@abloatai/ablo 0.28.0 → 0.29.0

package/dist/cli.cjs

@@ -212184,11 +212184,11 @@ var require_commonjs2 = __commonJS({
               if (pad) {
                 const need = width - c.length;
                 if (need > 0) {
-                  const z6 = new Array(need + 1).join("0");
+                  const z7 = new Array(need + 1).join("0");
                   if (i < 0) {
-                    c = "-" + z6 + c.slice(1);
+                    c = "-" + z7 + c.slice(1);
                   } else {
-                    c = z6 + c;
+                    c = z7 + c;
                   }
                 }
               }
@@ -276724,8 +276724,8 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
       if (i) process.stdout.write(`${I2}  ${l2}...`);
       else if (t === "timer") process.stdout.write(`${I2}  ${l2} ${O2(g2)}`);
       else {
-        const z6 = ".".repeat(Math.floor(w2)).slice(0, 3);
-        process.stdout.write(`${I2}  ${l2}${z6}`);
+        const z7 = ".".repeat(Math.floor(w2)).slice(0, 3);
+        process.stdout.write(`${I2}  ${l2}${z7}`);
       }
       h2 = h2 + 1 < n.length ? h2 + 1 : 0, w2 = w2 < n.length ? w2 + 0.125 : 0;
     }, r2);
@@ -277262,6 +277262,11 @@ var claimRejectionSchema = import_zod3.z.object({
   heldByClaim: wireClaimSummarySchema.optional(),
   policyReason: import_zod3.z.string().optional()
 });
+var claimLostSchema = import_zod3.z.object({
+  claimId: import_zod3.z.string(),
+  reason: import_zod3.z.enum(["expired", "preempted"]),
+  target: targetRefSchema
+});
 var modelTargetSchema = import_zod3.z.object({
   model: import_zod3.z.string(),
   id: import_zod3.z.string(),
@@ -277476,9 +277481,61 @@ var AbloError = class extends Error {
 function docUrlForCode(code) {
   return `https://docs.abloatai.com/errors#${code}`;
 }
+var AbloAuthenticationError = class extends AbloError {
+  type = "AbloAuthenticationError";
+};
+var AbloPermissionError = class extends AbloError {
+  type = "AbloPermissionError";
+};
+var AbloRateLimitError = class extends AbloError {
+  type = "AbloRateLimitError";
+  retryAfterSeconds;
+  constructor(message, options) {
+    super(message, options);
+    if (options?.retryAfterSeconds !== void 0) {
+      this.retryAfterSeconds = options.retryAfterSeconds;
+    }
+  }
+};
+var AbloIdempotencyError = class extends AbloError {
+  type = "AbloIdempotencyError";
+};
 var AbloValidationError = class extends AbloError {
   type = "AbloValidationError";
 };
+var AbloServerError = class extends AbloError {
+  type = "AbloServerError";
+};
+var AbloStaleContextError = class extends AbloError {
+  type = "AbloStaleContextError";
+  /** Sync id at the caller's `readAt` when the write was attempted. */
+  readAt;
+  /** Entities that received deltas between `readAt` and the write. */
+  conflicts;
+  constructor(message, options) {
+    super(message, options);
+    if (options?.readAt !== void 0) this.readAt = options.readAt;
+    if (options?.conflicts !== void 0) this.conflicts = options.conflicts;
+  }
+};
+var AbloClaimedError = class extends AbloError {
+  type = "AbloClaimedError";
+  claims;
+  constructor(message, options) {
+    super(message, options);
+    if (options?.claims !== void 0) this.claims = options.claims;
+  }
+};
+var CapabilityError = class extends AbloPermissionError {
+  requiredCapability;
+  constructor(code, message, requiredCapability) {
+    super(`${code}: ${message}`, { code });
+    this.name = "CapabilityError";
+    if (requiredCapability !== void 0) {
+      this.requiredCapability = requiredCapability;
+    }
+  }
+};
 var OptionalWireStringSchema = import_zod4.z.preprocess(
   (value) => typeof value === "string" ? value : void 0,
   import_zod4.z.string().optional()
@@ -277506,7 +277563,7 @@ var ErrorFieldSchema = import_zod4.z.preprocess(
 ).catch(void 0);
 var ErrorBodyShapeSchema = import_zod4.z.object({
   /** The `error` field may be a flat code string, as some endpoints return,
-   *  or a nested error object, as a {@link CommitReceipt} carries. */
+   *  or a nested error object, as commit endpoints return on rejection. */
   error: ErrorFieldSchema,
   code: OptionalWireStringSchema,
   reason: OptionalWireStringSchema,
@@ -277517,9 +277574,58 @@ var ErrorBodyShapeSchema = import_zod4.z.object({
   heldByClaim: wireClaimSummarySchema.optional().catch(void 0),
   claims: import_zod4.z.array(wireClaimSummarySchema).optional().catch(void 0)
 }).passthrough();
+function parseErrorBodyShape(body) {
+  if (typeof body !== "object" || body === null) return {};
+  const parsed = ErrorBodyShapeSchema.safeParse(body);
