) {
   console.error(import_chalk6.default.red(`Error: ${message}`));
   process.exit(1);
 }
-function printCurlExample(url, apiKey) {
+function buildTryItCurl(url, authType, apiKey) {
+  if (authType === "api_key") {
+    if (!apiKey) return null;
+    return `curl ${url} -H "X-API-Key: ${apiKey}"`;
+  }
+  if (authType === "none") return `curl ${url}`;
+  return null;
+}
+function printCurlExample(url, authType, apiKey, devPortal) {
+  const curl = buildTryItCurl(url, authType, apiKey);
   console.log();
-  console.log(`  ${import_chalk6.default.dim("Try it with curl:")}`);
-  if (apiKey) {
-    console.log(`    ${import_chalk6.default.cyan(`curl ${url} \\`)}`);
-    console.log(`    ${import_chalk6.default.cyan(`  -H "X-API-Key: ${apiKey}"`)}`);
-  } else {
-    console.log(`    ${import_chalk6.default.cyan(`curl ${url}`)}`);
+  if (curl) {
+    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
+    console.log(`    ${import_chalk6.default.cyan(curl)}`);
+  } else if (authType === "oauth") {
+    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
+    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
   }
 }
 var VALID_AUTH = ["api_key", "none", "oauth"];
@@ -1259,7 +1268,7 @@ async function runCreate(opts = {}) {
       console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
     }
   }
-  printCurlExample(proxyUrl, auth === "none" ? void 0 : adminKey);
+  printCurlExample(proxyUrl, auth, adminKey, devPortal);
   console.log();
 }
 async function runAnonymousCreate(opts) {
@@ -1370,7 +1379,7 @@ async function runAnonymousCreate(opts) {
     console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
     console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
   }
-  if (prodEndpoint) printCurlExample(prodEndpoint, apiKey);
+  if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
   if (result.claim_url) {
     console.log();
     console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
@@ -1507,12 +1516,12 @@ function openBrowser2(url) {
   } catch {
   }
 }
-async function deviceLogin(clientId, scope, onPrompt) {
+async function deviceLogin(clientId, scope, onPrompt, resource) {
   const { verifier, challenge } = pkce();
   const startRes = await fetch(`${AUTH_BASE}/device_authorization`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256" })
+    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256", ...resource ? { resource } : {} })
   });
   const start = await startRes.json().catch(() => ({}));
   if (!startRes.ok) {
@@ -1532,7 +1541,11 @@ async function deviceLogin(clientId, scope, onPrompt) {
     const tokRes = await fetch(`${AUTH_BASE}/token`, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier })
+      // RFC 8707 resource indicator: sets the access token's `aud` to the portal
+      // resource so the apikeys plane (which derives accepted auds as
+      // https://{tenant}.portal.apiblaze.com/{ver}) accepts this token. Without it the
+      // device grant falls back to aud=https://auth.apiblaze.com/device/callback → 401.
+      body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier, ...resource ? { resource } : {} })
     });
     const tok = await tokRes.json().catch(() => ({}));
     if (tokRes.ok && tok.access_token) {
@@ -1984,6 +1997,7 @@ var import_chalk16 = __toESM(require("chalk"));
 
 // src/lib/trace.ts
 var import_chalk15 = __toESM(require("chalk"));
+var CONTROL_API_VERSION = "1.0.0";
 var verbose = false;
 var entries = [];
 function setVerbose(v) {
@@ -2002,24 +2016,23 @@ function renderTrace() {
   console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
   console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
   console.log(
-    import_chalk15.default.dim("Copy/paste the curl below to do it yourself \u2014 it uses your own login token.\n")
+    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`):\n")
   );
   entries.forEach((e, i) => {
     const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
     if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
     const masked = maskBody(e.body);
-    const payload = JSON.stringify({ path: e.path, method: e.method, ...masked ? { body: JSON.parse(masked) } : {} });
-    console.log(import_chalk15.default.green("  curl -sS -X POST https://dashboard.apiblaze.com/api/cli/admin \\"));
-    console.log(import_chalk15.default.green('    -H "Authorization: Bearer $(jq -r .accessToken ~/.apiblaze/credentials.json)" \\'));
-    console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
-    console.log(import_chalk15.default.green(`    -d '${payload}'`));
-    console.log(
-      import_chalk15.default.dim(
-        `  # \u2192 admin-api leaf (Lane 3, X-User-Assertion minted server-side): ${e.method} ${e.path}`
-      )
-    );
+    const hasBody = e.method !== "GET" && masked !== void 0;
+    console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
+    if (hasBody) {
+      console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
+      console.log(import_chalk15.default.green(`    -d '${masked}'`));
+    }
     if (i < entries.length - 1) console.log();
   });
+  entries.length = 0;
 }
 
 // src/lib/admin.ts
@@ -2148,7 +2161,7 @@ async function runDelete(project, version2, opts) {
   try {
     await admin({
       method: "DELETE",
-      path: `/${proj2.projectId}/${proj2.apiVersion}`,
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
       summary: `Delete proxy ${proj2.projectName} v${proj2.apiVersion} (full cascade)`
     });
     s2.succeed(`Deleted ${proj2.projectName} v${proj2.apiVersion}.`);
@@ -2169,7 +2182,7 @@ async function patchConfig(project, opts, body, summary) {
   try {
     const out = await admin({
       method: "PATCH",
-      path: `/${proj2.projectId}/${proj2.apiVersion}/config`,
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
       body,
       summary
     });
@@ -2228,9 +2241,10 @@ async function runDomainAdd(project, opts) {
   try {
     const out = await admin({
       method: "POST",
-      path: `/projects/${proj2.projectId}/cf-domains`,
+      path: `/projects/${proj2.projectId}/domains`,
+      // --tenant binds the domain to one of the project's tenants (per-tenant scope).
