apiblaze 0.6.0 → 0.7.2

package/dist/index.js

@@ -6,6 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -23,33 +30,23 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/index.ts
-var import_commander = require("commander");
-var import_chalk30 = __toESM(require("chalk"));
-
-// package.json
-var version = "0.6.0";
-
 // src/types.ts
-var ApiError = class extends Error {
-  constructor(status, message, body) {
-    super(message);
-    this.status = status;
-    this.body = body;
-    this.name = "ApiError";
+var ApiError;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    ApiError = class extends Error {
+      constructor(status, message, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "ApiError";
+      }
+    };
   }
-};
-
-// src/commands/login.ts
-var import_chalk2 = __toESM(require("chalk"));
-var import_ora = __toESM(require("ora"));
+});
 
 // src/lib/auth.ts
-var fs = __toESM(require("fs"));
-var os = __toESM(require("os"));
-var path = __toESM(require("path"));
-var APIBLAZE_DIR = path.join(os.homedir(), ".apiblaze");
-var CREDENTIALS_PATH = path.join(APIBLAZE_DIR, "credentials.json");
 function saveCredentials(creds) {
   fs.mkdirSync(APIBLAZE_DIR, { recursive: true });
   fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), "utf-8");
@@ -81,17 +78,39 @@ function getAccessToken() {
   }
   return creds.accessToken;
 }
-
-// src/lib/team.ts
-var import_chalk = __toESM(require("chalk"));
+var fs, os, path, APIBLAZE_DIR, CREDENTIALS_PATH;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    fs = __toESM(require("fs"));
+    os = __toESM(require("os"));
+    path = __toESM(require("path"));
+    APIBLAZE_DIR = path.join(os.homedir(), ".apiblaze");
+    CREDENTIALS_PATH = path.join(APIBLAZE_DIR, "credentials.json");
+  }
+});
 
 // src/lib/api.ts
-var DASHBOARD_BASE = "https://dashboard.apiblaze.com";
-var PUBLIC_API_BASE = "https://api.apiblaze.com";
-async function createProxyAnonymous(body) {
+var api_exports = {};
+__export(api_exports, {
+  agentCall: () => agentCall,
+  checkProxyName: () => checkProxyName,
+  claimProxy: () => claimProxy,
+  claimTeam: () => claimTeam,
+  createProxy: () => createProxy,
+  createProxyAnonymous: () => createProxyAnonymous,
+  deleteDevTunnel: () => deleteDevTunnel,
+  getLocalhostTargets: () => getLocalhostTargets,
+  getProjects: () => getProjects,
+  getTeams: () => getTeams,
+  putDevTunnel: () => putDevTunnel,
+  sidecarApproveAnonymous: () => sidecarApproveAnonymous,
+  sidecarInitAnonymous: () => sidecarInitAnonymous
+});
+async function createProxyAnonymous(body, anonSession) {
   const res = await fetch(`${PUBLIC_API_BASE}/proxy`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...anonSession ? { "X-Abz-Anon-Session": anonSession } : {} },
     body: JSON.stringify(body)
   });
   if (!res.ok) {
@@ -105,9 +124,9 @@ async function createProxyAnonymous(body) {
   }
   return res.json();
 }
-async function apiFetch(path4, options = {}) {
+async function apiFetch(path6, options = {}) {
   const token = getAccessToken();
-  const url = `${DASHBOARD_BASE}${path4}`;
+  const url = `${DASHBOARD_BASE}${path6}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -121,8 +140,9 @@ async function apiFetch(path4, options = {}) {
     let parsed;
     try {
       parsed = await res.json();
+      const pick2 = (v) => typeof v === "string" ? v : v && typeof v === "object" ? pick2(v.message) ?? pick2(v.error) : void 0;
       const b = parsed;
-      message = b.message ?? b.error ?? message;
+      message = pick2(b.message) ?? pick2(b.error) ?? pick2(b.details) ?? message;
     } catch {
     }
     throw new ApiError(res.status, message, parsed);
@@ -132,12 +152,12 @@ async function apiFetch(path4, options = {}) {
   }
   return res.json();
 }
-async function agentCall(path4, method, body) {
+async function agentCall(path6, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path4, method, body })
+    body: JSON.stringify({ path: path6, method, body })
   });
   let data = null;
   try {
@@ -177,6 +197,32 @@ async function claimProxy(claimCode, teamId) {
     body: JSON.stringify({ claimCode, team_id: teamId })
   });
 }
+async function claimTeam(code) {
+  return apiFetch("/api/cli/claim-team", {
+    method: "POST",
+    body: JSON.stringify({ code })
+  });
+}
+async function sidecarInitAnonymous(anonSession) {
+  const res = await fetch(`${PUBLIC_API_BASE}/sidecar/init`, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...anonSession ? { "X-Abz-Anon-Session": anonSession } : {} },
+    body: "{}"
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new ApiError(res.status, data?.error ?? "init_failed", data);
+  return data;
+}
+async function sidecarApproveAnonymous(invokeKey, origin) {
+  const res = await fetch(`${PUBLIC_API_BASE}/sidecar/approve`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-abz-sidecar-key": invokeKey },
+    body: JSON.stringify({ origin })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new ApiError(res.status, data?.detail ?? data?.error ?? "approve_failed", data);
+  return data;
+}
 async function putDevTunnel(payload) {
   return apiFetch("/api/cli/dev-tunnel", {
     method: "PUT",
@@ -189,8 +235,81 @@ async function deleteDevTunnel(restore) {
     body: JSON.stringify({ restore })
   });
 }
+var DASHBOARD_BASE, PUBLIC_API_BASE;
+var init_api = __esm({
+  "src/lib/api.ts"() {
+    "use strict";
+    init_auth();
+    init_types();
+    DASHBOARD_BASE = "https://dashboard.apiblaze.com";
+    PUBLIC_API_BASE = "https://api.apiblaze.com";
+  }
+});
+
+// src/lib/anon-session.ts
+var anon_session_exports = {};
+__export(anon_session_exports, {
+  clearAnonSession: () => clearAnonSession,
+  loadAnonSession: () => loadAnonSession,
+  saveAnonSession: () => saveAnonSession
+});
+function loadAnonSession() {
+  try {
+    const s = JSON.parse(fs3.readFileSync(SESSION_PATH, "utf8"));
+    return s?.anon_session ? s : null;
+  } catch {
+    return null;
+  }
+}
+function saveAnonSession(anon_session, claim_code) {
+  try {
+    fs3.mkdirSync(DIR, { recursive: true });
+    const prev = loadAnonSession();
+    const merged = {
+      anon_session,
+      claim_code: claim_code ?? prev?.claim_code,
+      created_at: prev?.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    fs3.writeFileSync(SESSION_PATH, JSON.stringify(merged, null, 2));
+  } catch {
+  }
+}
+function clearAnonSession() {
+  try {
+    fs3.unlinkSync(SESSION_PATH);
+  } catch {
+  }
+}
+var fs3, path2, os2, DIR, SESSION_PATH;
+var init_anon_session = __esm({
+  "src/lib/anon-session.ts"() {
+    "use strict";
+    fs3 = __toESM(require("fs"));
+    path2 = __toESM(require("path"));
+    os2 = __toESM(require("os"));
+    DIR = path2.join(os2.homedir(), ".apiblaze");
+    SESSION_PATH = path2.join(DIR, "anon.json");
+  }
+});
+
+// src/index.ts
+var import_commander = require("commander");
+var import_chalk30 = __toESM(require("chalk"));
+
+// package.json
+var version = "0.7.2";
+
+// src/index.ts
+init_types();
+
+// src/commands/login.ts
+var import_chalk2 = __toESM(require("chalk"));
+var import_ora = __toESM(require("ora"));
+init_auth();
 