+  return parsed.success ? parsed.data : {};
+}
+function errorFromWire(message, opts = {}) {
+  const { code, requestId, requiredCapability, claims } = opts;
+  const httpStatus = opts.httpStatus ?? (code ? errorCodeSpec(code)?.httpStatus : void 0);
+  const publicCode = code === "claim_conflict" ? "claim_conflict" : code;
+  const baseOpts = { code: publicCode, httpStatus, requestId };
+  if (code === "capability_scope_denied" || code === "capability_invalid") {
+    return new CapabilityError(code, message, requiredCapability);
+  }
+  if (code === "claim_conflict" || code === "entity_claimed" || code === "claim_lost") {
+    return new AbloClaimedError(message, { ...baseOpts, claims });
+  }
+  if (code === "stale_context") {
+    return new AbloStaleContextError(message, baseOpts);
+  }
+  if (httpStatus === 401) return new AbloAuthenticationError(message, baseOpts);
+  if (httpStatus === 403) return new AbloPermissionError(message, baseOpts);
+  if (httpStatus === 409) return new AbloIdempotencyError(message, baseOpts);
+  if (httpStatus === 422 || httpStatus === 400) return new AbloValidationError(message, baseOpts);
+  if (httpStatus === 429) return new AbloRateLimitError(message, baseOpts);
+  if (httpStatus !== void 0 && httpStatus >= 500) return new AbloServerError(message, baseOpts);
+  return new AbloError(message, baseOpts);
+}
+function translateHttpError(status2, body, requestId) {
+  const parsed = parseErrorBodyShape(body);
+  const nested = parsed.error != null && typeof parsed.error === "object" ? parsed.error : void 0;
+  const flatError = typeof parsed.error === "string" ? parsed.error : void 0;
+  const code = parsed.code ?? nested?.code ?? flatError;
+  const message = nested?.message ?? parsed.reason ?? parsed.message ?? flatError ?? (typeof body === "string" ? body : `HTTP ${status2}`);
+  const requiredCapability = nested?.requiredCapability ?? parsed.requiredCapability;
+  const claims = parsed.claims ?? nested?.claims ?? (parsed.heldByClaim ? [parsed.heldByClaim] : nested?.heldByClaim ? [nested.heldByClaim] : void 0);
+  return errorFromWire(message, {
+    code,
+    httpStatus: status2,
+    requestId,
+    requiredCapability,
+    claims
+  });
+}
+function hasWireCode(body) {
+  const parsed = parseErrorBodyShape(body);
+  if (typeof parsed.code === "string") return true;
+  if (typeof parsed.error === "string") return true;
+  return typeof parsed.error === "object" && parsed.error !== null && typeof parsed.error.code === "string";
+}
 
 // src/cli/migrate.ts
-var import_picocolors4 = __toESM(require_picocolors(), 1);
+var import_picocolors5 = __toESM(require_picocolors(), 1);
 var import_fs5 = require("fs");
 
 // node_modules/postgres/src/index.js
@@ -279688,7 +279794,7 @@ var import_source = require("@abloatai/ablo/source");
 
 // src/cli/push.ts
 init_cjs_shims();
-var import_picocolors3 = __toESM(require_picocolors(), 1);
+var import_picocolors4 = __toESM(require_picocolors(), 1);
 
 // src/auth/credentialPolicy.ts
 init_cjs_shims();
@@ -279962,6 +280068,174 @@ function resolvePushPlan() {
   return { flow: getMode(), apiKey: key, source };
 }
 
+// src/cli/target.ts
+init_cjs_shims();
+
+// src/auth/index.ts
+init_cjs_shims();
+
+// src/auth/schemas.ts
+init_cjs_shims();
+var import_zod5 = require("zod");
+var AuthParticipantKindSchema = import_zod5.z.enum(["user", "agent", "system"]);
+var AuthTokenSchema = import_zod5.z.string().trim().min(1);
+var CapabilityExchangeResponseSchema = import_zod5.z.object({
+  capabilityId: import_zod5.z.string().min(1),
+  token: AuthTokenSchema,
+  expiresAt: import_zod5.z.string().min(1),
+  organizationId: import_zod5.z.string().min(1),
+  scope: import_zod5.z.object({
+    organizationId: import_zod5.z.string().min(1),
+    syncGroups: import_zod5.z.array(import_zod5.z.string()),
+    operations: import_zod5.z.array(import_zod5.z.string()),
+    participantKind: AuthParticipantKindSchema,
+    participantId: import_zod5.z.string().min(1)
+  }).passthrough(),
+  userMeta: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown())
+}).passthrough();
+var IdentityResolveResponseSchema = import_zod5.z.object({
+  participantKind: AuthParticipantKindSchema,
+  participantId: import_zod5.z.string().min(1),
+  accountScope: import_zod5.z.string().min(1),
+  // The rest of the plane this credential resolves to. `nullish` (optional +
+  // nullable) so a server too old to send them still parses, and a human
+  // session — which carries no such scope — validates with them absent.
+  // `projectId` equals the org id for the org-default project.
