apiblaze 0.5.0 → 0.6.0

package/dist/index.js

@@ -25,10 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk29 = __toESM(require("chalk"));
+var import_chalk30 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.5.0";
+var version = "0.6.0";
 
 // src/types.ts
 var ApiError = class extends Error {
@@ -2485,15 +2485,15 @@ async function runTenantCors(opts) {
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-  const cors = origins.length ? { allowed_origins: origins } : null;
+  const origins2 = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const cors = origins2.length ? { allowed_origins: origins2 } : null;
   const spinner = (0, import_ora8.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
       path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(opts.tenant)}/cors`,
       body: { cors },
-      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins.length ? origins.join(", ") : "(cleared)"}`
+      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins2.length ? origins2.join(", ") : "(cleared)"}`
     });
     spinner.succeed(`CORS updated for ${opts.tenant}.`);
   } catch (err) {
@@ -3052,44 +3052,32 @@ function detectNextProject(root) {
   }
   const appDir = fs6.existsSync(path3.join(root, "app")) || fs6.existsSync(path3.join(root, "src", "app"));
   const pagesDir = fs6.existsSync(path3.join(root, "pages")) || fs6.existsSync(path3.join(root, "src", "pages"));
-  return {
-    found: hasConfig || hasDep || appDir || pagesDir,
-    router: appDir ? "app" : pagesDir ? "pages" : null
-  };
+  return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
-function upsertEnvLocal(root, token, tenant2) {
+function upsertEnvLocal(root, token) {
   const p = path3.join(root, ".env.local");
   let existing = "";
   try {
     existing = fs6.readFileSync(p, "utf8");
   } catch {
   }
-  const hadToken = /^APIBLAZE_TOKEN=/m.test(existing);
-  let next = existing;
-  const set = (k, v) => {
-    if (new RegExp(`^${k}=`, "m").test(next)) next = next.replace(new RegExp(`^${k}=.*$`, "m"), `${k}=${v}`);
-    else next = (next && !next.endsWith("\n") ? next + "\n" : next) + `${k}=${v}
+  const had = /^APIBLAZE_TOKEN=/m.test(existing);
+  const next = had ? existing.replace(/^APIBLAZE_TOKEN=.*$/m, `APIBLAZE_TOKEN=${token}`) : (existing && !existing.endsWith("\n") ? existing + "\n" : existing) + `APIBLAZE_TOKEN=${token}
 `;
-  };
-  set("APIBLAZE_TOKEN", token);
-  set("APIBLAZE_TENANT", tenant2);
   fs6.writeFileSync(p, next);
-  return hadToken ? "rotated" : existing ? "reused" : "created";
+  return had ? "rotated" : "created";
 }
 function ensureGitignored(root) {
   const p = path3.join(root, ".gitignore");
-  let content = "";
+  let c = "";
   try {
-    content = fs6.readFileSync(p, "utf8");
+    c = fs6.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(content) && !/^\.env\*/m.test(content)) {
-    fs6.writeFileSync(p, (content && !content.endsWith("\n") ? content + "\n" : content) + ".env.local\n");
-  }
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs6.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const candidates = ["instrumentation.ts", "instrumentation.js", path3.join("src", "instrumentation.ts")];
-  const existing = candidates.map((c) => path3.join(root, c)).find((f) => fs6.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path3.join("src", "instrumentation.ts")].map((c) => path3.join(root, c)).find((f) => fs6.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -3103,52 +3091,40 @@ export function register() {
   const cur = fs6.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    const patched = `import { register as apiblaze } from "apiblaze/sidecar";
+    fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
-  apiblaze();`);
-    fs6.writeFileSync(existing, patched);
+  apiblaze();`));
     return "patched";
   }
   fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
-// apiblaze(): call apiblaze() inside your register() export.
+// call apiblaze() inside your register() export.
 `);
   return "patched";
 }
-var INSPECTOR_PAGE = `// AUTO-GENERATED by \`apiblaze sidecar\` \u2014 dev-only smoke test. Safe to delete.
-// Proves the whole lazy path: interception \u2192 edge auth \u2192 auto-provision \u2192
-// header transform \u2192 convergence. Fires a fetch at httpbingo THROUGH the sidecar
-// and echoes what the upstream actually received.