 // src/lib/team.ts
+var import_chalk = __toESM(require("chalk"));
+init_api();
 async function resolveLinkedTeam(opts) {
   let teams;
   try {
@@ -326,6 +445,8 @@ var import_fs = __toESM(require("fs"));
 var import_chalk4 = __toESM(require("chalk"));
 var import_ora2 = __toESM(require("ora"));
 var import_inquirer = __toESM(require("inquirer"));
+init_auth();
+init_api();
 
 // src/lib/traffic.ts
 var import_chalk3 = __toESM(require("chalk"));
@@ -420,11 +541,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path4) {
-  const q = path4.indexOf("?");
-  if (q < 0) return path4;
-  const base = path4.slice(0, q);
-  const query = path4.slice(q + 1);
+function maskPath(path6) {
+  const q = path6.indexOf("?");
+  if (q < 0) return path6;
+  const base = path6.slice(0, q);
+  const query = path6.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -1018,6 +1139,8 @@ Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
 // src/commands/projects.ts
 var import_chalk5 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
+init_auth();
+init_api();
 async function runProjects() {
   const creds = loadCredentials();
   if (!creds) {
@@ -1077,6 +1200,8 @@ ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 var import_fs2 = __toESM(require("fs"));
 var import_chalk6 = __toESM(require("chalk"));
 var import_ora4 = __toESM(require("ora"));
+init_auth();
+init_api();
 function normalizeName(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
@@ -1345,15 +1470,19 @@ async function runAnonymousCreate(opts) {
   if (opts.displayName) body.display_name = opts.displayName;
   if (opts.apiversion) body.api_version = opts.apiversion;
   if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
-  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy...").start() : null;
+  const { loadAnonSession: loadAnonSession2, saveAnonSession: saveAnonSession2, clearAnonSession: clearAnonSession2 } = await Promise.resolve().then(() => (init_anon_session(), anon_session_exports));
+  if (opts.newSession) clearAnonSession2();
+  const prior = loadAnonSession2();
+  const spinner = !opts.json ? (0, import_ora4.default)(prior ? "Creating proxy (adding to your anonymous session)..." : "Creating proxy...").start() : null;
   let result;
   try {
-    result = await createProxyAnonymous(body);
+    result = await createProxyAnonymous(body, prior?.anon_session);
     spinner?.succeed(import_chalk6.default.green("Proxy created!"));
   } catch (err) {
     spinner?.fail("Failed to create proxy.");
     throw err;
   }
+  if (result.anon_session) saveAnonSession2(result.anon_session, result.team_claim_code);
   const version2 = result.api_version || "1.0.0";
   const keys = result.api_keys ?? {};
   const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
@@ -1380,17 +1509,26 @@ async function runAnonymousCreate(opts) {
     console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
   }
   if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
-  if (result.claim_url) {
+  if (result.team_claim_code) {
+    console.log();
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} All your anonymous proxies`);
+    console.log(`    on this machine share ONE team. To keep them all:`);
+    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}  then  ${import_chalk6.default.cyan("apiblaze claim")}   ${import_chalk6.default.dim("(no code needed here)")}`);
+    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${result.team_claim_code}`));
+  } else if (result.claim_url) {
     console.log();
     console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
     console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
-    console.log(import_chalk6.default.dim("  (or run `apiblaze login`, then re-run `apiblaze create` to create it under your account)"));
   }
   console.log();
 }
 
