apiblaze 0.4.4 → 0.4.7

package/dist/index.js

@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk26 = __toESM(require("chalk"));
+var import_chalk27 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.4.4";
+var version = "0.4.7";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -1516,12 +1516,12 @@ function openBrowser2(url) {
   } catch {
   }
 }
-async function deviceLogin(clientId, scope, onPrompt) {
+async function deviceLogin(clientId, scope, onPrompt, resource) {
   const { verifier, challenge } = pkce();
   const startRes = await fetch(`${AUTH_BASE}/device_authorization`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256" })
+    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256", ...resource ? { resource } : {} })
   });
   const start = await startRes.json().catch(() => ({}));
   if (!startRes.ok) {
@@ -1541,7 +1541,11 @@ async function deviceLogin(clientId, scope, onPrompt) {
     const tokRes = await fetch(`${AUTH_BASE}/token`, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier })
+      // RFC 8707 resource indicator: sets the access token's `aud` to the portal
+      // resource so the apikeys plane (which derives accepted auds as
+      // https://{tenant}.portal.apiblaze.com/{ver}) accepts this token. Without it the
+      // device grant falls back to aud=https://auth.apiblaze.com/device/callback → 401.
+      body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier, ...resource ? { resource } : {} })
     });
     const tok = await tokRes.json().catch(() => ({}));
     if (tokRes.ok && tok.access_token) {
@@ -2012,7 +2016,7 @@ function renderTrace() {
   console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
   console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
   console.log(
-    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one with `apiblaze apikeys`, then `export APIBLAZE_KEY=sk_...`):\n")
+    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`):\n")
   );
   entries.forEach((e, i) => {
     const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
@@ -2021,7 +2025,7 @@ function renderTrace() {
     const masked = maskBody(e.body);
     const hasBody = e.method !== "GET" && masked !== void 0;
     console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
-    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_KEY"' + (hasBody ? " \\" : "")));
+    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
     if (hasBody) {
       console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
       console.log(import_chalk15.default.green(`    -d '${masked}'`));
@@ -2566,10 +2570,11 @@ async function runSpecSet(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk24 = __toESM(require("chalk"));
+var import_chalk25 = __toESM(require("chalk"));
 var import_ora11 = __toESM(require("ora"));
 
 // src/lib/tools.ts
+var import_chalk24 = __toESM(require("chalk"));
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -2586,7 +2591,16 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.apiblaze.com/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      return { ...res, proxy_url: url, ...tryIt ? { try_it: tryIt } : {} };
+      const lines = [`  ${import_chalk24.default.dim("Proxy URL:")}  ${import_chalk24.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk24.default.dim("Dev portal:")} ${res.devPortal}`);
+      const envs = Object.keys(keys);
+      if (envs.length) {
+        lines.push("", `  ${import_chalk24.default.bold("API keys")} ${import_chalk24.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        const w = Math.max(...envs.map((e) => e.length));
+        for (const env of envs) lines.push(`    ${import_chalk24.default.cyan(env.padEnd(w))}  ${import_chalk24.default.green(keys[env])}`);
+      }
+      if (tryIt) lines.push("", `  ${import_chalk24.default.dim("Try it:")}`, `    ${import_chalk24.default.cyan(tryIt)}`);
+      return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
   {
@@ -2739,17 +2753,17 @@ function truncate(value, max = 1500) {
 }
 function printCost(llm) {
   const usd = llm.cost > 0 ? `$${llm.cost.toFixed(4)}` : "<$0.0001";
-  console.log(import_chalk24.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk24.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
+  console.log(import_chalk25.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk25.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk24.default.bold("APIblaze agent") + import_chalk24.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk24.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk25.default.bold("APIblaze agent") + import_chalk25.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk25.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk24.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk25.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
@@ -2763,14 +2777,14 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk24.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk25.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp.llm);
-      if (resp.reply) console.log(import_chalk24.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk25.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
@@ -2781,7 +2795,13 @@ async function runAgent(opts) {
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
-        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: ${truncate(result)}` });
+        let forHistory = result;
+        if (result && typeof result === "object" && typeof result.display === "string") {
+          console.log("\n" + result.display + "\n");
+          const { display, ...rest } = result;
+          forHistory = { ...rest, _note: "Details + keys already shown to the user verbatim; do not repeat the keys." };
+        }
+        history.push({ role: "user", content: `TOOL_RESULT ${tool.name}: ${truncate(forHistory)}` });
       } catch (err) {
         runSpinner.fail(`${tool.name} failed`);
         const msg = err instanceof Error ? err.message : String(err);
@@ -2789,25 +2809,21 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk24.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk25.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk24.default.dim("\nBye."));
+  console.log(import_chalk25.default.dim("\nBye."));
 }
 