+var INSPECTOR_PAGE = `// AUTO-GENERATED by \`apiblaze init\` \u2014 dev-only. Safe to delete (rm this folder).
+// Proves the observe\u2192approve model: an approved origin routes + keeps its auth;
+// an un-approved origin goes direct and shows up as a candidate to approve.
 export const dynamic = "force-dynamic";
 
-async function probe() {
-  const res = await fetch("https://httpbingo.org/headers", {
-    headers: { "x-api-key": "demo-secret-value" },
-    cache: "no-store",
-  });
-  const body = await res.json().catch(() => ({}));
-  return { status: res.status, sidecar: res.headers.get("x-abz-sidecar"), echo: body };
+async function probe(u: string) {
+  try {
+    const res = await fetch(u, { headers: { "x-api-key": "demo-secret-value" }, cache: "no-store" });
+    return { url: u, status: res.status, echo: await res.json().catch(() => ({})) };
+  } catch (e: any) { return { url: u, error: e?.message ?? String(e) }; }
 }
 
 export default async function Page() {
-  if (process.env.NODE_ENV === "production") {
-    return <main style={{ padding: 24 }}>Inspector is disabled in production.</main>;
-  }
-  let result: any = null, error: string | null = null;
-  try { result = await probe(); } catch (e: any) { error = e?.message ?? String(e); }
-  const ok = result && result.status === 200;
+  if (process.env.NODE_ENV === "production") return <main style={{padding:24}}>Inspector disabled in production.</main>;
+  const r = await probe("https://httpbingo.org/headers");
   return (
     <main style={{ fontFamily: "ui-monospace, monospace", padding: 24, lineHeight: 1.6 }}>
       <h1>APIblaze sidecar inspector</h1>
-      <p>{ok ? "\u2705 intercepted + relayed" : "\u26A0\uFE0F check the result below"}</p>
-      <p>edge path: <b>{result?.sidecar ?? "(no x-abz-sidecar header \u2014 was the fetch intercepted?)"}</b>
-         {" "}(first call \u2192 "miss"; after ~60s of propagation, provisioned path)</p>
-      <p>The upstream echoes the headers it received \u2014 you should see <code>x-api-key</code>
-         (the marker suffix stripped), and NOT <code>x-abz-target</code> or any APIblaze identity header.</p>
-      {error && <pre style={{ color: "crimson" }}>{error}</pre>}
-      <pre>{JSON.stringify(result?.echo ?? {}, null, 2)}</pre>
-      <form><button formAction="" style={{ padding: "8px 16px" }}>Run again</button></form>
-      <p style={{ opacity: 0.6 }}>Delete app/abz-inspector/ (or pages/abz-inspector) before shipping.</p>
+      <p>Fetched httpbingo through the interceptor. If httpbingo.org is <b>not yet approved</b>, this went
+         <b> direct</b> and now appears as a candidate in your dashboard \u2014 approve it, wait ~5 min, reload,
+         and it will route through APIblaze (the echo below will show it arrived via your proxy).</p>
+      <pre>{JSON.stringify(r, null, 2)}</pre>
+      <p style={{opacity:.6}}>Delete this folder before shipping.</p>
     </main>
   );
 }
@@ -3174,53 +3150,112 @@ function generateInspector(root, router) {
 async function runSidecar(opts) {
   const root = path3.resolve(opts.dir ?? process.cwd());
   if (!loadCredentials()) {
-    console.log(import_chalk28.default.dim("Not logged in \u2014 starting APIblaze login first..."));
+    console.log(import_chalk28.default.dim("Not logged in \u2014 starting APIblaze login..."));
     await runLogin();
   }
   const detected = detectNextProject(root);
   if (!detected.found) {
     console.log(import_chalk28.default.yellow(`No Next.js project detected in ${root}.`));
-    console.log("Create one first (e.g. `npx create-next-app`), then re-run `apiblaze sidecar` inside it.");
+    console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora13.default)("Minting a scoped sidecar key...").start();
-  let key, tenant2, keyId;
+  const spinner = (0, import_ora13.default)("Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+  let token;
   try {
     const out = await admin({
       method: "POST",
-      path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
-      body: { role: "sidecar", description: `sidecar key for ${path3.basename(root)}` },
-      summary: `Mint a sidecar data-plane key for team ${teamName ?? teamId}`
+      path: `/teams/${encodeURIComponent(teamId)}/sidecar/setup`,
+      summary: `Set up sidecar for team ${teamName ?? teamId}`
     });
-    key = out.key;
-    tenant2 = out.tenant;
-    keyId = out.key_id;
-    spinner.succeed("Sidecar key minted.");
+    token = out.token;
+    spinner.succeed("Sidecar ready.");
   } catch (err) {
-    spinner.fail("Key mint failed.");
+    spinner.fail("Setup failed.");
     throw err;
   }
-  const envState = upsertEnvLocal(root, key, tenant2);
+  const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_TOKEN, APIBLAZE_TENANT) \u2014 gitignored`);
+  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_TOKEN) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState} (register apiblaze/sidecar)`);
-  console.log(`  ${import_chalk28.default.dim("\u2022")} install the runtime dep:  ${import_chalk28.default.cyan("npm install apiblaze")}`);
+  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState}`);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}  \u2192  visit /abz-inspector (dev only)`);
+    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk28.default.bold("Done. Next steps:"));
+  console.log(import_chalk28.default.bold("Done. What happens next:"));
   console.log(`  1. ${import_chalk28.default.cyan("npm install apiblaze")}`);