 // src/commands/claim.ts
 var import_chalk7 = __toESM(require("chalk"));
+init_auth();
+init_anon_session();
+init_api();
+init_types();
 function fail2(message) {
   console.error(import_chalk7.default.red(`Error: ${message}`));
   process.exit(1);
@@ -1401,6 +1539,14 @@ async function runClaim(claimCodeArg, opts) {
     fail2("Not logged in. Run `apiblaze login` first, then claim.");
   }
   let claimCode = (claimCodeArg ?? "").trim();
+  let fromLocalSession = false;
+  if (!claimCode) {
+    const sess = loadAnonSession();
+    if (sess?.claim_code) {
+      claimCode = sess.claim_code;
+      fromLocalSession = true;
+    }
+  }
   if (!claimCode && process.stdin.isTTY) {
     const { default: inquirer2 } = await import("inquirer");
     const { code } = await inquirer2.prompt([{
@@ -1411,7 +1557,30 @@ async function runClaim(claimCodeArg, opts) {
     claimCode = (code ?? "").trim();
   }
   if (!claimCode) {
-    fail2("A claim code is required: `apiblaze claim <code>`.");
+    fail2("Nothing to claim on this machine. Run `apiblaze claim <code>` with a code, or `apiblaze create`/`init` first.");
+  }
+  try {
+    const t = await claimTeam(claimCode);
+    if (fromLocalSession) clearAnonSession();
+    if (opts.json) {
+      console.log(JSON.stringify(t, null, 2));
+      return;
+    }
+    console.log(import_chalk7.default.green(`
+\u2714 Claimed the whole team into your account.`));
+    console.log(`  Team: ${import_chalk7.default.bold(t.team_id)}`);
+    console.log(`  Its proxies + keys are now yours. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${t.team_id}`)}.`);
+    console.log(`
+  Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
+    return;
+  } catch (err) {
+    if (err instanceof ApiError && err.status !== 404) {
+      const code = typeof err.body === "object" && err.body ? err.body.error : void 0;
+      if (code === "already_claimed") fail2("That claim code has already been used.");
+      if (code === "expired") fail2("That claim code has expired. Create a fresh setup with `apiblaze init`.");
+      if (code === "not_claimable") fail2("That team can no longer be claimed (it already belongs to an account).");
+      fail2(`Could not claim: ${err.message}`);
+    }
   }
   const teams = await getTeams().catch(() => []);
   if (teams.length === 0) {
@@ -1443,7 +1612,13 @@ async function runClaim(claimCodeArg, opts) {
     fail2(`Specify a team: \`apiblaze claim ${claimCode} --team <name|id>\`. Available: ${teams.map((t) => t.name).join(", ")}.`);
   }
   const teamName = teams.find((t) => t.teamId === teamId)?.name ?? teamId;
-  const result = await claimProxy(claimCode, teamId);
+  let result;
+  try {
+    result = await claimProxy(claimCode, teamId);
+  } catch (err) {
+    if (err instanceof ApiError) fail2(`That claim code isn't valid \u2014 it may be mistyped, already claimed, or expired.`);
+    throw err;
+  }
   if (opts.json) {
     console.log(JSON.stringify(result, null, 2));
     return;
@@ -1461,32 +1636,33 @@ async function runClaim(claimCodeArg, opts) {
 
 // src/commands/logout.ts
 var import_chalk8 = __toESM(require("chalk"));
+init_auth();
 
 // src/lib/consumer-auth.ts
-var fs4 = __toESM(require("fs"));
-var os2 = __toESM(require("os"));
-var path2 = __toESM(require("path"));
+var fs5 = __toESM(require("fs"));
+var os3 = __toESM(require("os"));
+var path3 = __toESM(require("path"));
 var crypto = __toESM(require("crypto"));
 var import_child_process = require("child_process");
 var AUTH_BASE = process.env.APIBLAZE_AUTH_BASE || "https://auth.apiblaze.com";
-var APIBLAZE_DIR2 = path2.join(os2.homedir(), ".apiblaze");
-var CONSUMER_PATH = path2.join(APIBLAZE_DIR2, "consumer.json");
+var APIBLAZE_DIR2 = path3.join(os3.homedir(), ".apiblaze");
+var CONSUMER_PATH = path3.join(APIBLAZE_DIR2, "consumer.json");
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function loadConsumer() {
   try {
-    return JSON.parse(fs4.readFileSync(CONSUMER_PATH, "utf-8"));
+    return JSON.parse(fs5.readFileSync(CONSUMER_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveConsumer(creds) {
-  fs4.mkdirSync(APIBLAZE_DIR2, { recursive: true });
-  fs4.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
-  fs4.chmodSync(CONSUMER_PATH, 384);
+  fs5.mkdirSync(APIBLAZE_DIR2, { recursive: true });
+  fs5.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
+  fs5.chmodSync(CONSUMER_PATH, 384);
 }
 function clearConsumer() {
   try {
-    fs4.unlinkSync(CONSUMER_PATH);
+    fs5.unlinkSync(CONSUMER_PATH);
     return true;
   } catch {
     return false;
@@ -1628,6 +1804,7 @@ async function runLogout(opts = {}) {
 