       body: { hostname: opts.domain, api_version: proj2.apiVersion, ...opts.tenant ? { tenant_name: opts.tenant } : {} },
-      summary: `Add custom domain ${opts.domain} to ${proj2.projectName} v${proj2.apiVersion}`
+      summary: `Add custom domain ${opts.domain} to ${proj2.projectName} v${proj2.apiVersion}${opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
     });
     spinner.succeed(`Registered ${opts.domain}. Add these DNS records, then run \`apiblaze domain status\`:`);
     if (opts.json) {
@@ -2250,7 +2264,7 @@ async function runDomainList(project, opts) {
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/cf-domains?api_version=${encodeURIComponent(proj2.apiVersion)}`,
+    path: `/projects/${proj2.projectId}/domains?api_version=${encodeURIComponent(proj2.apiVersion)}`,
     summary: `List custom domains for ${proj2.projectName} v${proj2.apiVersion}`
   });
   const domains = out?.domains ?? [];
@@ -2273,7 +2287,7 @@ async function runDomainStatus(project, opts) {
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/cf-domains/${encodeURIComponent(opts.id)}/status`,
+    path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
   console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk20.default.bold(out?.hostname ?? opts.id)}: ${import_chalk20.default.cyan(out?.status ?? "unknown")}`);
@@ -2289,7 +2303,7 @@ async function runDomainRemove(project, opts) {
   try {
     await admin({
       method: "DELETE",
-      path: `/projects/${proj2.projectId}/cf-domains/${encodeURIComponent(opts.id)}`,
+      path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}`,
       summary: `Remove custom domain ${opts.id}`
     });
     spinner.succeed("Removed.");
@@ -2556,10 +2570,11 @@ async function runSpecSet(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk24 = __toESM(require("chalk"));
+var import_chalk25 = __toESM(require("chalk"));
 var import_ora11 = __toESM(require("ora"));
 
 // src/lib/tools.ts
+var import_chalk24 = __toESM(require("chalk"));
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -2568,7 +2583,25 @@ var TOOLS = [
     name: "create_proxy",
     description: "Create a new API proxy (project) from a backend URL. auth is one of: api_key, none, oauth.",
     params: { name: "proxy name (becomes its subdomain)", target: "backend URL to forward to", auth: "api_key | none | oauth (default api_key)" },
-    run: async (a, { teamId }) => createProxy({ name: a.name, target_url: a.target ?? a.target_url ?? a.url, auth_type: a.auth ?? a.auth_type ?? "api_key", team_id: teamId })
+    run: async (a, { teamId }) => {
+      const auth = a.auth ?? a.auth_type ?? "api_key";
+      const res = await createProxy({ name: a.name, target_url: a.target ?? a.target_url ?? a.url, auth_type: auth, team_id: teamId });
+      const version2 = res.api_version || "1.0.0";
+      const keys = res.api_keys ?? {};
+      const key = keys.dev ?? Object.values(keys)[0];
+      const url = `https://${a.name}.apiblaze.com/${version2}/dev`;
+      const tryIt = buildTryItCurl(url, auth, key);
+      const lines = [`  ${import_chalk24.default.dim("Proxy URL:")}  ${import_chalk24.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk24.default.dim("Dev portal:")} ${res.devPortal}`);
+      const envs = Object.keys(keys);
+      if (envs.length) {
+        lines.push("", `  ${import_chalk24.default.bold("API keys")} ${import_chalk24.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        const w = Math.max(...envs.map((e) => e.length));
+        for (const env of envs) lines.push(`    ${import_chalk24.default.cyan(env.padEnd(w))}  ${import_chalk24.default.green(keys[env])}`);
+      }
+      if (tryIt) lines.push("", `  ${import_chalk24.default.dim("Try it:")}`, `    ${import_chalk24.default.cyan(tryIt)}`);
+      return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
+    }
   },
   {
     name: "list_projects",
@@ -2583,7 +2616,7 @@ var TOOLS = [
     run: async (a, { teamId }) => {
       const p = await proj(teamId, a.project, a.apiversion);
       const body = a.env ? { environments: { [a.env]: { target: a.url } } } : { target_url: a.url };
-      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body, summary: `Set target for ${p.projectName}` });
+      return admin({ method: "PATCH", path: `/projects/${p.projectId}/${p.apiVersion}`, body, summary: `Set target for ${p.projectName}` });
     }
   },
   {
@@ -2596,7 +2629,7 @@ var TOOLS = [
       if (a.rate != null) throttling.userRateLimit = Number(a.rate);
       if (a.quota != null) throttling.proxyQuota = Number(a.quota);
       if (a.period) throttling.quotaPeriod = a.period;
-      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body: { throttling }, summary: `Throttle ${p.projectName}` });
+      return admin({ method: "PATCH", path: `/projects/${p.projectId}/${p.apiVersion}`, body: { throttling }, summary: `Throttle ${p.projectName}` });
     }
   },
   {
@@ -2605,7 +2638,7 @@ var TOOLS = [
     params: { project: "project name or id", display_name: "new display name" },
     run: async (a, { teamId }) => {
       const p = await proj(teamId, a.project, a.apiversion);
-      return admin({ method: "PATCH", path: `/${p.projectId}/${p.apiVersion}/config`, body: { display_name: a.display_name }, summary: `Rename ${p.projectName}` });
+      return admin({ method: "PATCH", path: `/projects/${p.projectId}/${p.apiVersion}`, body: { display_name: a.display_name }, summary: `Rename ${p.projectName}` });
     }
   },
   {
@@ -2614,7 +2647,7 @@ var TOOLS = [
     params: { project: "project name or id", version: "optional api version" },
     run: async (a, { teamId }) => {
       const p = await proj(teamId, a.project, a.version);
