apiblaze 0.7.2 → 0.9.0

package/dist/index.js

@@ -31,6 +31,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ApiError: () => ApiError
+});
 var ApiError;
 var init_types = __esm({
   "src/types.ts"() {
@@ -95,7 +99,6 @@ var api_exports = {};
 __export(api_exports, {
   agentCall: () => agentCall,
   checkProxyName: () => checkProxyName,
-  claimProxy: () => claimProxy,
   claimTeam: () => claimTeam,
   createProxy: () => createProxy,
   createProxyAnonymous: () => createProxyAnonymous,
@@ -104,13 +107,12 @@ __export(api_exports, {
   getProjects: () => getProjects,
   getTeams: () => getTeams,
   putDevTunnel: () => putDevTunnel,
-  sidecarApproveAnonymous: () => sidecarApproveAnonymous,
   sidecarInitAnonymous: () => sidecarInitAnonymous
 });
-async function createProxyAnonymous(body, anonSession) {
+async function createProxyAnonymous(body) {
   const res = await fetch(`${PUBLIC_API_BASE}/proxy`, {
     method: "POST",
-    headers: { "Content-Type": "application/json", ...anonSession ? { "X-Abz-Anon-Session": anonSession } : {} },
+    headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
   });
   if (!res.ok) {
@@ -124,9 +126,9 @@ async function createProxyAnonymous(body, anonSession) {
   }
   return res.json();
 }
-async function apiFetch(path6, options = {}) {
+async function apiFetch(path5, options = {}) {
   const token = getAccessToken();
-  const url = `${DASHBOARD_BASE}${path6}`;
+  const url = `${DASHBOARD_BASE}${path5}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -152,12 +154,12 @@ async function apiFetch(path6, options = {}) {
   }
   return res.json();
 }
-async function agentCall(path6, method, body) {
+async function agentCall(path5, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path6, method, body })
+    body: JSON.stringify({ path: path5, method, body })
   });
   let data = null;
   try {
@@ -191,38 +193,22 @@ async function createProxy(payload) {
     body: JSON.stringify(payload)
   });
 }
-async function claimProxy(claimCode, teamId) {
-  return apiFetch("/api/cli/claim", {
-    method: "POST",
-    body: JSON.stringify({ claimCode, team_id: teamId })
-  });
-}
-async function claimTeam(code) {
+async function claimTeam(code, teamId) {
   return apiFetch("/api/cli/claim-team", {
     method: "POST",
-    body: JSON.stringify({ code })
+    body: JSON.stringify({ code, ...teamId ? { team_id: teamId } : {} })
   });
 }
-async function sidecarInitAnonymous(anonSession) {
+async function sidecarInitAnonymous() {
   const res = await fetch(`${PUBLIC_API_BASE}/sidecar/init`, {
     method: "POST",
-    headers: { "content-type": "application/json", ...anonSession ? { "X-Abz-Anon-Session": anonSession } : {} },
+    headers: { "content-type": "application/json" },
     body: "{}"
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new ApiError(res.status, data?.error ?? "init_failed", data);
   return data;
 }
-async function sidecarApproveAnonymous(invokeKey, origin) {
-  const res = await fetch(`${PUBLIC_API_BASE}/sidecar/approve`, {
-    method: "POST",
-    headers: { "content-type": "application/json", "x-abz-sidecar-key": invokeKey },
-    body: JSON.stringify({ origin })
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) throw new ApiError(res.status, data?.detail ?? data?.error ?? "approve_failed", data);
-  return data;
-}
 async function putDevTunnel(payload) {
   return apiFetch("/api/cli/dev-tunnel", {
     method: "PUT",
@@ -246,49 +232,71 @@ var init_api = __esm({
   }
 });
 
-// src/lib/anon-session.ts
-var anon_session_exports = {};
-__export(anon_session_exports, {
-  clearAnonSession: () => clearAnonSession,
-  loadAnonSession: () => loadAnonSession,
-  saveAnonSession: () => saveAnonSession
+// src/lib/anon-cred.ts
+var anon_cred_exports = {};
+__export(anon_cred_exports, {
+  clearAnonCred: () => clearAnonCred,
+  cpFetch: () => cpFetch,
+  loadAnonCred: () => loadAnonCred,
+  saveAnonCred: () => saveAnonCred
 });
-function loadAnonSession() {
+function loadAnonCred() {
   try {
-    const s = JSON.parse(fs3.readFileSync(SESSION_PATH, "utf8"));
-    return s?.anon_session ? s : null;
+    const c = JSON.parse(fs2.readFileSync(FILE, "utf8"));
+    return c?.cp_key ? c : null;
   } catch {
     return null;
   }
 }
-function saveAnonSession(anon_session, claim_code) {
+function saveAnonCred(cp_key, team_id, claim_code) {
   try {
-    fs3.mkdirSync(DIR, { recursive: true });
-    const prev = loadAnonSession();
+    fs2.mkdirSync(DIR, { recursive: true });