 // src/commands/whoami.ts
 var import_chalk9 = __toESM(require("chalk"));
+init_auth();
 async function runWhoami(opts = {}) {
   const creds = loadCredentials();
   const consumer2 = loadConsumer();
@@ -1668,6 +1845,8 @@ async function runWhoami(opts = {}) {
 
 // src/commands/team.ts
 var import_chalk10 = __toESM(require("chalk"));
+init_auth();
+init_api();
 function fail3(message) {
   console.error(import_chalk10.default.red(`Error: ${message}`));
   process.exit(1);
@@ -1712,10 +1891,13 @@ async function runTeam(arg) {
 
 // src/commands/authz.ts
 var import_chalk12 = __toESM(require("chalk"));
+init_auth();
+init_api();
 
 // src/lib/agent-chat.ts
 var import_readline = __toESM(require("readline"));
 var import_chalk11 = __toESM(require("chalk"));
+init_api();
 async function runAgentChatRepl(opts) {
   const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
   console.log("\n" + import_chalk11.default.cyan.bold(title));
@@ -1885,6 +2067,8 @@ async function runAuthz(projectArg, apiVersionArg) {
 
 // src/commands/openapi.ts
 var import_chalk13 = __toESM(require("chalk"));
+init_auth();
+init_api();
 async function runOpenapi(projectArg, apiVersionArg) {
   const creds = loadCredentials();
   if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
@@ -1949,6 +2133,8 @@ async function runOpenapi(projectArg, apiVersionArg) {
 
 // src/commands/mcp.ts
 var import_chalk14 = __toESM(require("chalk"));
+init_auth();
+init_api();
 async function runMcp(projectArg, apiVersionArg, opts) {
   const creds = loadCredentials();
   if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
@@ -1994,6 +2180,7 @@ var import_ora5 = __toESM(require("ora"));
 
 // src/lib/admin.ts
 var import_chalk16 = __toESM(require("chalk"));
+init_auth();
 
 // src/lib/trace.ts
 var import_chalk15 = __toESM(require("chalk"));
@@ -2036,6 +2223,7 @@ function renderTrace() {
 }
 
 // src/lib/admin.ts
+init_types();
 var DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 async function admin(call) {
   const token = getAccessToken();
@@ -2068,6 +2256,8 @@ function maybePrintBilling(data) {
 
 // src/lib/resolve.ts
 var import_chalk17 = __toESM(require("chalk"));
+init_auth();
+init_api();
 function requireAuth() {
   const creds = loadCredentials();
   if (!creds) {
@@ -2175,6 +2365,7 @@ async function runDelete(project, version2, opts) {
 // src/commands/export.ts
 var import_chalk19 = __toESM(require("chalk"));
 var import_fs3 = require("fs");
+init_auth();
 var DASHBOARD_BASE4 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 async function runExport(projectArg, versionArg, opts) {
   const token = getAccessToken();
@@ -2581,7 +2772,7 @@ async function runKeyRevoke(keyId, opts) {
 }
 
 // src/commands/spec.ts
-var fs5 = __toESM(require("fs"));
+var fs6 = __toESM(require("fs"));
 var import_chalk24 = __toESM(require("chalk"));
 var import_ora10 = __toESM(require("ora"));
 async function runSpecGet(project, opts) {
@@ -2601,7 +2792,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs5.readFileSync(opts.file, "utf-8");
+    specContent = fs6.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk24.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -2627,9 +2818,11 @@ async function runSpecSet(project, opts) {
 // src/commands/agent.ts
 var import_chalk26 = __toESM(require("chalk"));
 var import_ora11 = __toESM(require("ora"));
+init_auth();
 
 // src/lib/tools.ts
 var import_chalk25 = __toESM(require("chalk"));
+init_api();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -2779,6 +2972,7 @@ function findTool(name) {
 }
 