 // src/commands/consumer.ts
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk26 = __toESM(require("chalk"));
 var import_ora12 = __toESM(require("ora"));
-var APIKEYS_VER = "1.0.0";
 var DEFAULT_SCOPE = "openid email profile offline_access";
-function apikeysBase(tenant2) {
-  const tmpl = process.env.APIBLAZE_APIKEYS_BASE_TMPL;
-  return tmpl ? tmpl.replace("{tenant}", tenant2) : `https://${tenant2}.apikeys.apiblaze.com`;
-}
+var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
   const fresh = await validConsumerToken(creds) ?? creds;
-  const res = await fetch(`${apikeysBase(fresh.tenant)}/${APIKEYS_VER}${suffix}`, {
+  const res = await fetch(`${APIKEYS_BASE}${suffix}`, {
     ...init,
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${fresh.accessToken}`, ...init?.headers ?? {} }
   });
@@ -2821,7 +2837,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk25.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk26.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -2832,7 +2848,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk25.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk26.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -2845,7 +2861,7 @@ async function runConsumerLogin(opts) {
       (t) => typeof t === "string" ? { tenant_name: t } : t
     );
     if (!tenants.length) {
-      console.error(import_chalk25.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk26.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       process.exit(1);
     }
     if (!tenant2) {
@@ -2861,19 +2877,20 @@ async function runConsumerLogin(opts) {
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk25.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk26.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk25.default.cyan("\u2192")} Logging in to ${import_chalk25.default.bold(tenant2)} as a consumer...`);
+  const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
+  console.log(`${import_chalk26.default.cyan("\u2192")} Logging in to ${import_chalk26.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk25.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk25.default.bold(userCode)}
+  Open: ${import_chalk26.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk26.default.bold(userCode)}
 `);
-    console.log(import_chalk25.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
-  });
+    console.log(import_chalk26.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+  }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
     tenant: tenant2,
@@ -2887,7 +2904,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk25.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk26.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -2900,18 +2917,18 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk25.default.cyan("Consumer")} ${import_chalk25.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk25.default.bold(fresh.tenant)}
+  console.log(`${import_chalk26.default.cyan("Consumer")} ${import_chalk26.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk26.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk25.default.bold("access_token")}  ${import_chalk25.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk26.default.bold("access_token")}  ${import_chalk26.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk25.default.bold("id_token")}      ${import_chalk25.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk26.default.bold("id_token")}      ${import_chalk26.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk25.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk26.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk25.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk26.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
@@ -2921,8 +2938,8 @@ async function runConsumerApikeys(opts) {
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk25.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk25.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk26.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk26.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -2930,16 +2947,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk25.default.yellow("No API keys yet."));
+    console.log(import_chalk26.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk25.default.green(clear) : import_chalk25.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk25.default.dim(`exp ${k.expires_at}`) : import_chalk25.default.dim("no expiry");
-      console.log(`  ${import_chalk25.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk25.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk26.default.green(clear) : import_chalk26.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk26.default.dim(`exp ${k.expires_at}`) : import_chalk26.default.dim("no expiry");
+      console.log(`  ${import_chalk26.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk26.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk25.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk26.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -2961,8 +2978,8 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk25.default.green(key)}  ${import_chalk25.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk25.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk26.default.green(key)}  ${import_chalk26.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk26.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/index.ts
@@ -3008,7 +3025,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk26.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk27.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -3093,7 +3110,7 @@ function groupedCommandHelp() {
       const c = byName.get(n);
       return c ? `  ${n.padEnd(width)}${c.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk26.default.bold(g.title)}
+    return `${import_chalk27.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -3119,13 +3136,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk26.default.red(`
+    console.error(import_chalk27.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk26.default.red(`
+    console.error(import_chalk27.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk26.default.red("\nUnknown error"));
+    console.error(import_chalk27.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.4.4",
+  "version": "0.4.7",
   "description": "Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints",
   "keywords": [
     "apiblaze",