-  console.log(`  2. ${import_chalk28.default.cyan("npm run dev")} then open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")}`);
-  console.log(`  3. Your external https fetches now route through APIblaze \u2014 see them in the dashboard (badged "auto-provisioned").`);
+  console.log(`  2. ${import_chalk28.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  3. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze origins")}`);
+  console.log(`  4. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path3.dirname(inspectorPath)} before shipping)`);
   console.log("");
-  console.log(import_chalk28.default.dim(`  Key id ${keyId} \xB7 revoke anytime:  apiblaze apikeys revoke ${keyId}`));
-  if (inspectorPath) console.log(import_chalk28.default.dim(`  Remove the inspector before shipping:  rm -rf ${path3.dirname(inspectorPath)}`));
-  console.log(import_chalk28.default.dim("  The control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk28.default.yellow("  \u26A0 APIBLAZE_TOKEN is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk28.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+}
+
+// src/commands/origins.ts
+var import_chalk29 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
+async function runOriginsList(opts) {
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/sidecar/candidates`,
+    summary: `List sidecar origins for team ${teamName ?? teamId}`
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  const routed = out.routed ?? [];
+  const candidates = out.candidates ?? [];
+  console.log(import_chalk29.default.bold(`
+Routed through APIblaze (${routed.length})`));
+  if (!routed.length) console.log(import_chalk29.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk29.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk29.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk29.default.bold(`
+Candidates \u2014 going direct, not yet approved (${candidates.length})`));
+  if (!candidates.length) console.log(import_chalk29.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  for (const c of candidates) {
+    console.log(`  ${import_chalk29.default.yellow("\u25CB")} ${c.origin}  ${import_chalk29.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+  }
+  if (candidates.length) {
+    console.log(import_chalk29.default.dim(`
+  Approve:  apiblaze origins approve ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk29.default.dim(`  Dismiss:  apiblaze origins deny ${candidates[0].origin.replace("https://", "")}`));
+  }
+}
+async function runOriginsApprove(origin, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora14.default)(`Approving ${origin}...`).start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/sidecar/approve`,
+      body: { origin },
+      summary: `Approve sidecar origin ${origin}`
+    });
+    spinner.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Your app will route it within ~5 min.`);
+    if (opts.json) console.log(JSON.stringify(out));
+  } catch (err) {
+    spinner.fail("Approve failed.");
+    throw err;
+  }
+}
+async function runOriginsDeny(origin, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora14.default)(`Dismissing ${origin}...`).start();
+  try {
+    await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
+    spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
+  } catch (err) {
+    spinner.fail("Dismiss failed.");
+    throw err;
+  }
 }
 
 // src/index.ts
@@ -3262,12 +3297,15 @@ var agent = program.command("agent").description("Chat with an assistant that bu
 agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("sidecar").description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to provision under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector smoke-test page").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false })));
+program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false })));
+var origins = program.command("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
+origins.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
+origins.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
 program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk29.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk30.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -3340,7 +3378,7 @@ spec.command("get").description("Print the current OpenAPI document").argument("
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
 var HELP_GROUPS = [
   { title: "Chat", commands: ["agent"] },
-  { title: "Setup", commands: ["login", "create", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
+  { title: "Setup", commands: ["login", "create", "init", "origins", "dev", "claim", "team", "whoami", "logout"] },
   { title: "Control plane commands", commands: ["projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
@@ -3360,7 +3398,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk29.default.bold(g.title)}
+    return `${import_chalk30.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -3386,13 +3424,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk29.default.red(`
+    console.error(import_chalk30.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk29.default.red(`
+    console.error(import_chalk30.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk29.default.red("\nUnknown error"));
+    console.error(import_chalk30.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);

package/dist/sidecar/index.d.mts

@@ -1,46 +1,24 @@
 /**
- * apiblaze/sidecar — the egress interceptor.