 // src/commands/agent.ts
+init_types();
 var DASHBOARD_BASE5 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 var MAX_TOOL_STEPS = 6;
 async function callAgent(messages, teamId) {
@@ -3040,44 +3234,59 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk28 = __toESM(require("chalk"));
 var import_ora13 = __toESM(require("ora"));
-var fs6 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
+var fs7 = __toESM(require("fs"));
+var path4 = __toESM(require("path"));
+init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs6.existsSync(path3.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs7.existsSync(path4.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs6.readFileSync(path3.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs7.readFileSync(path4.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs6.existsSync(path3.join(root, "app")) || fs6.existsSync(path3.join(root, "src", "app"));
-  const pagesDir = fs6.existsSync(path3.join(root, "pages")) || fs6.existsSync(path3.join(root, "src", "pages"));
+  const appDir = fs7.existsSync(path4.join(root, "app")) || fs7.existsSync(path4.join(root, "src", "app"));
+  const pagesDir = fs7.existsSync(path4.join(root, "pages")) || fs7.existsSync(path4.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
-  const p = path3.join(root, ".env.local");
+  const p = path4.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs6.readFileSync(p, "utf8");
+    existing = fs7.readFileSync(p, "utf8");
   } catch {
   }
-  const had = /^APIBLAZE_TOKEN=/m.test(existing);
-  const next = had ? existing.replace(/^APIBLAZE_TOKEN=.*$/m, `APIBLAZE_TOKEN=${token}`) : (existing && !existing.endsWith("\n") ? existing + "\n" : existing) + `APIBLAZE_TOKEN=${token}
+  const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
+  let next = existing.replace(/^APIBLAZE_TOKEN=.*\n?/m, "");
+  next = /^APIBLAZE_API_KEY=/m.test(next) ? next.replace(/^APIBLAZE_API_KEY=.*$/m, `APIBLAZE_API_KEY=${token}`) : (next && !next.endsWith("\n") ? next + "\n" : next) + `APIBLAZE_API_KEY=${token}
+`;
+  if (!/^APIBLAZE_SIDECAR=/m.test(next)) {
+    next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR=on
 `;
-  fs6.writeFileSync(p, next);
+  }
+  fs7.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
+function readEnvKey(root) {
+  try {
+    const s = fs7.readFileSync(path4.join(root, ".env.local"), "utf8");
+    const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
+    return m ? m[1].trim() : null;
+  } catch {
+    return null;
+  }
+}
 function ensureGitignored(root) {
-  const p = path3.join(root, ".gitignore");
+  const p = path4.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs6.readFileSync(p, "utf8");
+    c = fs7.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs6.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs7.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path3.join("src", "instrumentation.ts")].map((c) => path3.join(root, c)).find((f) => fs6.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path4.join("src", "instrumentation.ts")].map((c) => path4.join(root, c)).find((f) => fs7.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -3085,18 +3294,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs6.writeFileSync(path3.join(root, "instrumentation.ts"), body);
+    fs7.writeFileSync(path4.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs6.readFileSync(existing, "utf8");
+  const cur = fs7.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs7.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs6.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs7.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -3120,7 +3329,7 @@ export default async function Page() {
   return (
     <main style={{ fontFamily: "ui-monospace, monospace", padding: 24, lineHeight: 1.6 }}>
       <h1>APIblaze sidecar inspector</h1>
-      <p>Fetched httpbingo through the interceptor. If httpbingo.org is <b>not yet approved</b>, this went
+      <p>Fetched httpbingo through the sidecar. If httpbingo.org is <b>not yet approved</b>, this went
          <b> direct</b> and now appears as a candidate in your dashboard \u2014 approve it, wait ~5 min, reload,
          and it will route through APIblaze (the echo below will show it arrived via your proxy).</p>
       <pre>{JSON.stringify(r, null, 2)}</pre>
@@ -3132,51 +3341,100 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs6.existsSync(path3.join(root, "src", "pages")) ? path3.join(root, "src", "pages") : path3.join(root, "pages");
-      const f2 = path3.join(dir2, "abz-inspector.tsx");
-      fs6.writeFileSync(f2, INSPECTOR_PAGE);
-      return path3.relative(root, f2);
-    }
-    const base = fs6.existsSync(path3.join(root, "src", "app")) ? path3.join(root, "src", "app") : path3.join(root, "app");
-    const dir = path3.join(base, "abz-inspector");
-    fs6.mkdirSync(dir, { recursive: true });
-    const f = path3.join(dir, "page.tsx");
-    fs6.writeFileSync(f, INSPECTOR_PAGE);
-    return path3.relative(root, f);
+      const dir2 = fs7.existsSync(path4.join(root, "src", "pages")) ? path4.join(root, "src", "pages") : path4.join(root, "pages");
+      const f2 = path4.join(dir2, "abz-inspector.tsx");
+      fs7.writeFileSync(f2, INSPECTOR_PAGE);
+      return path4.relative(root, f2);
+    }
+    const base = fs7.existsSync(path4.join(root, "src", "app")) ? path4.join(root, "src", "app") : path4.join(root, "app");
+    const dir = path4.join(base, "abz-inspector");
+    fs7.mkdirSync(dir, { recursive: true });
+    const f = path4.join(dir, "page.tsx");
+    fs7.writeFileSync(f, INSPECTOR_PAGE);
+    return path4.relative(root, f);
   } catch {
     return null;
   }
 }
-async function runSidecar(opts) {
-  const root = path3.resolve(opts.dir ?? process.cwd());
-  if (!loadCredentials()) {
-    console.log(import_chalk28.default.dim("Not logged in \u2014 starting APIblaze login..."));
-    await runLogin();
+async function runAnonymousInit(root, router, opts) {
+  const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
+  const { loadAnonSession: loadAnonSession2, saveAnonSession: saveAnonSession2, clearAnonSession: clearAnonSession2 } = await Promise.resolve().then(() => (init_anon_session(), anon_session_exports));
+  if (opts.newSession) clearAnonSession2();
+  const prior = loadAnonSession2();
+  const spinner = (0, import_ora13.default)(prior ? "Adding to your anonymous session..." : "Setting up a sidecar (no login needed)...").start();