+  projectId: import_zod5.z.string().min(1).nullish(),
+  environment: import_zod5.z.enum(["sandbox", "production"]).nullish(),
+  sandboxId: import_zod5.z.string().min(1).nullish(),
+  syncGroups: import_zod5.z.array(import_zod5.z.string()),
+  userMeta: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown())
+}).passthrough();
+var EphemeralKeyResponseSchema = import_zod5.z.object({
+  object: import_zod5.z.literal("ephemeral_key").optional(),
+  id: import_zod5.z.string().min(1),
+  token: AuthTokenSchema,
+  expiresAt: import_zod5.z.string().min(1),
+  organizationId: import_zod5.z.string().min(1),
+  participantId: import_zod5.z.string().min(1),
+  syncGroups: import_zod5.z.array(import_zod5.z.string())
+}).passthrough();
+function formatIssues(error) {
+  return error.issues.map((issue) => {
+    const path = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+    return `${path}: ${issue.message}`;
+  }).join("; ");
+}
+function parseIdentityResolveResponse(raw) {
+  const parsed = IdentityResolveResponseSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new AbloAuthenticationError(
+      `identity resolve response was malformed: ${formatIssues(parsed.error)}`,
+      { code: "identity_resolve_failed", cause: parsed.error }
+    );
+  }
+  return parsed.data;
+}
+
+// src/auth/index.ts
+async function resolveIdentity(options) {
+  if (!options.baseUrl) {
+    throw new AbloAuthenticationError("baseUrl is required for identity resolve", {
+      code: "base_url_missing"
+    });
+  }
+  const fetcher = options.fetch ?? fetch;
+  const url = `${options.baseUrl.replace(/\/+$/, "")}/auth/identity`;
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  const controller = new AbortController();
+  const timer2 = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
+  let response;
+  try {
+    const headers = { Accept: "application/json" };
+    if (options.authToken) {
+      headers.Authorization = `Bearer ${options.authToken}`;
+    }
+    response = await fetcher(url, {
+      method: "GET",
+      headers,
+      signal: controller.signal
+    });
+  } catch (err) {
+    throw new AbloAuthenticationError(
+      `identity resolve failed: ${err instanceof Error ? err.message : String(err)}`,
+      { code: "identity_network_error", cause: err }
+    );
+  } finally {
+    clearTimeout(timer2);
+  }
+  if (!response.ok) {
+    let body = null;
+    try {
+      body = await response.json();
+    } catch {
+    }
+    const requestId = response.headers.get("x-request-id") ?? void 0;
+    throw hasWireCode(body) ? translateHttpError(response.status, body, requestId) : new AbloAuthenticationError(
+      `identity resolve rejected (${response.status})`,
+      { code: "identity_resolve_failed", httpStatus: response.status }
+    );
+  }
+  return parseIdentityResolveResponse(await response.json());
+}
+
+// src/client/auth.ts
+init_cjs_shims();
+
+// src/client/credentialEndpoint.ts
+init_cjs_shims();
+
+// src/client/auth.ts
+var LEGACY_HOSTED_API_HOSTS = /* @__PURE__ */ new Set([
+  "mesh.ablo.finance",
+  "mesh-staging.ablo.finance",
+  "api.ablo.finance",
+  "sync-staging.ablo.finance"
+]);
+function normalizeAbloHostedBaseUrl(rawUrl) {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) return trimmed;
+  const schemed = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+  try {
+    const url = new URL(schemed);
+    if (url.protocol === "ws:") url.protocol = "http:";
+    if (url.protocol === "wss:") url.protocol = "https:";
+    if (!LEGACY_HOSTED_API_HOSTS.has(url.hostname)) {
+      return url.toString().replace(/\/+$/, "");
+    }
+    url.hostname = ABLO_HOSTED_API_DOMAIN;
+    if (url.protocol === "http:") url.protocol = "https:";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return schemed;
+  }
+}
+function resolveBootstrapBaseUrl(input) {
+  if (input.bootstrapBaseUrl) {
+    return ensureApiSuffix(normalizeAbloHostedBaseUrl(input.bootstrapBaseUrl).replace(/^ws/, "http"));
+  }
+  const url = normalizeAbloHostedBaseUrl(input.url);
+  return ensureApiSuffix(url.replace(/^ws/, "http"));
+}
+function ensureApiSuffix(httpBase) {
+  const trimmed = httpBase.replace(/\/+$/, "");
+  try {
+    const u2 = new URL(trimmed);
+    const segments = u2.pathname.split("/").filter(Boolean);
+    if (segments[segments.length - 1] === "api") return trimmed;
+    u2.pathname = `${u2.pathname.replace(/\/+$/, "")}/api`;
+    return u2.toString().replace(/\/+$/, "");
+  } catch {
+    return trimmed.endsWith("/api") ? trimmed : `${trimmed}/api`;
+  }
+}
+
+// src/cli/projects.ts
+init_cjs_shims();
+var import_picocolors3 = __toESM(require_picocolors(), 1);
+
 // src/cli/theme.ts
 init_cjs_shims();
 var RESET = "\x1B[0m";
@@ -279975,6 +280249,288 @@ function brand(label = "ablo") {
   return `${PAPER_BG}${BLACK_FG} ${label} ${RESET}`;
 }
 
+// src/cli/projects.ts
+function apiUrl() {
+  return (process.env.ABLO_API_URL ?? ABLO_DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+function requireKey() {
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors3.default.red("  No API key.") + import_picocolors3.default.dim(
+        ` Run ${import_picocolors3.default.bold("npx ablo login")} \u2014 or set ${import_picocolors3.default.bold("ABLO_API_KEY")} (${import_picocolors3.default.bold("sk_test_")} = sandbox; ${import_picocolors3.default.bold("sk_live_")} = production).`
+      )
+    );
+    process.exit(1);
+  }
+  return apiKey;
+}
+async function request(path, apiKey, init2 = {}, baseUrl2) {
+  const res = await fetch(`${baseUrl2 ?? apiUrl()}${path}`, {
+    method: init2.method ?? "GET",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${apiKey}`
+    },
+    ...init2.body !== void 0 ? { body: JSON.stringify(init2.body) } : {}
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  return { status: res.status, body };
+}
+async function listProjects(apiKey, baseUrl2) {
+  try {
+    const { status: status2, body } = await request("/api/v1/projects", apiKey, {}, baseUrl2);
+    if (status2 !== 200 || !Array.isArray(body.data)) return null;