- * Spec: specs/sidecar/apiblaze-sidecar-implementation-spec.md §11.
- *
- * Import in a Next.js backend to route outbound fetch() calls through APIblaze:
+ * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
  *
  *   // instrumentation.ts
  *   import { register as apiblaze } from "apiblaze/sidecar";
  *   export function register() { apiblaze(); }
  *
- *   // or next.config.js
- *   import { withApiblaze } from "apiblaze/sidecar";
- *   export default withApiblaze({ /* your next config *\/ });
- *
- * Reads APIBLAZE_TOKEN + APIBLAZE_TENANT from env. STATELESS — it never learns
- * whether a proxy exists; it applies the same transform on call 1 and call N.
- * All state lives at the edge. If either env var is missing it no-ops with a
- * single boot warning and NEVER breaks the app.
+ * At boot it loads the team's APPROVED origins (GET sidecar.abz.run/routes) into
+ * an in-memory map. Per request: if the origin is approved it routes through that
+ * origin's proxy (carrying the call's own auth); otherwise it goes DIRECT,
+ * untouched, and reports the origin once as a candidate. Reads only APIBLAZE_TOKEN.
+ * Fail-open: any error → direct. Never breaks the app.
  */
 interface SidecarOptions {
     token?: string;
-    tenant?: string;
-    /** Extra origin globs to never intercept (in addition to the noise denylist). */
     exclude?: string[];
-    /** Only intercept these origin globs (when set, everything else passes direct). */
     include?: string[];
-    /** Suppress the boot log line. */
     quiet?: boolean;
 }
-/**
- * Install the interceptor. Wraps the current globalThis.fetch (which Next has
- * already patched for cache semantics) so caching survives — we only reroute the
- * actual egress. Idempotent: safe to call from both next.config and
- * instrumentation without double-wrapping.
- */
 declare function register(opts?: SidecarOptions): void;
-/**
- * next.config wrapper: injects instrumentation registration. Returns the config
- * with `instrumentationHook` enabled (Next <15) — on Next 15+ instrumentation is
- * always on, so the flag is a harmless no-op. The actual register() call still
- * needs an instrumentation.ts (the scaffolder writes one); this wrapper mainly
- * exists as the documented most-zero entry point and to enable the hook.
- */
 declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;
 declare const _default: {
     register: typeof register;

package/dist/sidecar/index.d.ts

@@ -1,46 +1,24 @@
 /**
- * apiblaze/sidecar — the egress interceptor.
- * Spec: specs/sidecar/apiblaze-sidecar-implementation-spec.md §11.
- *
- * Import in a Next.js backend to route outbound fetch() calls through APIblaze:
+ * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
  *
  *   // instrumentation.ts
  *   import { register as apiblaze } from "apiblaze/sidecar";
  *   export function register() { apiblaze(); }
  *
- *   // or next.config.js
- *   import { withApiblaze } from "apiblaze/sidecar";
- *   export default withApiblaze({ /* your next config *\/ });
- *
- * Reads APIBLAZE_TOKEN + APIBLAZE_TENANT from env. STATELESS — it never learns
- * whether a proxy exists; it applies the same transform on call 1 and call N.
- * All state lives at the edge. If either env var is missing it no-ops with a
- * single boot warning and NEVER breaks the app.
+ * At boot it loads the team's APPROVED origins (GET sidecar.abz.run/routes) into
+ * an in-memory map. Per request: if the origin is approved it routes through that
+ * origin's proxy (carrying the call's own auth); otherwise it goes DIRECT,
+ * untouched, and reports the origin once as a candidate. Reads only APIBLAZE_TOKEN.