+    const prev = loadAnonCred();
     const merged = {
-      anon_session,
+      cp_key,
+      team_id,
       claim_code: claim_code ?? prev?.claim_code,
       created_at: prev?.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
     };
-    fs3.writeFileSync(SESSION_PATH, JSON.stringify(merged, null, 2));
+    fs2.writeFileSync(FILE, JSON.stringify(merged, null, 2));
+  } catch {
+  }
+}
+function clearAnonCred() {
+  try {
+    fs2.unlinkSync(FILE);
   } catch {
   }
 }
-function clearAnonSession() {
+async function cpFetch(cpKey, apiPath, opts = {}) {
+  const res = await fetch(`${CP_EDGE}${apiPath}`, {
+    ...opts,
+    headers: { "Content-Type": "application/json", "X-API-Key": cpKey, ...opts.headers ?? {} }
+  });
+  const text = await res.text();
+  let parsed;
   try {
-    fs3.unlinkSync(SESSION_PATH);
+    parsed = text ? JSON.parse(text) : void 0;
   } catch {
+    parsed = text;
+  }
+  if (!res.ok) {
+    const msg = parsed && typeof parsed === "object" && (parsed.details ?? parsed.error) || res.statusText;
+    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), parsed);
   }
+  return parsed;
 }
-var fs3, path2, os2, DIR, SESSION_PATH;
-var init_anon_session = __esm({
-  "src/lib/anon-session.ts"() {
+var fs2, path2, os2, DIR, FILE, CP_EDGE;
+var init_anon_cred = __esm({
+  "src/lib/anon-cred.ts"() {
     "use strict";
-    fs3 = __toESM(require("fs"));
+    fs2 = __toESM(require("fs"));
     path2 = __toESM(require("path"));
     os2 = __toESM(require("os"));
+    init_types();
     DIR = path2.join(os2.homedir(), ".apiblaze");
-    SESSION_PATH = path2.join(DIR, "anon.json");
+    FILE = path2.join(DIR, "anon.json");
+    CP_EDGE = process.env.APIBLAZE_API_BASE ? `${process.env.APIBLAZE_API_BASE}/1.0.0/prod` : "https://api.apiblaze.com/1.0.0/prod";
   }
 });
 
@@ -297,7 +305,7 @@ var import_commander = require("commander");
 var import_chalk30 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.7.2";
+var version = "0.9.0";
 
 // src/index.ts
 init_types();
@@ -438,6 +446,37 @@ ${import_chalk2.default.cyan("\u2192")} Team: ${import_chalk2.default.bold(teamN
     teamName
   });
   console.log(import_chalk2.default.green("\n\u2714 Logged in successfully!"));
+  await offerClaimPendingAnon();
+}
+async function offerClaimPendingAnon() {
+  const { loadAnonCred: loadAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
+  const cred = loadAnonCred2();
+  if (!cred?.claim_code) return;
+  let doClaim = true;
+  if (process.stdin.isTTY) {
+    const { default: inquirer2 } = await import("inquirer");
+    const { yes } = await inquirer2.prompt([{
+      type: "confirm",
+      name: "yes",
+      message: "You created proxies anonymously before logging in. Claim them into this account?",
+      default: true
+    }]);
+    doClaim = yes;
+  }
+  if (!doClaim) {
+    console.log(import_chalk2.default.dim("  Left unclaimed \u2014 run `apiblaze claim` anytime to keep them (they GC after inactivity)."));
+    return;
+  }
+  try {
+    const { claimTeam: claimTeam2 } = await Promise.resolve().then(() => (init_api(), api_exports));
+    const t = await claimTeam2(cred.claim_code);
+    clearAnonCred2();
+    console.log(import_chalk2.default.green(`  \u2714 Claimed your anonymous proxies into your account (team ${import_chalk2.default.bold(t.team_id)}).`));
+  } catch (err) {
+    const { ApiError: ApiError2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+    const why = err instanceof ApiError2 ? err.message : err instanceof Error ? err.message : "error";
+    console.log(import_chalk2.default.yellow(`  Couldn't auto-claim (${why}). Run \`apiblaze claim\` to retry.`));
+  }
 }
 
 // src/commands/dev.ts
@@ -541,11 +580,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path6) {
-  const q = path6.indexOf("?");
-  if (q < 0) return path6;
-  const base = path6.slice(0, q);
-  const query = path6.slice(q + 1);
+function maskPath(path5) {
+  const q = path5.indexOf("?");
+  if (q < 0) return path5;
+  const base = path5.slice(0, q);
+  const query = path5.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -1470,19 +1509,28 @@ async function runAnonymousCreate(opts) {
   if (opts.displayName) body.display_name = opts.displayName;
   if (opts.apiversion) body.api_version = opts.apiversion;
   if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
-  const { loadAnonSession: loadAnonSession2, saveAnonSession: saveAnonSession2, clearAnonSession: clearAnonSession2 } = await Promise.resolve().then(() => (init_anon_session(), anon_session_exports));