+    return body.data;
+  } catch {
+    return null;
+  }
+}
+async function fetchProjects() {
+  const all = await listProjects(requireKey());
+  if (!all) {
+    console.error(import_picocolors3.default.red("  Could not list projects \u2014 is the API reachable and the key valid?"));
+    process.exit(1);
+  }
+  return all;
+}
+function projectSlugFromPackageName(name) {
+  if (typeof name !== "string") return void 0;
+  const slug = name.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 64);
+  if (!slug || slug === "default") return void 0;
+  return slug;
+}
+async function ensureProject(slug, name) {
+  const apiKey = resolveApiKey();
+  if (!apiKey) return null;
+  try {
+    const { status: status2, body } = await request("/api/v1/projects", apiKey, {
+      method: "POST",
+      body: { slug, ...name ? { name } : {} }
+    });
+    if (status2 === 201) {
+      const created = body;
+      setActiveProject({ id: created.id, slug: created.slug });
+      return { id: created.id, slug: created.slug, created: true };
+    }
+    if (body.code === "project_slug_taken") {
+      const all = await listProjects(apiKey);
+      const existing = all?.find((p2) => p2.slug === slug);
+      if (!existing) return null;
+      setActiveProject({ id: existing.id, slug: existing.slug });
+      return { id: existing.id, slug: existing.slug, created: false };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function printList(projects2) {
+  const active = getActiveProject();
+  for (const p2 of projects2) {
+    const isActive = active ? active.id === p2.id : p2.default;
+    const marker = isActive ? import_picocolors3.default.green("\u25CF") : import_picocolors3.default.dim("\u25CB");
+    const tags = [p2.default ? import_picocolors3.default.dim("default") : "", isActive ? import_picocolors3.default.green("active") : ""].filter(Boolean).join(import_picocolors3.default.dim(", "));
+    console.log(
+      `  ${marker} ${p2.slug.padEnd(20)} ${import_picocolors3.default.dim(p2.id)}${tags ? `  ${tags}` : ""}`
+    );
+  }
+}
+async function projects(argv) {
+  const sub = argv[0];
+  if (sub === "list" || sub === void 0) {
+    console.log(`
+  ${brand("ablo")} ${import_picocolors3.default.dim("projects")}
+`);
+    printList(await fetchProjects());
+    console.log();
+    return;
+  }
+  if (sub === "create") {
+    const slug = argv[1];
+    if (!slug || slug.startsWith("-")) {
+      console.error(import_picocolors3.default.red('  usage: ablo projects create <slug> [--name "Display Name"]'));
+      process.exit(1);
+    }
+    const nameIdx = argv.indexOf("--name");
+    const name = nameIdx >= 0 ? argv[nameIdx + 1] : void 0;
+    const { status: status2, body } = await request("/api/v1/projects", requireKey(), {
+      method: "POST",
+      body: { slug, ...name ? { name } : {} }
+    });
+    if (status2 !== 201) {
+      console.error(
+        import_picocolors3.default.red(`  Create failed (${status2}): ${String(body.message ?? body.code ?? "")}`)
+      );
+      if (body.code === "project_slug_taken") {
+        console.error(import_picocolors3.default.dim(`  Pick another slug, or switch to it: ${import_picocolors3.default.bold(`ablo projects use ${slug}`)}`));
+      }
+      process.exit(1);
+    }
+    const created = body;
+    console.log(`  ${import_picocolors3.default.green("\u2713")} Created project ${import_picocolors3.default.bold(created.slug)} ${import_picocolors3.default.dim(`(${created.id})`)}`);
+    console.log(
+      import_picocolors3.default.dim(`  Make it active with ${import_picocolors3.default.bold(`ablo projects use ${created.slug}`)}; mint its keys in the dashboard.`)
+    );
+    return;
+  }
+  if (sub === "rename") {
+    const ref = argv[1];
+    const name = argv.slice(2).join(" ").trim();
+    if (!ref || ref.startsWith("-") || !name) {
+      console.error(import_picocolors3.default.red("  usage: ablo projects rename <slug|id> <new name>"));
+      process.exit(1);
+    }
+    const all = await fetchProjects();
+    const target = all.find((p2) => p2.slug === ref || p2.id === ref);
+    if (!target) {
+      console.error(import_picocolors3.default.red(`  No project "${ref}".`) + import_picocolors3.default.dim(" Run ablo projects list."));
+      process.exit(1);
+    }
+    if (target.default) {
+      console.error(import_picocolors3.default.red("  The default project cannot be renamed."));
+      process.exit(1);
+    }
+    const { status: status2, body } = await request(`/api/v1/projects/${target.id}`, requireKey(), {
+      method: "PATCH",
+      body: { name }
+    });
+    if (status2 !== 200) {
+      console.error(
+        import_picocolors3.default.red(`  Rename failed (${status2}): ${String(body.message ?? body.code ?? "")}`)
+      );
+      process.exit(1);
+    }
+    const updated = body;
+    console.log(
+      `  ${import_picocolors3.default.green("\u2713")} Renamed ${import_picocolors3.default.bold(updated.slug)} \u2192 ${import_picocolors3.default.bold(updated.name ?? updated.slug)} ${import_picocolors3.default.dim(`(${updated.id})`)}`
+    );
+    return;
+  }
+  if (sub === "use") {
+    const ref = argv[1];
+    if (!ref) {
+      console.error(import_picocolors3.default.red("  usage: ablo projects use <slug|id|default>"));
+      process.exit(1);
+    }
+    const all = await fetchProjects();
+    const target = all.find((p2) => p2.slug === ref || p2.id === ref);
+    if (!target) {
+      console.error(import_picocolors3.default.red(`  No project "${ref}".`) + import_picocolors3.default.dim(" Run ablo projects list."));
+      process.exit(1);
+    }
+    if (target.default) {
+      setActiveProject(void 0);
+      console.log(`  ${import_picocolors3.default.green("\u2713")} now targeting the ${import_picocolors3.default.bold("default")} project`);
+    } else {
+      setActiveProject({ id: target.id, slug: target.slug });
+      console.log(`  ${import_picocolors3.default.green("\u2713")} now targeting project ${import_picocolors3.default.bold(target.slug)} ${import_picocolors3.default.dim(`(${target.id})`)}`);