+ * Fail-open: any error → direct. Never breaks the app.
  */
 interface SidecarOptions {
     token?: string;
-    tenant?: string;
-    /** Extra origin globs to never intercept (in addition to the noise denylist). */
     exclude?: string[];
-    /** Only intercept these origin globs (when set, everything else passes direct). */
     include?: string[];
-    /** Suppress the boot log line. */
     quiet?: boolean;
 }
-/**
- * Install the interceptor. Wraps the current globalThis.fetch (which Next has
- * already patched for cache semantics) so caching survives — we only reroute the
- * actual egress. Idempotent: safe to call from both next.config and
- * instrumentation without double-wrapping.
- */
 declare function register(opts?: SidecarOptions): void;
-/**
- * next.config wrapper: injects instrumentation registration. Returns the config
- * with `instrumentationHook` enabled (Next <15) — on Next 15+ instrumentation is
- * always on, so the flag is a harmless no-op. The actual register() call still
- * needs an instrumentation.ts (the scaffolder writes one); this wrapper mainly
- * exists as the documented most-zero entry point and to enable the hook.
- */
 declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;
 declare const _default: {
     register: typeof register;

package/dist/sidecar/index.js

@@ -25,14 +25,12 @@ __export(sidecar_exports, {
   withApiblaze: () => withApiblaze
 });
 module.exports = __toCommonJS(sidecar_exports);
-var ABZ_TARGET_HEADER = "x-abz-target";
-var MARK_SUFFIX = "-abz-target";
-var DATA_PLANE = "abz.run";
+var SIDECAR_HOST = "https://sidecar.abz.run";
+var REFRESH_MS = 5 * 60 * 1e3;
 var NOISE_DENYLIST = [
   "google-analytics.com",
   "googletagmanager.com",
   "segment.io",
-  "segment.com",
   "sentry.io",
   "ingest.sentry.io",
   "posthog.com",
@@ -41,13 +39,9 @@ var NOISE_DENYLIST = [
   "datadoghq.com",
   "newrelic.com",
   "nr-data.net",
-  "honeycomb.io",
   "launchdarkly.com",
   "statsigapi.net",
   "plausible.io",
-  "hotjar.com",
-  "fullstory.com",
-  "intercom.io",
   "avatars.githubusercontent.com",
   "gravatar.com",
   "googleusercontent.com",
@@ -56,15 +50,11 @@ var NOISE_DENYLIST = [
   "fastly.net",
   "imgix.net",
   "cloudinary.com",
-  "unsplash.com",
-  "twimg.com",
-  "fbcdn.net",
   "registry.npmjs.org",
-  "pypi.org",
-  "github.io"
+  "pypi.org"
 ];
 var installed = false;
-function canonicalizeOrigin(input) {
+function canonicalOrigin(input) {
   try {
     const u = new URL(input);
     if (u.protocol !== "https:") return null;
@@ -74,20 +64,11 @@ function canonicalizeOrigin(input) {
     return null;
   }
 }
-async function sha256Hex(s) {
-  const data = new TextEncoder().encode(s);
-  const buf = await globalThis.crypto.subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function sidecarHost(tenant, canonicalOrigin) {
-  const h = await sha256Hex(`${tenant}|${canonicalOrigin}`);
-  return `sc${h.slice(0, 16)}.${DATA_PLANE}`;
-}
 function hostMatchesGlob(host, glob) {
   const g = glob.toLowerCase();
   if (g.startsWith("*.")) {
-    const base = g.slice(2);
-    return host === base || host.endsWith(`.${base}`);
+    const b = g.slice(2);
+    return host === b || host.endsWith(`.${b}`);
   }
   return host === g;
 }
@@ -96,78 +77,84 @@ function isNoise(host) {
 }
 function isPrivateOrLocal(host) {
   if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
-  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host)) return true;
+  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host)) return true;
   if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (/^169\.254\./.test(host)) return true;
   return false;
 }
-function shouldIntercept(cfg, url) {
-  if (url.protocol !== "https:") return false;
-  const host = url.hostname.toLowerCase();
-  if (host.endsWith(DATA_PLANE) || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
-  if (isPrivateOrLocal(host)) return false;
-  if (isNoise(host)) return false;
-  if (cfg.exclude.some((g) => hostMatchesGlob(host, g))) return false;
-  if (cfg.include.length > 0 && !cfg.include.some((g) => hostMatchesGlob(host, g))) return false;
-  return true;
-}
-async function rewrite(cfg, input) {
-  const url = new URL(input.url);
-  if (!shouldIntercept(cfg, url)) return null;
