apiblaze 0.9.0 → 0.10.0

package/dist/index.js

@@ -305,7 +305,7 @@ var import_commander = require("commander");
 var import_chalk30 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.9.0";
+var version = "0.10.0";
 
 // src/index.ts
 init_types();
@@ -3266,11 +3266,31 @@ function upsertEnvLocal(root, token) {
 `;
   if (!/^APIBLAZE_SIDECAR=/m.test(next)) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR=on
+`;
+  }
+  if (!/^APIBLAZE_SIDECAR_VERBOSE=/m.test(next)) {
+    next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
   fs7.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
+function installSidecarPackage(root) {
+  if (fs7.existsSync(path4.join(root, "node_modules", "apiblaze", "package.json"))) {
+    console.log(`  ${import_chalk28.default.green("\u2713")} apiblaze package already installed`);
+    return;
+  }
+  const has = (f) => fs7.existsSync(path4.join(root, f));
+  const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
+  const spinner = (0, import_ora13.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  try {
+    const { execSync } = require("child_process");
+    execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
+    spinner.succeed("Installed apiblaze (the sidecar runtime).");
+  } catch {
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk28.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk28.default.cyan("npm run dev")}.`);
+  }
+}
 function readEnvKey(root) {
   try {
     const s = fs7.readFileSync(path4.join(root, ".env.local"), "utf8");
@@ -3328,16 +3348,46 @@ async function probe(u: string) {
 }
 