+    }
+    const guard = guardActiveProjectKey();
+    if (!guard.ok) {
+      const loginCmd = guard.activeProfile === DEFAULT_PROFILE ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
+      console.log(
+        import_picocolors3.default.dim(`  No key stored for this project yet \u2014 run ${import_picocolors3.default.bold(loginCmd)} to mint one.`)
+      );
+    }
+    return;
+  }
+  console.error(
+    import_picocolors3.default.red(`  unknown subcommand: ${sub}`) + import_picocolors3.default.dim(
+      ` (expected ${import_picocolors3.default.bold("list")}, ${import_picocolors3.default.bold("create")}, ${import_picocolors3.default.bold("rename")}, or ${import_picocolors3.default.bold("use")})`
+    )
+  );
+  process.exit(1);
+}
+
+// src/cli/target.ts
+var DEFAULT_PROJECT_SLUG = "default";
+async function resolveTarget(opts) {
+  const keyEnv = modeFromKey(opts.apiKey) ?? null;
+  const localProject = getActiveProject();
+  const confirmed = await confirmFromServer(opts);
+  return {
+    url: opts.url,
+    keyPrefix: `${opts.apiKey.slice(0, 12)}\u2026`,
+    keySource: opts.keySource,
+    keyEnv,
+    confirmed,
+    localProject,
+    mismatches: reconcile({ confirmed, keyEnv, localProject })
+  };
+}
+async function confirmFromServer(opts) {
+  const keyEnv = modeFromKey(opts.apiKey) ?? null;
+  try {
+    const identity = await resolveIdentity({
+      baseUrl: resolveBootstrapBaseUrl({ url: opts.url }),
+      authToken: opts.apiKey,
+      timeoutMs: opts.timeoutMs ?? 4e3
+    });
+    const projectId = identity.projectId ?? null;
+    const environment = identity.environment ?? keyEnv;
+    const project = projectId ? await nameProject(projectId, identity.accountScope, opts) : null;
+    return {
+      organizationId: identity.accountScope,
+      environment,
+      project,
+      projectId,
+      sandboxId: identity.sandboxId ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+async function nameProject(projectId, organizationId, opts) {
+  const list = await listProjects(opts.apiKey, resolveBootstrapBaseUrl({ url: opts.url }));
+  const match = list?.find((p2) => p2.id === projectId);
+  if (match) {
+    return { id: match.id, slug: match.slug, name: match.name, isDefault: match.default };
+  }
+  return {
+    id: projectId,
+    slug: projectId,
+    name: null,
+    isDefault: projectId === organizationId
+  };
+}
+function intendedProjectSlug(localProject) {
+  return localProject?.slug ?? DEFAULT_PROJECT_SLUG;
+}
+function confirmedProjectSlug(project) {
+  return project.isDefault ? DEFAULT_PROJECT_SLUG : project.slug;
+}
+function reconcile(input) {
+  const { confirmed, keyEnv, localProject } = input;
+  const mismatches = [];
+  const realEnv = confirmed?.environment ?? keyEnv;
+  const cliMode = getMode();
+  if (realEnv && realEnv !== cliMode) {
+    mismatches.push({ kind: "environment", keyEnv: realEnv, cliMode });
+  }
+  if (confirmed?.projectId) {
+    const intendedId = localProject?.id ?? confirmed.organizationId;
+    if (intendedId !== confirmed.projectId) {
+      mismatches.push({
+        kind: "project",
+        intended: intendedProjectSlug(localProject),
+        actual: confirmed.project ? confirmedProjectSlug(confirmed.project) : confirmed.projectId
+      });
+    }
+  }
+  return mismatches;
+}
+function describeMismatch(m2) {
+  if (m2.kind === "project") {
+    return `The key targets project ${m2.actual}, but ${m2.intended} is selected locally. This key routes the push, so it lands on ${m2.actual}. Run \`ablo projects use ${m2.actual}\` to match, or use a key minted for ${m2.intended}.`;
+  }
+  return `The key deploys to ${m2.keyEnv}, but the CLI mode is ${m2.cliMode}. The key wins, so this acts on ${m2.keyEnv}. Run \`ablo mode ${m2.keyEnv}\` to match, or present a ${m2.cliMode} key.`;
+}
+
 // src/cli/push.ts
 function coerceBackfill(raw) {
   if (raw === "true") return true;
@@ -279988,14 +280544,14 @@ var DEFAULT_URL = ABLO_DEFAULT_BASE_URL;
 function fmtSignal(s) {
   const sig = s;
   const where = sig.field ? `${sig.model}.${sig.field}` : sig.model;
-  let line = `    \u2022 ${import_picocolors3.default.bold(where ?? "?")} \u2014 ${sig.detail ?? ""}`;
+  let line = `    \u2022 ${import_picocolors4.default.bold(where ?? "?")} \u2014 ${sig.detail ?? ""}`;
   if (sig.shadowed) {
     const env = sig.shadowed.environment ?? "production";
     const ver = sig.shadowed.version != null ? `v${sig.shadowed.version}` : "active";
     const when = sig.shadowed.pushedAt ? new Date(sig.shadowed.pushedAt).toISOString().slice(0, 10) : "unknown date";
     const by = sig.shadowed.pushedBy ? ` by ${sig.shadowed.pushedBy}` : "";
     line += `
-      ${import_picocolors3.default.dim(`\u21B3 baseline: ${env} ${ver}, pushed ${when}${by}`)}`;
+      ${import_picocolors4.default.dim(`\u21B3 baseline: ${env} ${ver}, pushed ${when}${by}`)}`;
   }
   return line;
 }
@@ -280092,7 +280648,7 @@ async function loadSchema(schemaPath, exportName) {
   const abs = (0, import_path3.resolve)(process.cwd(), schemaPath);
   if (!(0, import_fs4.existsSync)(abs)) {
     throw new AbloValidationError(
-      `schema not found at ${import_picocolors3.default.bold(schemaPath)}. Run ${import_picocolors3.default.bold("npx ablo init")} or pass ${import_picocolors3.default.bold("--schema <path>")}.`,
+      `schema not found at ${import_picocolors4.default.bold(schemaPath)}. Run ${import_picocolors4.default.bold("npx ablo init")} or pass ${import_picocolors4.default.bold("--schema <path>")}.`,
       { code: "cli_invalid_arguments" }
     );
   }
@@ -280103,7 +280659,7 @@ async function loadSchema(schemaPath, exportName) {
   const schema = mod[exportName] ?? nested?.[exportName];
   if (!schema || typeof schema !== "object" || !("models" in schema)) {
     throw new AbloValidationError(
-      `${import_picocolors3.default.bold(schemaPath)} has no \`${exportName}\` export that looks like a Schema. Did you \`export const ${exportName} = defineSchema({ ... })\`?`,