-  const origin = canonicalizeOrigin(url.origin);
-  if (!origin) return null;
-  const host = await sidecarHost(cfg.tenant, origin);
-  const newUrl = new URL(input.url);
-  newUrl.protocol = "https:";
-  newUrl.host = host;
-  newUrl.pathname = `/1.0.0/prod${url.pathname === "/" ? "" : url.pathname}`;
-  const headers = new Headers(input.headers);
-  const marked = new Headers();
-  headers.forEach((value, name) => {
-    const n = name.toLowerCase();
-    if (n === "authorization") {
-      marked.set(`authorization${MARK_SUFFIX}`, value);
-      return;
-    }
-    if (n.startsWith("x-") && !n.startsWith("x-abz-")) {
-      marked.set(`${n}${MARK_SUFFIX}`, value);
-      return;
-    }
-    marked.set(n, value);
-  });
-  marked.set(ABZ_TARGET_HEADER, origin);
-  marked.set("x-api-key", cfg.token);
-  return new Request(newUrl.toString(), {
-    method: input.method,
-    headers: marked,
-    body: input.body,
-    redirect: "manual",
-    // @ts-expect-error duplex needed for streaming bodies on some runtimes
-    duplex: input.body ? "half" : void 0
-  });
-}
-function resolveConfig(opts) {
-  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
-  const tenant = opts?.tenant ?? process.env.APIBLAZE_TENANT;
-  if (!token || !tenant) {
-    if (!opts?.quiet) {
-      console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN and APIBLAZE_TENANT are required \u2014 interceptor is OFF (fetches pass through unchanged).");
-    }
-    return null;
-  }
-  return { token, tenant, exclude: opts?.exclude ?? [], include: opts?.include ?? [] };
-}
 function register(opts) {
   if (installed) return;
-  const cfg = resolveConfig(opts);
-  if (!cfg) return;
+  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  if (!token) {
+    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    return;
+  }
   const original = globalThis.fetch;
   if (typeof original !== "function") return;
+  const exclude = opts?.exclude ?? [];
+  const include = opts?.include ?? [];
+  let routes = {};
+  const seen = /* @__PURE__ */ new Set();
+  const refresh = async () => {
+    try {
+      const res = await original(`${SIDECAR_HOST}/routes`, { headers: { "x-api-key": token }, cache: "no-store" });
+      if (res.ok) routes = await res.json();
+    } catch {
+    }
+  };
+  void refresh();
+  const timer = setInterval(refresh, REFRESH_MS);
+  if (typeof timer?.unref === "function") timer.unref();
+  const reportObserved = (origin) => {
+    original(`${SIDECAR_HOST}/observed`, {
+      method: "POST",
+      headers: { "x-api-key": token, "content-type": "application/json" },
+      body: JSON.stringify({ origin })
+    }).catch(() => {
+    });
+  };
+  const shouldConsider = (url) => {
+    if (url.protocol !== "https:") return false;
+    const host = url.hostname.toLowerCase();
+    if (host.endsWith("abz.run") || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
+    if (isPrivateOrLocal(host) || isNoise(host)) return false;
+    if (exclude.some((g) => hostMatchesGlob(host, g))) return false;
+    if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
+    return true;
+  };
   const wrapped = async (input, init) => {
     try {
       const req = new Request(input, init);
-      const rewritten = await rewrite(cfg, req);
-      if (rewritten) return original(rewritten);
+      const url = new URL(req.url);
+      if (shouldConsider(url)) {
+        const origin = canonicalOrigin(url.origin);
+        if (origin) {
+          const base = routes[origin];
+          if (base) {
+            if (!seen.has(origin)) {
+              seen.add(origin);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+            }
+            const headers = new Headers(req.headers);
+            const appKey = headers.get("x-api-key");
+            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+            headers.set("x-api-key", token);
+            const target = `${base}${url.pathname}${url.search}`;
+            return original(target, {
+              method: req.method,
+              headers,
+              body: req.body,
+              redirect: "manual",
+              duplex: req.body ? "half" : void 0
+              // streaming request bodies
+            });
+          }