-      return admin({ method: "DELETE", path: `/${p.projectId}/${p.apiVersion}`, summary: `Delete ${p.projectName} (cascade)` });
+      return admin({ method: "DELETE", path: `/projects/${p.projectId}/${p.apiVersion}`, summary: `Delete ${p.projectName} (cascade)` });
     }
   },
   {
@@ -2661,7 +2694,7 @@ var TOOLS = [
     params: { project: "project name or id" },
     run: async (a, { teamId }) => {
       const p = await proj(teamId, a.project, a.apiversion);
-      return admin({ method: "GET", path: `/projects/${p.projectId}/cf-domains?api_version=${encodeURIComponent(p.apiVersion)}`, summary: `List domains for ${p.projectName}` });
+      return admin({ method: "GET", path: `/projects/${p.projectId}/domains?api_version=${encodeURIComponent(p.apiVersion)}`, summary: `List domains for ${p.projectName}` });
     }
   },
   {
@@ -2720,17 +2753,17 @@ function truncate(value, max = 1500) {
 }
 function printCost(llm) {
   const usd = llm.cost > 0 ? `$${llm.cost.toFixed(4)}` : "<$0.0001";
-  console.log(import_chalk24.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk24.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
+  console.log(import_chalk25.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk25.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk24.default.bold("APIblaze agent") + import_chalk24.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk24.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk25.default.bold("APIblaze agent") + import_chalk25.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk25.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk24.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk25.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
@@ -2744,14 +2777,14 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk24.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk25.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp.llm);
-      if (resp.reply) console.log(import_chalk24.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk25.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
@@ -2762,32 +2795,35 @@ async function runAgent(opts) {
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
-        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: ${truncate(result)}` });
+        let forHistory = result;
+        if (result && typeof result === "object" && typeof result.display === "string") {
+          console.log("\n" + result.display + "\n");
+          const { display, ...rest } = result;
+          forHistory = { ...rest, _note: "Details + keys already shown to the user verbatim; do not repeat the keys." };
+        }
+        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: ${truncate(forHistory)}` });
       } catch (err) {
         runSpinner.fail(`${tool.name} failed`);
         const msg = err instanceof Error ? err.message : String(err);
         history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: error \u2014 ${truncate(msg, 400)}` });
       }
+      renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk24.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk25.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk24.default.dim("\nBye."));
+  console.log(import_chalk25.default.dim("\nBye."));
 }
 
 // src/commands/consumer.ts
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk26 = __toESM(require("chalk"));
 var import_ora12 = __toESM(require("ora"));
-var APIKEYS_VER = "1.0.0";
 var DEFAULT_SCOPE = "openid email profile offline_access";
-function apikeysBase(tenant2) {
-  const tmpl = process.env.APIBLAZE_APIKEYS_BASE_TMPL;
-  return tmpl ? tmpl.replace("{tenant}", tenant2) : `https://${tenant2}.apikeys.apiblaze.com`;
-}
+var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
   const fresh = await validConsumerToken(creds) ?? creds;
-  const res = await fetch(`${apikeysBase(fresh.tenant)}/${APIKEYS_VER}${suffix}`, {
+  const res = await fetch(`${APIKEYS_BASE}${suffix}`, {
     ...init,
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${fresh.accessToken}`, ...init?.headers ?? {} }
   });
@@ -2801,7 +2837,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk25.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk26.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -2812,7 +2848,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk25.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk26.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -2825,7 +2861,7 @@ async function runConsumerLogin(opts) {
       (t) => typeof t === "string" ? { tenant_name: t } : t
     );
     if (!tenants.length) {
-      console.error(import_chalk25.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk26.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       process.exit(1);
     }
     if (!tenant2) {
@@ -2841,19 +2877,20 @@ async function runConsumerLogin(opts) {
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk25.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk26.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk25.default.cyan("\u2192")} Logging in to ${import_chalk25.default.bold(tenant2)} as a consumer...`);
+  const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
+  console.log(`${import_chalk26.default.cyan("\u2192")} Logging in to ${import_chalk26.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk25.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk25.default.bold(userCode)}
+  Open: ${import_chalk26.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk26.default.bold(userCode)}
 `);
-    console.log(import_chalk25.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
-  });
+    console.log(import_chalk26.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+  }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
     tenant: tenant2,