+      `${import_picocolors4.default.bold(schemaPath)} has no \`${exportName}\` export that looks like a Schema. Did you \`export const ${exportName} = defineSchema({ ... })\`?`,
       { code: "cli_invalid_arguments" }
     );
   }
@@ -280156,7 +280712,7 @@ function localModels(schema) {
 }
 function printPlan(local, remote) {
   if (!remote?.models) {
-    console.log(`  ${import_picocolors3.default.dim("plan")}     ${import_picocolors3.default.dim("(deployed schema unavailable \u2014 the server computes the diff on apply)")}
+    console.log(`  ${import_picocolors4.default.dim("plan")}     ${import_picocolors4.default.dim("(deployed schema unavailable \u2014 the server computes the diff on apply)")}
 `);
     return;
   }
@@ -280167,36 +280723,37 @@ function printPlan(local, remote) {
   const changed = [...local.keys()].filter((k3) => remoteMap.has(k3) && remoteMap.get(k3) !== local.get(k3));
   const verLabel = remote.version != null ? `v${remote.version}` : "active";
   if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    console.log(`  ${import_picocolors3.default.dim("plan")}     ${import_picocolors3.default.dim(`no model-level changes vs deployed ${verLabel} (any field changes apply on push)`)}
+    console.log(`  ${import_picocolors4.default.dim("plan")}     ${import_picocolors4.default.dim(`no model-level changes vs deployed ${verLabel} (any field changes apply on push)`)}
 `);
     return;
   }
-  console.log(`  ${import_picocolors3.default.dim("plan")}     ${import_picocolors3.default.dim(`vs deployed ${verLabel}:`)}`);
-  for (const k3 of added) console.log(`           ${import_picocolors3.default.green(`+ ${k3}`)} ${import_picocolors3.default.dim("(new model)")}`);
+  console.log(`  ${import_picocolors4.default.dim("plan")}     ${import_picocolors4.default.dim(`vs deployed ${verLabel}:`)}`);
+  for (const k3 of added) console.log(`           ${import_picocolors4.default.green(`+ ${k3}`)} ${import_picocolors4.default.dim("(new model)")}`);
   for (const k3 of changed)
-    console.log(`           ${import_picocolors3.default.yellow(`~ ${k3}`)} ${import_picocolors3.default.dim(`conflict ${remoteMap.get(k3) || "(default)"} \u2192 ${local.get(k3) || "(default)"}`)}`);
-  for (const k3 of removed) console.log(`           ${import_picocolors3.default.red(`- ${k3}`)} ${import_picocolors3.default.dim("(removed \u2014 destructive, needs --force)")}`);
+    console.log(`           ${import_picocolors4.default.yellow(`~ ${k3}`)} ${import_picocolors4.default.dim(`conflict ${remoteMap.get(k3) || "(default)"} \u2192 ${local.get(k3) || "(default)"}`)}`);
+  for (const k3 of removed) console.log(`           ${import_picocolors4.default.red(`- ${k3}`)} ${import_picocolors4.default.dim("(removed \u2014 destructive, needs --force)")}`);
   console.log("");
 }
-async function confirmPush(args, env) {
+async function confirmPush(args, target) {
+  const env = target.confirmed?.environment ?? target.keyEnv;
   const isProd = env === "production";
   const tty = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   if (isProd && !args.yes) {
     const git = schemaGitState(args.schemaPath);
     if (git?.dirty && !args.allowDirty) {
-      console.error(`  ${import_picocolors3.default.red("\u2717")} Refusing to deploy uncommitted schema to ${import_picocolors3.default.red(import_picocolors3.default.bold("production"))}.`);
-      console.error(import_picocolors3.default.dim(`    Commit ${import_picocolors3.default.bold(args.schemaPath)} first, or pass ${import_picocolors3.default.bold("--allow-dirty")} to override.`));
+      console.error(`  ${import_picocolors4.default.red("\u2717")} Refusing to deploy uncommitted schema to ${import_picocolors4.default.red(import_picocolors4.default.bold("production"))}.`);
+      console.error(import_picocolors4.default.dim(`    Commit ${import_picocolors4.default.bold(args.schemaPath)} first, or pass ${import_picocolors4.default.bold("--allow-dirty")} to override.`));
       process.exit(1);
     }
     if (!tty) {
-      console.error(`  ${import_picocolors3.default.red("\u2717")} Refusing to deploy to ${import_picocolors3.default.red(import_picocolors3.default.bold("production"))} non-interactively without confirmation.`);
-      console.error(import_picocolors3.default.dim(`    Re-run with ${import_picocolors3.default.bold("--yes")} to confirm in CI/scripts.`));
+      console.error(`  ${import_picocolors4.default.red("\u2717")} Refusing to deploy to ${import_picocolors4.default.red(import_picocolors4.default.bold("production"))} non-interactively without confirmation.`);
+      console.error(import_picocolors4.default.dim(`    Re-run with ${import_picocolors4.default.bold("--yes")} to confirm in CI/scripts.`));
       process.exit(1);
     }
-    const project = getActiveProject();
-    const expected = project?.slug ?? "production";
+    const confirmedProject = target.confirmed?.project;
+    const expected = confirmedProject ? confirmedProject.isDefault ? "default" : confirmedProject.slug : target.localProject?.slug ?? "production";
     const typed = await he({
-      message: `This deploys to ${import_picocolors3.default.bold("production")}. Type ${import_picocolors3.default.bold(expected)} to confirm:`,
+      message: `This deploys to ${import_picocolors4.default.bold("production")} project ${import_picocolors4.default.bold(expected)}. Type ${import_picocolors4.default.bold(expected)} to confirm:`,
       placeholder: expected
     });
     if (pD(typed) || String(typed).trim() !== expected) {
@@ -280206,32 +280763,53 @@ async function confirmPush(args, env) {
     return;
   }
   if (!isProd && !args.yes && tty) {
-    const ok = await ye({ message: `Apply to ${import_picocolors3.default.bold("sandbox")}?` });
+    const ok = await ye({ message: `Apply to ${import_picocolors4.default.bold("sandbox")}?` });
     if (pD(ok) || !ok) {
       xe("Aborted.");
       process.exit(1);
     }
   }
 }
-function printPushTarget(opts) {
-  const env = modeFromKey(opts.apiKey);