+          if (!seen.has(origin)) {
+            seen.add(origin);
+            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
+            reportObserved(origin);
+          }
+        }
+      }
     } catch (err) {
       if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
     }
@@ -176,7 +163,7 @@ function register(opts) {
   wrapped.__apiblaze = true;
   globalThis.fetch = wrapped;
   installed = true;
-  if (!opts?.quiet) console.log(`[apiblaze/sidecar] active \u2014 external fetches route through ${cfg.tenant}'s APIblaze plane.`);
+  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
 }
 function withApiblaze(nextConfig = {}) {
   register();

package/dist/sidecar/index.mjs

@@ -1,12 +1,10 @@
 // src/sidecar/index.ts
-var ABZ_TARGET_HEADER = "x-abz-target";
-var MARK_SUFFIX = "-abz-target";
-var DATA_PLANE = "abz.run";
+var SIDECAR_HOST = "https://sidecar.abz.run";
+var REFRESH_MS = 5 * 60 * 1e3;
 var NOISE_DENYLIST = [
   "google-analytics.com",
   "googletagmanager.com",
   "segment.io",
-  "segment.com",
   "sentry.io",
   "ingest.sentry.io",
   "posthog.com",
@@ -15,13 +13,9 @@ var NOISE_DENYLIST = [
   "datadoghq.com",
   "newrelic.com",
   "nr-data.net",
-  "honeycomb.io",
   "launchdarkly.com",
   "statsigapi.net",
   "plausible.io",
-  "hotjar.com",
-  "fullstory.com",
-  "intercom.io",
   "avatars.githubusercontent.com",
   "gravatar.com",
   "googleusercontent.com",
@@ -30,15 +24,11 @@ var NOISE_DENYLIST = [
   "fastly.net",
   "imgix.net",
   "cloudinary.com",
-  "unsplash.com",
-  "twimg.com",
-  "fbcdn.net",
   "registry.npmjs.org",
-  "pypi.org",
-  "github.io"
+  "pypi.org"
 ];
 var installed = false;
-function canonicalizeOrigin(input) {
+function canonicalOrigin(input) {
   try {
     const u = new URL(input);
     if (u.protocol !== "https:") return null;
@@ -48,20 +38,11 @@ function canonicalizeOrigin(input) {
     return null;
   }
 }
-async function sha256Hex(s) {
-  const data = new TextEncoder().encode(s);
-  const buf = await globalThis.crypto.subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function sidecarHost(tenant, canonicalOrigin) {
-  const h = await sha256Hex(`${tenant}|${canonicalOrigin}`);
-  return `sc${h.slice(0, 16)}.${DATA_PLANE}`;
-}
 function hostMatchesGlob(host, glob) {
   const g = glob.toLowerCase();
   if (g.startsWith("*.")) {
-    const base = g.slice(2);
-    return host === base || host.endsWith(`.${base}`);
+    const b = g.slice(2);
+    return host === b || host.endsWith(`.${b}`);
   }
   return host === g;
 }
@@ -70,78 +51,84 @@ function isNoise(host) {
 }
 function isPrivateOrLocal(host) {
   if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
-  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host)) return true;
+  if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host)) return true;
   if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (/^169\.254\./.test(host)) return true;
   return false;
 }
-function shouldIntercept(cfg, url) {
-  if (url.protocol !== "https:") return false;
-  const host = url.hostname.toLowerCase();
-  if (host.endsWith(DATA_PLANE) || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
-  if (isPrivateOrLocal(host)) return false;
-  if (isNoise(host)) return false;
-  if (cfg.exclude.some((g) => hostMatchesGlob(host, g))) return false;
-  if (cfg.include.length > 0 && !cfg.include.some((g) => hostMatchesGlob(host, g))) return false;
-  return true;
-}
-async function rewrite(cfg, input) {
-  const url = new URL(input.url);
-  if (!shouldIntercept(cfg, url)) return null;
-  const origin = canonicalizeOrigin(url.origin);
-  if (!origin) return null;
-  const host = await sidecarHost(cfg.tenant, origin);
-  const newUrl = new URL(input.url);
-  newUrl.protocol = "https:";
-  newUrl.host = host;
-  newUrl.pathname = `/1.0.0/prod${url.pathname === "/" ? "" : url.pathname}`;
-  const headers = new Headers(input.headers);
-  const marked = new Headers();
-  headers.forEach((value, name) => {
-    const n = name.toLowerCase();
-    if (n === "authorization") {
-      marked.set(`authorization${MARK_SUFFIX}`, value);
-      return;
-    }
-    if (n.startsWith("x-") && !n.startsWith("x-abz-")) {
-      marked.set(`${n}${MARK_SUFFIX}`, value);
-      return;
-    }
-    marked.set(n, value);