+  let out;
+  try {
+    out = await sidecarInitAnonymous2(prior?.anon_session);
+    spinner.succeed("Sidecar ready (anonymous trial).");
+  } catch (err) {
+    spinner.fail("Setup failed.");
+    throw err;
   }
+  if (out.anon_session) saveAnonSession2(out.anon_session, out.claim_code);
+  const envState = upsertEnvLocal(root, out.token);
+  ensureGitignored(root);
+  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  let inspectorPath = null;
+  if (!opts.noInspector) {
+    inspectorPath = generateInspector(root, router);
+    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}`);
+  }
+  console.log("");
+  console.log(import_chalk28.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk28.default.cyan("npm install apiblaze")} then ${import_chalk28.default.cyan("npm run dev")} and use your app.`);
+  console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
+  console.log(`       ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}   (no login needed)`);
+  console.log("");
+  console.log(import_chalk28.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk28.default.cyan("apiblaze login")}  then  ${import_chalk28.default.cyan("apiblaze claim")}   ${import_chalk28.default.dim("(no code needed here)")}`);
+  console.log(import_chalk28.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+}
+async function runSidecar(opts) {
+  const root = path4.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
     console.log(import_chalk28.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
+  if (!loadCredentials() && !readEnvKey(root)) {
+    await runAnonymousInit(root, detected.router, opts);
+    return;
+  }
+  if (!loadCredentials()) {
+    upsertEnvLocal(root, readEnvKey(root));
+    ensureGitignored(root);
+    console.log(`  ${import_chalk28.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(import_chalk28.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    return;
+  }
   const { teamId, teamName } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora13.default)("Setting up the sidecar (tenant + non-expiring invoke key)...").start();
-  let token;
-  try {
-    const out = await admin({
-      method: "POST",
-      path: `/teams/${encodeURIComponent(teamId)}/sidecar/setup`,
-      summary: `Set up sidecar for team ${teamName ?? teamId}`
-    });
-    token = out.token;
-    spinner.succeed("Sidecar ready.");
-  } catch (err) {
-    spinner.fail("Setup failed.");
-    throw err;
+  const existingKey = readEnvKey(root);
+  const switchingTeam = !!opts.team;
+  const mustMint = !existingKey || opts.rotate || switchingTeam;
+  let token = existingKey ?? "";
+  if (mustMint) {
+    const spinner = (0, import_ora13.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    try {
+      const out = await admin({
+        method: "POST",
+        path: `/teams/${encodeURIComponent(teamId)}/sidecar/setup`,
+        summary: `Set up sidecar for team ${teamName ?? teamId}`
+      });
+      token = out.token;
+      spinner.succeed(existingKey ? `Sidecar re-established on team ${teamName ?? teamId}.` : "Sidecar ready.");
+    } catch (err) {
+      spinner.fail("Setup failed.");
+      throw err;
+    }
+  } else {
+    console.log(import_chalk28.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_TOKEN) \u2014 gitignored`);
+  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
   console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState}`);
   let inspectorPath = null;
@@ -3191,15 +3449,33 @@ async function runSidecar(opts) {
   console.log(`  3. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze origins")}`);
   console.log(`  4. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path3.dirname(inspectorPath)} before shipping)`);
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk28.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze origins approve <origin>\`.`));
+  console.log("");
+  console.log(import_chalk28.default.dim("  Manage:  apiblaze origins            (list/approve/deny/remove)"));
+  console.log(import_chalk28.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk28.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk28.default.yellow("  \u26A0 APIBLAZE_TOKEN is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk28.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
   console.log(import_chalk28.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
 var import_chalk29 = __toESM(require("chalk"));
 var import_ora14 = __toESM(require("ora"));
+var fs8 = __toESM(require("fs"));
+var path5 = __toESM(require("path"));
+init_auth();
+init_api();
+function readEnvKey2() {
+  try {
+    const s = fs8.readFileSync(path5.join(process.cwd(), ".env.local"), "utf8");
+    const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
+    return m ? m[1].trim() : null;
+  } catch {
+    return null;
+  }
+}
 async function runOriginsList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
   const out = await admin({
@@ -3230,6 +3506,22 @@ Candidates \u2014 going direct, not yet approved (${candidates.length})`));
   }
 }
 async function runOriginsApprove(origin, opts) {
+  if (!loadCredentials()) {
+    const key = readEnvKey2();
+    if (!key) {
+      console.error(import_chalk29.default.red("Not logged in and no .env.local APIBLAZE_API_KEY found. Run `apiblaze init` first."));
+      process.exit(1);
+    }
+    const spinner2 = (0, import_ora14.default)(`Approving ${origin} (anonymous)...`).start();
+    try {
+      const out = await sidecarApproveAnonymous(key, origin.replace(/^https?:\/\//, ""));
+      spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
+    } catch (err) {
+      spinner2.fail("Approve failed.");
+      throw err;
+    }
+    return;
+  }
   const { teamId } = await resolveTeam(opts.team);
   const spinner = (0, import_ora14.default)(`Approving ${origin}...`).start();
   try {
@@ -3257,6 +3549,17 @@ async function runOriginsDeny(origin, opts) {
     throw err;
   }
 }
+async function runOriginsRemove(origin, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora14.default)(`Removing the proxy for ${origin}...`).start();
+  try {
+    await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
+    spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
+  } catch (err) {
+    spinner.fail("Remove failed.");
+    throw err;
+  }
+}
 