-  const envLabel = env === "production" ? import_picocolors3.default.bold("production") : env === "sandbox" ? import_picocolors3.default.bold("sandbox") : import_picocolors3.default.yellow("unknown env");
-  const project = getActiveProject();
-  const projectLabel = project ? `${import_picocolors3.default.bold(project.slug)} ${import_picocolors3.default.dim(`(${project.id})`)}` : `${import_picocolors3.default.bold("default")} ${import_picocolors3.default.dim("(org-default)")}`;
+function printPushTarget(target, schema) {
+  const confirmed = target.confirmed;
+  const env = confirmed?.environment ?? target.keyEnv;
+  const envLabel = env === "production" ? import_picocolors4.default.bold("production") : env === "sandbox" ? import_picocolors4.default.bold("sandbox") : import_picocolors4.default.yellow("unknown env");
   const cliMode = getMode();
-  const modeNote = env && env !== cliMode ? ` ${import_picocolors3.default.yellow(`(cli mode: ${cliMode})`)}` : "";
+  const modeNote = env && env !== cliMode ? ` ${import_picocolors4.default.yellow(`(cli mode: ${cliMode})`)}` : "";
+  let projectLabel;
+  if (confirmed?.project) {
+    const p2 = confirmed.project;
+    const name = p2.isDefault ? `${import_picocolors4.default.bold("default")} ${import_picocolors4.default.dim("(org-default)")}` : import_picocolors4.default.bold(p2.slug);
+    projectLabel = `${name} ${import_picocolors4.default.dim(`(${p2.id})`)}`;
+  } else if (confirmed) {
+    projectLabel = `${import_picocolors4.default.bold("default")} ${import_picocolors4.default.dim("(org-default)")}`;
+  } else {
+    const local = target.localProject;
+    const shown = local ? `${import_picocolors4.default.bold(local.slug)} ${import_picocolors4.default.dim(`(${local.id})`)}` : `${import_picocolors4.default.bold("default")} ${import_picocolors4.default.dim("(org-default)")}`;
+    projectLabel = `${shown} ${import_picocolors4.default.yellow("(unconfirmed \u2014 server did not answer)")}`;
+  }
   console.log(`
-  ${brand("ablo")} ${import_picocolors3.default.dim("push")} ${import_picocolors3.default.dim("\u2192")} ${envLabel}${modeNote}`);
-  console.log(`  ${import_picocolors3.default.dim("project")}  ${projectLabel}`);
-  console.log(`  ${import_picocolors3.default.dim("target")}   ${import_picocolors3.default.dim(opts.url)}`);
+  ${brand("ablo")} ${import_picocolors4.default.dim("push")} ${import_picocolors4.default.dim("\u2192")} ${envLabel}${modeNote}`);
+  if (confirmed?.organizationId) console.log(`  ${import_picocolors4.default.dim("org")}      ${import_picocolors4.default.dim(confirmed.organizationId)}`);
+  console.log(`  ${import_picocolors4.default.dim("project")}  ${projectLabel}`);
+  console.log(`  ${import_picocolors4.default.dim("target")}   ${import_picocolors4.default.dim(target.url)}`);
   console.log(
-    `  ${import_picocolors3.default.dim("key")}      ${maskKey(opts.apiKey)} ${import_picocolors3.default.dim(`(${describeKeySource(opts.keySource)})`)}`
+    `  ${import_picocolors4.default.dim("key")}      ${target.keyPrefix} ${import_picocolors4.default.dim(`(${describeKeySource(target.keySource)})`)}`
   );
   console.log(
-    `  ${import_picocolors3.default.dim("schema")}   ${import_picocolors3.default.bold(opts.schemaPath)} ${import_picocolors3.default.dim(`${opts.modelCount} models, hash ${opts.hash}`)}
+    `  ${import_picocolors4.default.dim("schema")}   ${import_picocolors4.default.bold(schema.path)} ${import_picocolors4.default.dim(`${schema.modelCount} models, hash ${schema.hash}`)}
 `
   );
 }
+function warnMismatches(target) {
+  let projectDrift = false;
+  for (const m2 of target.mismatches) {
+    if (m2.kind === "project") projectDrift = true;
+    console.log(`  ${import_picocolors4.default.yellow("\u26A0")}  ${import_picocolors4.default.yellow(describeMismatch(m2))}
+`);
+  }
+  return { projectDrift };
+}
 function describeKeySource(source) {
   switch (source) {
     case "env":
@@ -280249,7 +280827,7 @@ async function push(argv) {
   try {
     args = parsePushArgs(argv);
   } catch (err) {
-    console.error(import_picocolors3.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors4.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let keySource = "env";
@@ -280260,44 +280838,43 @@ async function push(argv) {
   }
   if (!args.apiKey) {
     console.error(
-      import_picocolors3.default.red(`  No API key.`) + import_picocolors3.default.dim(
-        ` Run ${import_picocolors3.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors3.default.bold("ABLO_API_KEY")} (${import_picocolors3.default.bold("sk_test_")} = sandbox; ${import_picocolors3.default.bold("sk_live_")} = deliberate production deploy). Mode is currently '${getMode()}'.`
+      import_picocolors4.default.red(`  No API key.`) + import_picocolors4.default.dim(
+        ` Run ${import_picocolors4.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors4.default.bold("ABLO_API_KEY")} (${import_picocolors4.default.bold("sk_test_")} = sandbox; ${import_picocolors4.default.bold("sk_live_")} = deliberate production deploy). Mode is currently '${getMode()}'.`
       )
     );
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const hash = (0, import_schema2.schemaHash)(schema);
-  printPushTarget({
-    schemaPath: args.schemaPath,
-    url: args.url,
-    apiKey: args.apiKey,
-    keySource,
+  const target = await resolveTarget({ url: args.url, apiKey: args.apiKey, keySource });
+  printPushTarget(target, {
+    path: args.schemaPath,
     modelCount: Object.keys(schema.models).length,
     hash
   });
   const remote = await fetchActiveSchema(args.url, args.apiKey);
   printPlan(localModels(schema), remote);
+  warnMismatches(target);
   const git = schemaGitState(args.schemaPath);
   if (git?.dirty) {
     const what = git.untracked ? "is untracked (not committed)" : "has uncommitted changes";
-    console.log(`  ${import_picocolors3.default.yellow("\u26A0")}  ${import_picocolors3.default.bold(args.schemaPath)} ${what} \u2014 this deploy won't match a git commit.