-  if (opts.newSession) clearAnonSession2();
-  const prior = loadAnonSession2();
-  const spinner = !opts.json ? (0, import_ora4.default)(prior ? "Creating proxy (adding to your anonymous session)..." : "Creating proxy...").start() : null;
+  const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
+  if (opts.newSession) clearAnonCred2();
+  const cred = loadAnonCred2();
+  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
   let result;
   try {
-    result = await createProxyAnonymous(body, prior?.anon_session);
+    if (cred) {
+      result = await cpFetch2(cred.cp_key, "/projects", { method: "POST", body: JSON.stringify(body) });
+      if (Array.isArray(result.endpoints)) {
+        result.endpoints = result.endpoints.map((e) => e.replace(/:\/\/[^/]+/, `://${result.project_id}.tryabz.run`));
+      }
+    } else {
+      result = await createProxyAnonymous(body);
+      if (result.cp_key && result.team_id) {
+        saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
+      }
+    }
     spinner?.succeed(import_chalk6.default.green("Proxy created!"));
   } catch (err) {
     spinner?.fail("Failed to create proxy.");
     throw err;
   }
-  if (result.anon_session) saveAnonSession2(result.anon_session, result.team_claim_code);
   const version2 = result.api_version || "1.0.0";
   const keys = result.api_keys ?? {};
   const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
@@ -1509,12 +1557,13 @@ async function runAnonymousCreate(opts) {
     console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
   }
   if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
-  if (result.team_claim_code) {
+  const claimCode = result.claim_code || cred?.claim_code;
+  if (claimCode) {
     console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} All your anonymous proxies`);
-    console.log(`    on this machine share ONE team. To keep them all:`);
-    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}  then  ${import_chalk6.default.cyan("apiblaze claim")}   ${import_chalk6.default.dim("(no code needed here)")}`);
-    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${result.team_claim_code}`));
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} Everything you create`);
+    console.log(`    with the CP key shares ONE workspace. To keep it all in one shot:`);
+    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}   ${import_chalk6.default.dim("(prompts to claim your workspace into your account)")}`);
+    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${claimCode}  (add --team <name> to merge into an existing team)`));
   } else if (result.claim_url) {
     console.log();
     console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
@@ -1526,7 +1575,7 @@ async function runAnonymousCreate(opts) {
 // src/commands/claim.ts
 var import_chalk7 = __toESM(require("chalk"));
 init_auth();
-init_anon_session();
+init_anon_cred();
 init_api();
 init_types();
 function fail2(message) {
@@ -1535,100 +1584,55 @@ function fail2(message) {
 }
 async function runClaim(claimCodeArg, opts) {
   const creds = loadCredentials();
-  if (!creds) {
-    fail2("Not logged in. Run `apiblaze login` first, then claim.");
-  }
+  if (!creds) fail2("Not logged in. Run `apiblaze login` first, then claim.");
   let claimCode = (claimCodeArg ?? "").trim();
-  let fromLocalSession = false;
+  let fromLocal = false;
   if (!claimCode) {
-    const sess = loadAnonSession();
-    if (sess?.claim_code) {
-      claimCode = sess.claim_code;
-      fromLocalSession = true;
+    const c = loadAnonCred();
+    if (c?.claim_code) {
+      claimCode = c.claim_code;
+      fromLocal = true;
     }
   }
   if (!claimCode && process.stdin.isTTY) {
     const { default: inquirer2 } = await import("inquirer");
-    const { code } = await inquirer2.prompt([{
-      type: "input",
-      name: "code",
-      message: "Claim code (from the create output / claim URL):"
-    }]);
+    const { code } = await inquirer2.prompt([{ type: "input", name: "code", message: "Claim code:" }]);
     claimCode = (code ?? "").trim();
   }
-  if (!claimCode) {
-    fail2("Nothing to claim on this machine. Run `apiblaze claim <code>` with a code, or `apiblaze create`/`init` first.");
+  if (!claimCode) fail2("Nothing to claim on this machine. Run `apiblaze claim <code>`, or `apiblaze create`/`init` first.");
+  let targetTeamId;
+  if (opts.team) {
+    const teams = await getTeams().catch(() => []);