 // src/index.ts
 var program = new import_commander.Command();
@@ -3285,7 +3588,7 @@ program.command("login").description("Authenticate with APIblaze").action(async
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate(opts);
   } catch (err) {
@@ -3297,10 +3600,11 @@ var agent = program.command("agent").description("Chat with an assistant that bu
 agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false })));
+program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("--rotate", "Mint a fresh invoke key even if one already exists").option("--new-session", "Start a fresh anonymous session (logged-out only)").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false, rotate: opts.rotate, newSession: opts.newSession })));
 var origins = program.command("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
 origins.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
 origins.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
+origins.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
 program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);

package/dist/sidecar/index.d.mts

@@ -1,5 +1,5 @@
 /**
- * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * apiblaze/sidecar — the egress sidecar (observe → approve model).
  * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
  *
  *   // instrumentation.ts
@@ -17,6 +17,8 @@ interface SidecarOptions {
     exclude?: string[];
     include?: string[];
     quiet?: boolean;
+    /** Explicit on/off. Overrides the APIBLAZE_SIDECAR env toggle when set. */
+    enabled?: boolean;
 }
 declare function register(opts?: SidecarOptions): void;
 declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;

package/dist/sidecar/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * apiblaze/sidecar — the egress interceptor (observe → approve model).
+ * apiblaze/sidecar — the egress sidecar (observe → approve model).
  * Spec: specs/sidecar/apiblaze-sidecar-spec.md §3.
  *
  *   // instrumentation.ts
@@ -17,6 +17,8 @@ interface SidecarOptions {
     exclude?: string[];
     include?: string[];
     quiet?: boolean;
+    /** Explicit on/off. Overrides the APIBLAZE_SIDECAR env toggle when set. */
+    enabled?: boolean;
 }
 declare function register(opts?: SidecarOptions): void;
 declare function withApiblaze<T extends Record<string, unknown>>(nextConfig?: T): T;

package/dist/sidecar/index.js

@@ -53,6 +53,7 @@ var NOISE_DENYLIST = [
   "registry.npmjs.org",
   "pypi.org"
 ];
+var OFF_VALUES = /* @__PURE__ */ new Set(["off", "false", "0", "no", "disabled"]);
 var installed = false;
 function canonicalOrigin(input) {
   try {
@@ -83,9 +84,14 @@ function isPrivateOrLocal(host) {
 }
 function register(opts) {
   if (installed) return;
-  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  const off = opts?.enabled === false || opts?.enabled === void 0 && OFF_VALUES.has((process.env.APIBLAZE_SIDECAR ?? "").trim().toLowerCase());
+  if (off) {
+    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
+    return;
+  }
+  const token = opts?.token ?? process.env.APIBLAZE_API_KEY ?? process.env.APIBLAZE_TOKEN;
   if (!token) {
-    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
     return;
   }
   const original = globalThis.fetch;
@@ -121,42 +127,55 @@ function register(opts) {
     if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
     return true;
   };
+  const urlOf = (input) => {
+    if (typeof input === "string") return input;
+    if (input instanceof URL) return input.href;
+    if (input && typeof input === "object" && typeof input.url === "string") return input.url;
+    return null;
+  };
   const wrapped = async (input, init) => {
     try {
-      const req = new Request(input, init);
-      const url = new URL(req.url);
-      if (shouldConsider(url)) {
-        const origin = canonicalOrigin(url.origin);
-        if (origin) {
-          const base = routes[origin];
-          if (base) {
+      const urlStr = urlOf(input);
+      if (urlStr) {
+        const url = new URL(urlStr);
+        if (shouldConsider(url)) {
+          const origin = canonicalOrigin(url.origin);
+          if (origin) {
+            const base = routes[origin];
+            if (base) {
+              if (!seen.has(origin)) {
+                seen.add(origin);
+                if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+              }
+              const isReq = input instanceof Request;
+              const headers = new Headers(isReq ? input.headers : void 0);
+              if (init?.headers) new Headers(init.headers).forEach((v, k) => headers.set(k, v));
+              const appKey = headers.get("x-api-key");
+              if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+              headers.set("x-api-key", token);
+              const target = `${base}${url.pathname}${url.search}`;
+              const body = init?.body ?? (isReq ? input.body : void 0);
+              const nextInit = {
+                method: init?.method ?? (isReq ? input.method : "GET"),
+                headers,
+                body,
+                signal: init?.signal ?? (isReq ? input.signal : void 0),
+                redirect: init?.redirect ?? (isReq ? input.redirect : void 0),
+                credentials: init?.credentials ?? (isReq ? input.credentials : void 0)
+              };
+              if (body) nextInit.duplex = "half";
+              return original(target, nextInit);
+            }
             if (!seen.has(origin)) {
               seen.add(origin);
-              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it`);
+              reportObserved(origin);
             }
-            const headers = new Headers(req.headers);
-            const appKey = headers.get("x-api-key");
-            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
-            headers.set("x-api-key", token);
-            const target = `${base}${url.pathname}${url.search}`;
-            return original(target, {
-              method: req.method,
-              headers,
-              body: req.body,
-              redirect: "manual",
-              duplex: req.body ? "half" : void 0
-              // streaming request bodies
-            });
-          }
-          if (!seen.has(origin)) {
-            seen.add(origin);
-            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
-            reportObserved(origin);
           }
         }
       }
     } catch (err) {
-      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
+      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
     }
     return original(input, init);
   };