-  });
-  marked.set(ABZ_TARGET_HEADER, origin);
-  marked.set("x-api-key", cfg.token);
-  return new Request(newUrl.toString(), {
-    method: input.method,
-    headers: marked,
-    body: input.body,
-    redirect: "manual",
-    // @ts-expect-error duplex needed for streaming bodies on some runtimes
-    duplex: input.body ? "half" : void 0
-  });
-}
-function resolveConfig(opts) {
-  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
-  const tenant = opts?.tenant ?? process.env.APIBLAZE_TENANT;
-  if (!token || !tenant) {
-    if (!opts?.quiet) {
-      console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN and APIBLAZE_TENANT are required \u2014 interceptor is OFF (fetches pass through unchanged).");
-    }
-    return null;
-  }
-  return { token, tenant, exclude: opts?.exclude ?? [], include: opts?.include ?? [] };
-}
 function register(opts) {
   if (installed) return;
-  const cfg = resolveConfig(opts);
-  if (!cfg) return;
+  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  if (!token) {
+    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    return;
+  }
   const original = globalThis.fetch;
   if (typeof original !== "function") return;
+  const exclude = opts?.exclude ?? [];
+  const include = opts?.include ?? [];
+  let routes = {};
+  const seen = /* @__PURE__ */ new Set();
+  const refresh = async () => {
+    try {
+      const res = await original(`${SIDECAR_HOST}/routes`, { headers: { "x-api-key": token }, cache: "no-store" });
+      if (res.ok) routes = await res.json();
+    } catch {
+    }
+  };
+  void refresh();
+  const timer = setInterval(refresh, REFRESH_MS);
+  if (typeof timer?.unref === "function") timer.unref();
+  const reportObserved = (origin) => {
+    original(`${SIDECAR_HOST}/observed`, {
+      method: "POST",
+      headers: { "x-api-key": token, "content-type": "application/json" },
+      body: JSON.stringify({ origin })
+    }).catch(() => {
+    });
+  };
+  const shouldConsider = (url) => {
+    if (url.protocol !== "https:") return false;
+    const host = url.hostname.toLowerCase();
+    if (host.endsWith("abz.run") || host.endsWith("tryabz.run") || host.endsWith("apiblaze.com")) return false;
+    if (isPrivateOrLocal(host) || isNoise(host)) return false;
+    if (exclude.some((g) => hostMatchesGlob(host, g))) return false;
+    if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
+    return true;
+  };
   const wrapped = async (input, init) => {
     try {
       const req = new Request(input, init);
-      const rewritten = await rewrite(cfg, req);
-      if (rewritten) return original(rewritten);
+      const url = new URL(req.url);
+      if (shouldConsider(url)) {
+        const origin = canonicalOrigin(url.origin);
+        if (origin) {
+          const base = routes[origin];
+          if (base) {
+            if (!seen.has(origin)) {
+              seen.add(origin);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+            }
+            const headers = new Headers(req.headers);
+            const appKey = headers.get("x-api-key");
+            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+            headers.set("x-api-key", token);
+            const target = `${base}${url.pathname}${url.search}`;
+            return original(target, {
+              method: req.method,
+              headers,
+              body: req.body,
+              redirect: "manual",
+              duplex: req.body ? "half" : void 0
+              // streaming request bodies
+            });
+          }
+          if (!seen.has(origin)) {
+            seen.add(origin);
+            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
+            reportObserved(origin);
+          }
+        }
+      }
     } catch (err) {
       if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
     }
@@ -150,7 +137,7 @@ function register(opts) {
   wrapped.__apiblaze = true;
   globalThis.fetch = wrapped;
   installed = true;
-  if (!opts?.quiet) console.log(`[apiblaze/sidecar] active \u2014 external fetches route through ${cfg.tenant}'s APIblaze plane.`);
+  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
 }
 function withApiblaze(nextConfig = {}) {
   register();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",