+    const match = teams.find((t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase());
+    if (!match) fail2(`Team "${opts.team}" not found. Available: ${teams.map((t) => t.name).join(", ") || "(none)"}.`);
+    targetTeamId = match.teamId;
   }
+  let res;
   try {
-    const t = await claimTeam(claimCode);
-    if (fromLocalSession) clearAnonSession();
-    if (opts.json) {
-      console.log(JSON.stringify(t, null, 2));
-      return;
-    }
-    console.log(import_chalk7.default.green(`
-\u2714 Claimed the whole team into your account.`));
-    console.log(`  Team: ${import_chalk7.default.bold(t.team_id)}`);
-    console.log(`  Its proxies + keys are now yours. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${t.team_id}`)}.`);
-    console.log(`
-  Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
-    return;
+    res = await claimTeam(claimCode, targetTeamId);
   } catch (err) {
-    if (err instanceof ApiError && err.status !== 404) {
-      const code = typeof err.body === "object" && err.body ? err.body.error : void 0;
-      if (code === "already_claimed") fail2("That claim code has already been used.");
-      if (code === "expired") fail2("That claim code has expired. Create a fresh setup with `apiblaze init`.");
-      if (code === "not_claimable") fail2("That team can no longer be claimed (it already belongs to an account).");
+    if (err instanceof ApiError) {
+      const c = typeof err.body === "object" && err.body ? err.body.error : void 0;
+      if (c === "already_claimed") fail2("That claim code has already been used.");
+      if (c === "expired") fail2("That claim code has expired. Create a fresh setup with `apiblaze create`/`init`.");
+      if (c === "not_claimable") fail2("That workspace can no longer be claimed (it already belongs to an account).");
+      if (err.status === 404) fail2("That claim code isn't valid \u2014 check it and try again.");
+      if (err.status === 403) fail2(`You're not a member of team "${opts.team}".`);
       fail2(`Could not claim: ${err.message}`);
     }
-  }
-  const teams = await getTeams().catch(() => []);
-  if (teams.length === 0) {
-    fail2("No teams found for your account.");
-  }
-  let teamId;
-  if (opts.team) {
-    const match = teams.find(
-      (t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase()
-    );
-    if (!match) {
-      fail2(`Team "${opts.team}" not found. Available: ${teams.map((t) => t.name).join(", ")}.`);
-    }
-    teamId = match.teamId;
-  } else if (creds.teamId && teams.some((t) => t.teamId === creds.teamId)) {
-    teamId = creds.teamId;
-  } else if (teams.length === 1) {
-    teamId = teams[0].teamId;
-  } else if (process.stdin.isTTY) {
-    const { default: inquirer2 } = await import("inquirer");
-    const { picked } = await inquirer2.prompt([{
-      type: "list",
-      name: "picked",
-      message: "Claim into which team?",
-      choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
-    }]);
-    teamId = picked;
-  } else {
-    fail2(`Specify a team: \`apiblaze claim ${claimCode} --team <name|id>\`. Available: ${teams.map((t) => t.name).join(", ")}.`);
-  }
-  const teamName = teams.find((t) => t.teamId === teamId)?.name ?? teamId;
-  let result;
-  try {
-    result = await claimProxy(claimCode, teamId);
-  } catch (err) {
-    if (err instanceof ApiError) fail2(`That claim code isn't valid \u2014 it may be mistyped, already claimed, or expired.`);
     throw err;
   }
+  if (fromLocal) clearAnonCred();
   if (opts.json) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(res, null, 2));
     return;
   }
-  console.log(import_chalk7.default.green(`
-\u2714 Claimed into ${import_chalk7.default.bold(teamName)}.`));
-  if (result.project_id) console.log(`  Project: ${import_chalk7.default.bold(result.project_id)}`);
-  if (result.endpoints?.length) {
-    console.log("  Endpoints:");
-    for (const e of result.endpoints) console.log(`    ${e}`);
+  console.log(import_chalk7.default.green("\n\u2714 Claimed your anonymous workspace into your account."));
+  if (res.merged) {
+    console.log(`  Merged ${import_chalk7.default.bold(String(res.proxy_count ?? ""))} prox${res.proxy_count === 1 ? "y" : "ies"} into team ${import_chalk7.default.bold(res.team_id)}.`);
+  } else {
+    console.log(`  It's now your team ${import_chalk7.default.bold(res.team_id)}. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${res.team_id}`)}.`);
+    console.log(import_chalk7.default.dim(`  (Tip: re-run with --team <name> to merge into an existing team instead.)`));