package/dist/sidecar/index.mjs

@@ -27,6 +27,7 @@ var NOISE_DENYLIST = [
   "registry.npmjs.org",
   "pypi.org"
 ];
+var OFF_VALUES = /* @__PURE__ */ new Set(["off", "false", "0", "no", "disabled"]);
 var installed = false;
 function canonicalOrigin(input) {
   try {
@@ -57,9 +58,14 @@ function isPrivateOrLocal(host) {
 }
 function register(opts) {
   if (installed) return;
-  const token = opts?.token ?? process.env.APIBLAZE_TOKEN;
+  const off = opts?.enabled === false || opts?.enabled === void 0 && OFF_VALUES.has((process.env.APIBLAZE_SIDECAR ?? "").trim().toLowerCase());
+  if (off) {
+    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
+    return;
+  }
+  const token = opts?.token ?? process.env.APIBLAZE_API_KEY ?? process.env.APIBLAZE_TOKEN;
   if (!token) {
-    if (!opts?.quiet) console.warn("[apiblaze/sidecar] APIBLAZE_TOKEN not set \u2014 interceptor OFF (fetches pass through unchanged).");
+    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
     return;
   }
   const original = globalThis.fetch;
@@ -95,42 +101,55 @@ function register(opts) {
     if (include.length > 0 && !include.some((g) => hostMatchesGlob(host, g))) return false;
     return true;
   };
+  const urlOf = (input) => {
+    if (typeof input === "string") return input;
+    if (input instanceof URL) return input.href;
+    if (input && typeof input === "object" && typeof input.url === "string") return input.url;
+    return null;
+  };
   const wrapped = async (input, init) => {
     try {
-      const req = new Request(input, init);
-      const url = new URL(req.url);
-      if (shouldConsider(url)) {
-        const origin = canonicalOrigin(url.origin);
-        if (origin) {
-          const base = routes[origin];
-          if (base) {
+      const urlStr = urlOf(input);
+      if (urlStr) {
+        const url = new URL(urlStr);
+        if (shouldConsider(url)) {
+          const origin = canonicalOrigin(url.origin);
+          if (origin) {
+            const base = routes[origin];
+            if (base) {
+              if (!seen.has(origin)) {
+                seen.add(origin);
+                if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+              }
+              const isReq = input instanceof Request;
+              const headers = new Headers(isReq ? input.headers : void 0);
+              if (init?.headers) new Headers(init.headers).forEach((v, k) => headers.set(k, v));
+              const appKey = headers.get("x-api-key");
+              if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
+              headers.set("x-api-key", token);
+              const target = `${base}${url.pathname}${url.search}`;
+              const body = init?.body ?? (isReq ? input.body : void 0);
+              const nextInit = {
+                method: init?.method ?? (isReq ? input.method : "GET"),
+                headers,
+                body,
+                signal: init?.signal ?? (isReq ? input.signal : void 0),
+                redirect: init?.redirect ?? (isReq ? input.redirect : void 0),
+                credentials: init?.credentials ?? (isReq ? input.credentials : void 0)
+              };
+              if (body) nextInit.duplex = "half";
+              return original(target, nextInit);
+            }
             if (!seen.has(origin)) {
               seen.add(origin);
-              if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+              if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it`);
+              reportObserved(origin);
             }
-            const headers = new Headers(req.headers);
-            const appKey = headers.get("x-api-key");
-            if (appKey) headers.set("x-abz-fwd-x-api-key", appKey);
-            headers.set("x-api-key", token);
-            const target = `${base}${url.pathname}${url.search}`;
-            return original(target, {
-              method: req.method,
-              headers,
-              body: req.body,
-              redirect: "manual",
-              duplex: req.body ? "half" : void 0
-              // streaming request bodies
-            });
-          }
-          if (!seen.has(origin)) {
-            seen.add(origin);
-            if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve at your dashboard to route it`);
-            reportObserved(origin);
           }
         }
       }
     } catch (err) {
-      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after interceptor error:", err?.message);
+      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
     }
     return original(input, init);
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.6.0",
+  "version": "0.7.2",
   "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",