@@ -2867,7 +2904,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk25.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk26.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -2880,18 +2917,18 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk25.default.cyan("Consumer")} ${import_chalk25.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk25.default.bold(fresh.tenant)}
+  console.log(`${import_chalk26.default.cyan("Consumer")} ${import_chalk26.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk26.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk25.default.bold("access_token")}  ${import_chalk25.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk26.default.bold("access_token")}  ${import_chalk26.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk25.default.bold("id_token")}      ${import_chalk25.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk26.default.bold("id_token")}      ${import_chalk26.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk25.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk26.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk25.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk26.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
@@ -2901,8 +2938,8 @@ async function runConsumerApikeys(opts) {
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk25.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk25.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk26.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk26.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -2910,16 +2947,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk25.default.yellow("No API keys yet."));
+    console.log(import_chalk26.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk25.default.green(clear) : import_chalk25.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk25.default.dim(`exp ${k.expires_at}`) : import_chalk25.default.dim("no expiry");
-      console.log(`  ${import_chalk25.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk25.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk26.default.green(clear) : import_chalk26.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk26.default.dim(`exp ${k.expires_at}`) : import_chalk26.default.dim("no expiry");
+      console.log(`  ${import_chalk26.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk26.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk25.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk26.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -2941,8 +2978,8 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk25.default.green(key)}  ${import_chalk25.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk25.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk26.default.green(key)}  ${import_chalk26.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk26.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/index.ts
@@ -2956,7 +2993,9 @@ function action(fn) {
   return async (...args) => {
     try {
       await fn(...args);
+      renderTrace();
     } catch (err) {
+      renderTrace();
       printError(err);
       process.exit(1);
     }
@@ -2970,7 +3009,7 @@ program.command("login").description("Authenticate with APIblaze").action(async
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.apiblaze.com)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant slug (anonymous create; generated if omitted)").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.apiblaze.com)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate(opts);
   } catch (err) {
@@ -2986,7 +3025,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk26.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk27.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -3037,7 +3076,7 @@ program.command("target").description("Change where a proxy forwards requests").
 program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
 program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
 var domain = program.command("domain").description("Use your own domain for a proxy");
-domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("<project>", "Project name or id").requiredOption("--domain <host>", "Custom hostname to add").option("--tenant <slug>", "Tenant to scope the domain to").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainAdd(project, opts)));
+domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("<project>", "Project name or id").requiredOption("--domain <host>", "Custom hostname to add").option("--tenant <slug>", "Bind the domain to one of the project's tenants (per-tenant scope)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainAdd(project, opts)));
 domain.command("list").description("List custom domains for a proxy").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
 domain.command("status").description("Check a custom domain's validation status").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
 domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
@@ -3071,7 +3110,7 @@ function groupedCommandHelp() {
       const c = byName.get(n);
       return c ? `  ${n.padEnd(width)}${c.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk26.default.bold(g.title)}
+    return `${import_chalk27.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -3097,13 +3136,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk26.default.red(`
+    console.error(import_chalk27.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk26.default.red(`
+    console.error(import_chalk27.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk26.default.red("\nUnknown error"));
+    console.error(import_chalk27.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.4.2",
+  "version": "0.4.7",
   "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
   "keywords": [
     "apiblaze",