   }
   console.log(`
   Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
@@ -3358,19 +3362,18 @@ function generateInspector(root, router) {
 }
 async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
-  const { loadAnonSession: loadAnonSession2, saveAnonSession: saveAnonSession2, clearAnonSession: clearAnonSession2 } = await Promise.resolve().then(() => (init_anon_session(), anon_session_exports));
-  if (opts.newSession) clearAnonSession2();
-  const prior = loadAnonSession2();
-  const spinner = (0, import_ora13.default)(prior ? "Adding to your anonymous session..." : "Setting up a sidecar (no login needed)...").start();
+  const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
+  if (opts.newSession) clearAnonCred2();
+  const spinner = (0, import_ora13.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
-    out = await sidecarInitAnonymous2(prior?.anon_session);
+    out = await sidecarInitAnonymous2();
     spinner.succeed("Sidecar ready (anonymous trial).");
   } catch (err) {
     spinner.fail("Setup failed.");
     throw err;
   }
-  if (out.anon_session) saveAnonSession2(out.anon_session, out.claim_code);
+  if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
   console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
@@ -3463,26 +3466,25 @@ async function runSidecar(opts) {
 // src/commands/origins.ts
 var import_chalk29 = __toESM(require("chalk"));
 var import_ora14 = __toESM(require("ora"));
-var fs8 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
 init_auth();
-init_api();
-function readEnvKey2() {
-  try {
-    const s = fs8.readFileSync(path5.join(process.cwd(), ".env.local"), "utf8");
-    const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
-    return m ? m[1].trim() : null;
-  } catch {
-    return null;
-  }
-}
+init_anon_cred();
 async function runOriginsList(opts) {
-  const { teamId, teamName } = await resolveTeam(opts.team);
-  const out = await admin({
-    method: "GET",
-    path: `/teams/${encodeURIComponent(teamId)}/sidecar/candidates`,
-    summary: `List sidecar origins for team ${teamName ?? teamId}`
-  });
+  let out;
+  if (!loadCredentials()) {
+    const cred = loadAnonCred();
+    if (!cred) {
+      console.log(import_chalk29.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      return;
+    }
+    out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
+  } else {
+    const { teamId, teamName } = await resolveTeam(opts.team);
+    out = await admin({
+      method: "GET",
+      path: `/teams/${encodeURIComponent(teamId)}/sidecar/candidates`,
+      summary: `List sidecar origins for team ${teamName ?? teamId}`
+    });
+  }
   if (opts.json) {
     console.log(JSON.stringify(out));
     return;
@@ -3507,14 +3509,14 @@ Candidates \u2014 going direct, not yet approved (${candidates.length})`));
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
-    const key = readEnvKey2();
-    if (!key) {
-      console.error(import_chalk29.default.red("Not logged in and no .env.local APIBLAZE_API_KEY found. Run `apiblaze init` first."));
+    const cred = loadAnonCred();
+    if (!cred) {
+      console.error(import_chalk29.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
     const spinner2 = (0, import_ora14.default)(`Approving ${origin} (anonymous)...`).start();
     try {
-      const out = await sidecarApproveAnonymous(key, origin.replace(/^https?:\/\//, ""));
+      const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
     } catch (err) {
       spinner2.fail("Approve failed.");
@@ -3631,7 +3633,7 @@ program.command("whoami").description("Show who you are \u2014 both API Producer
     process.exit(1);
   }
 });
-program.command("claim").description("Claim an anonymously-created proxy into one of your teams (requires login)").argument("[code]", "Claim code from `create` output / claim URL (prompted if omitted)").option("--team <id|name>", "Team to claim into (defaults to your active team)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (code, opts) => {
+program.command("claim").description("Claim your anonymous workspace into your account (requires login)").argument("[code]", "Claim code from `create`/`init` output (omit to claim this machine's workspace)").option("--team <id|name>", "Merge into this existing team (default: promote to a new team)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (code, opts) => {
   try {
     await runClaim(code, opts);
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",