 export default async function Page() {
-  if (process.env.NODE_ENV === "production") return <main style={{padding:24}}>Inspector disabled in production.</main>;
-  const r = await probe("https://httpbingo.org/headers");
+  if (process.env.NODE_ENV === "production") return <main style={{ padding: 24 }}>Inspector disabled in production.</main>;
+  const r: any = await probe("https://httpbingo.org/headers");
+  const hdrs = (r && r.echo && r.echo.headers) || {};
+  // The sidecar sets X-Abz-Fwd-X-Api-Key ONLY when it routes a call through a proxy.
+  const routed = Boolean(hdrs["X-Abz-Fwd-X-Api-Key"] || hdrs["x-abz-fwd-x-api-key"]);
+  const card: any = { background: "#0b0f17", border: "1px solid #232a36", borderRadius: 14, padding: 20 };
+  const pill: any = { display: "inline-block", padding: "4px 10px", borderRadius: 999, fontSize: 12, fontWeight: 700 };
   return (
-    <main style={{ fontFamily: "ui-monospace, monospace", padding: 24, lineHeight: 1.6 }}>
-      <h1>APIblaze sidecar inspector</h1>
-      <p>Fetched httpbingo through the sidecar. If httpbingo.org is <b>not yet approved</b>, this went
-         <b> direct</b> and now appears as a candidate in your dashboard \u2014 approve it, wait ~5 min, reload,
-         and it will route through APIblaze (the echo below will show it arrived via your proxy).</p>
-      <pre>{JSON.stringify(r, null, 2)}</pre>
-      <p style={{opacity:.6}}>Delete this folder before shipping.</p>
+    <main style={{ fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace", background: "#070a10", minHeight: "100vh", padding: 32, color: "#e6e9ef", lineHeight: 1.6 }}>
+      <div style={{ maxWidth: 720, margin: "0 auto" }}>
+        <h1 style={{ fontSize: 20, margin: "0 0 6px" }}>APIblaze sidecar \u2014 live inspector</h1>
+        <p style={{ color: "#9aa4b2", margin: "0 0 20px", fontSize: 14 }}>
+          This dev-only page makes one real call to <b style={{ color: "#e6e9ef" }}>httpbingo.org</b> from your server so you can watch the sidecar work. Every external fetch your app makes either <b>routes</b> through APIblaze (once you approve that origin) or goes <b>direct</b>, untouched.
+        </p>
+        <div style={card}>
+          <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", gap: 12, marginBottom: 14, flexWrap: "wrap" }}>
+            <span style={{ fontSize: 15 }}>GET https://httpbingo.org/headers</span>
+            {routed
+              ? <span style={{ ...pill, background: "#0f2e20", color: "#4ade80" }}>\u25CF routed through APIblaze</span>
+              : <span style={{ ...pill, background: "#33280c", color: "#fbbf24" }}>\u25CB going direct \u2014 not approved</span>}
+          </div>
+          {routed ? (
+            <p style={{ color: "#9aa4b2", fontSize: 14, margin: 0 }}>
+              This request <b style={{ color: "#4ade80" }}>routed through your APIblaze proxy</b> \u2014 with auth, rate limits, and observability \u2014 and your app code never changed. The proxy swapped in your invoke key and preserved your original one (see <code>X-Abz-Fwd-X-Api-Key</code> in the raw response).
+            </p>
+          ) : (
+            <div style={{ color: "#9aa4b2", fontSize: 14 }}>
+              <p style={{ margin: "0 0 10px" }}>This call went <b style={{ color: "#fbbf24" }}>direct</b> \u2014 httpbingo.org isn&apos;t approved yet, so the sidecar left it untouched and reported it as a candidate.</p>
+              <p style={{ margin: "0 0 6px", color: "#e6e9ef" }}>Route it through APIblaze:</p>
+              <pre style={{ background: "#070a10", border: "1px solid #232a36", borderRadius: 8, padding: 12, margin: 0, color: "#8ab4ff", overflowX: "auto" }}>npx apiblaze sidecar approve httpbingo.org</pre>
+              <p style={{ margin: "10px 0 0" }}>\u2026wait ~5 min, then <b style={{ color: "#e6e9ef" }}>reload</b>. The badge above turns green.</p>
+            </div>
+          )}
+        </div>
+        <details style={{ marginTop: 16, color: "#9aa4b2", fontSize: 13 }}>
+          <summary style={{ cursor: "pointer" }}>Raw response {r && r.status ? "(HTTP " + r.status + ")" : "(error)"}</summary>
+          <pre style={{ background: "#0b0f17", border: "1px solid #232a36", borderRadius: 10, padding: 14, overflowX: "auto", marginTop: 8 }}>{JSON.stringify(r, null, 2)}</pre>
+        </details>
+        <p style={{ color: "#5b6472", fontSize: 12, marginTop: 20 }}>Dev-only \u2014 delete <code>app/abz-inspector</code> before shipping.</p>
+      </div>
     </main>
   );
 }
@@ -3378,6 +3428,7 @@ async function runAnonymousInit(root, router, opts) {
   ensureGitignored(root);
   console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
@@ -3385,9 +3436,9 @@ async function runAnonymousInit(root, router, opts) {
   }
   console.log("");
   console.log(import_chalk28.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk28.default.cyan("npm install apiblaze")} then ${import_chalk28.default.cyan("npm run dev")} and use your app.`);
+  console.log(`  1. ${import_chalk28.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk28.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
   console.log(import_chalk28.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
   console.log(`       ${import_chalk28.default.cyan("apiblaze login")}  then  ${import_chalk28.default.cyan("apiblaze claim")}   ${import_chalk28.default.dim("(no code needed here)")}`);
@@ -3410,6 +3461,7 @@ async function runSidecar(opts) {
     ensureGitignored(root);
     console.log(`  ${import_chalk28.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
     console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    installSidecarPackage(root);
     console.log(import_chalk28.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
@@ -3440,6 +3492,7 @@ async function runSidecar(opts) {
   console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
   console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
@@ -3447,15 +3500,14 @@ async function runSidecar(opts) {
   }
   console.log("");
   console.log(import_chalk28.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk28.default.cyan("npm install apiblaze")}`);
-  console.log(`  2. ${import_chalk28.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  3. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze origins")}`);
-  console.log(`  4. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze origins approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(`  1. ${import_chalk28.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
   if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk28.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze origins approve <origin>\`.`));
+  if (switchingTeam) console.log(import_chalk28.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk28.default.dim("  Manage:  apiblaze origins            (list/approve/deny/remove)"));
+  console.log(import_chalk28.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
   console.log(import_chalk28.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
   console.log(import_chalk28.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
@@ -3503,8 +3555,8 @@ Candidates \u2014 going direct, not yet approved (${candidates.length})`));
   }
   if (candidates.length) {
     console.log(import_chalk29.default.dim(`
-  Approve:  apiblaze origins approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk29.default.dim(`  Dismiss:  apiblaze origins deny ${candidates[0].origin.replace("https://", "")}`));
+  Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk29.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
@@ -3603,7 +3655,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
 program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("--rotate", "Mint a fresh invoke key even if one already exists").option("--new-session", "Start a fresh anonymous session (logged-out only)").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false, rotate: opts.rotate, newSession: opts.newSession })));
-var origins = program.command("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
+var origins = program.command("sidecar").alias("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
 origins.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
 origins.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
 origins.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
@@ -3684,7 +3736,7 @@ spec.command("get").description("Print the current OpenAPI document").argument("
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
 var HELP_GROUPS = [
   { title: "Chat", commands: ["agent"] },
-  { title: "Setup", commands: ["login", "create", "init", "origins", "dev", "claim", "team", "whoami", "logout"] },
+  { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
   { title: "Control plane commands", commands: ["projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },

package/dist/sidecar/index.js

@@ -84,14 +84,15 @@ function isPrivateOrLocal(host) {
 }
 function register(opts) {
   if (installed) return;
+  const quiet = opts?.quiet ?? (process.env.APIBLAZE_SIDECAR_VERBOSE ?? "true").trim().toLowerCase() === "false";
   const off = opts?.enabled === false || opts?.enabled === void 0 && OFF_VALUES.has((process.env.APIBLAZE_SIDECAR ?? "").trim().toLowerCase());
   if (off) {
-    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
+    if (!quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
     return;
   }
   const token = opts?.token ?? process.env.APIBLAZE_API_KEY ?? process.env.APIBLAZE_TOKEN;
   if (!token) {
-    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
+    if (!quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
     return;
   }
   const original = globalThis.fetch;
@@ -145,7 +146,7 @@ function register(opts) {
             if (base) {
               if (!seen.has(origin)) {
                 seen.add(origin);
-                if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+                if (!quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
               }
               const isReq = input instanceof Request;
               const headers = new Headers(isReq ? input.headers : void 0);
@@ -168,21 +169,21 @@ function register(opts) {
             }
             if (!seen.has(origin)) {
               seen.add(origin);
-              if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it`);
+              if (!quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it: npx apiblaze sidecar approve ${url.hostname}`);
               reportObserved(origin);
             }
           }
         }
       }
     } catch (err) {
-      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
+      if (!quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
     }
     return original(input, init);
   };
   wrapped.__apiblaze = true;
   globalThis.fetch = wrapped;
   installed = true;
-  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
+  if (!quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
 }
 function withApiblaze(nextConfig = {}) {
   register();

package/dist/sidecar/index.mjs

@@ -58,14 +58,15 @@ function isPrivateOrLocal(host) {
 }
 function register(opts) {
   if (installed) return;
+  const quiet = opts?.quiet ?? (process.env.APIBLAZE_SIDECAR_VERBOSE ?? "true").trim().toLowerCase() === "false";
   const off = opts?.enabled === false || opts?.enabled === void 0 && OFF_VALUES.has((process.env.APIBLAZE_SIDECAR ?? "").trim().toLowerCase());
   if (off) {
-    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
+    if (!quiet) console.log("[apiblaze/sidecar] off (APIBLAZE_SIDECAR=off) \u2014 fetches go direct.");
     return;
   }
   const token = opts?.token ?? process.env.APIBLAZE_API_KEY ?? process.env.APIBLAZE_TOKEN;
   if (!token) {
-    if (!opts?.quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
+    if (!quiet) console.log("[apiblaze/sidecar] off (no APIBLAZE_API_KEY set) \u2014 fetches go direct.");
     return;
   }
   const original = globalThis.fetch;
@@ -119,7 +120,7 @@ function register(opts) {
             if (base) {
               if (!seen.has(origin)) {
                 seen.add(origin);
-                if (!opts?.quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
+                if (!quiet) console.log(`[apiblaze/sidecar] routed \u2192 ${origin}`);
               }
               const isReq = input instanceof Request;
               const headers = new Headers(isReq ? input.headers : void 0);
@@ -142,21 +143,21 @@ function register(opts) {
             }
             if (!seen.has(origin)) {
               seen.add(origin);
-              if (!opts?.quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it`);
+              if (!quiet) console.log(`[apiblaze/sidecar] direct (not approved) \u2192 ${origin} \xB7 approve to route it: npx apiblaze sidecar approve ${url.hostname}`);
               reportObserved(origin);
             }
           }
         }
       }
     } catch (err) {
-      if (!opts?.quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
+      if (!quiet) console.warn("[apiblaze/sidecar] passthrough after sidecar error:", err?.message);
     }
     return original(input, init);
   };
   wrapped.__apiblaze = true;
   globalThis.fetch = wrapped;
   installed = true;
-  if (!opts?.quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
+  if (!quiet) console.log("[apiblaze/sidecar] active \u2014 approved origins route through APIblaze; the rest go direct.");
 }
 function withApiblaze(nextConfig = {}) {
   register();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command",
   "keywords": [
     "apiblaze",