+    console.log(`  ${import_picocolors4.default.yellow("\u26A0")}  ${import_picocolors4.default.bold(args.schemaPath)} ${what} \u2014 this deploy won't match a git commit.
 `);
   }
   if (args.dryRun) {
-    console.log(`  ${import_picocolors3.default.dim("\u25CB")} dry run \u2014 nothing applied. Re-run without ${import_picocolors3.default.bold("--dry-run")} to deploy.`);
+    console.log(`  ${import_picocolors4.default.dim("\u25CB")} dry run \u2014 nothing applied. Re-run without ${import_picocolors4.default.bold("--dry-run")} to deploy.`);
     return;
   }
-  await confirmPush(args, modeFromKey(args.apiKey));
+  await confirmPush(args, target);
   const { ok: resOk, status: status2, body, bodyText } = await pushSchema(schema, args);
   if (resOk) {
     if (body.unchanged) {
-      console.log(`  ${import_picocolors3.default.dim("\u25CB")} No changes \u2014 schema already active (v${body.version}).`);
+      console.log(`  ${import_picocolors4.default.dim("\u25CB")} No changes \u2014 schema already active (v${body.version}).`);
     } else {
-      console.log(`  ${import_picocolors3.default.green("\u2713")} Activated ${import_picocolors3.default.bold(`v${body.version}`)} ${import_picocolors3.default.dim(`(hash ${body.hash})`)}`);
+      console.log(`  ${import_picocolors4.default.green("\u2713")} Activated ${import_picocolors4.default.bold(`v${body.version}`)} ${import_picocolors4.default.dim(`(hash ${body.hash})`)}`);
       if (Array.isArray(body.warnings) && body.warnings.length > 0) {
-        console.log(import_picocolors3.default.yellow(`  Applied ${body.warnings.length} destructive change(s):`));
-        for (const w2 of body.warnings) console.log(import_picocolors3.default.yellow(fmtSignal(w2)));
+        console.log(import_picocolors4.default.yellow(`  Applied ${body.warnings.length} destructive change(s):`));
+        for (const w2 of body.warnings) console.log(import_picocolors4.default.yellow(fmtSignal(w2)));
       }
     }
     return;
@@ -280305,75 +280882,75 @@ async function push(argv) {
   if (status2 === 409) {
     const unexecutable = Array.isArray(body.unexecutable) ? body.unexecutable : [];
     const warnings = Array.isArray(body.warnings) ? body.warnings : [];
-    console.error(import_picocolors3.default.red("  Incompatible change \u2014 this push is not safe to apply as-is."));
+    console.error(import_picocolors4.default.red("  Incompatible change \u2014 this push is not safe to apply as-is."));
     if (unexecutable.length > 0) {
-      console.error(import_picocolors3.default.red(`  Unexecutable (would fail on existing rows):`));
-      for (const u2 of unexecutable) console.error(import_picocolors3.default.red(fmtSignal(u2)));
+      console.error(import_picocolors4.default.red(`  Unexecutable (would fail on existing rows):`));
+      for (const u2 of unexecutable) console.error(import_picocolors4.default.red(fmtSignal(u2)));
     }
     if (warnings.length > 0) {
-      console.error(import_picocolors3.default.yellow(`  Destructive (data loss):`));
-      for (const w2 of warnings) console.error(import_picocolors3.default.yellow(fmtSignal(w2)));
+      console.error(import_picocolors4.default.yellow(`  Destructive (data loss):`));
+      for (const w2 of warnings) console.error(import_picocolors4.default.yellow(fmtSignal(w2)));
     }
     const hasShadowed = [...unexecutable, ...warnings].some(
       (s) => s.shadowed != null
     );
     if (hasShadowed) {
       console.error(
-        import_picocolors3.default.dim(
+        import_picocolors4.default.dim(
           "  These models exist in the baseline above but not in your push. Sandbox readers fall"
         )
       );
       console.error(
-        import_picocolors3.default.dim(
+        import_picocolors4.default.dim(
           "  back to the production schema until you push your own, so applying this drops them."
         )
       );
     }
-    console.error(import_picocolors3.default.dim(`  Re-push with ${import_picocolors3.default.bold("--force")} to override, or use ${import_picocolors3.default.bold("--rename old:new")} if you renamed a model.`));
+    console.error(import_picocolors4.default.dim(`  Re-push with ${import_picocolors4.default.bold("--force")} to override, or use ${import_picocolors4.default.bold("--rename old:new")} if you renamed a model.`));
   } else if (status2 === 403) {
     const code = body.code ?? body.reason;
     const serverMsg = body.message ?? body.reason;
-    console.error(import_picocolors3.default.red(`  Forbidden${code ? ` [${code}]` : ""}: ${serverMsg ?? "permission denied"}`));
-    console.error(import_picocolors3.default.dim(`  Push used ${import_picocolors3.default.bold(maskKey(args.apiKey))} from ${describeKeySource(keySource)}.`));
+    console.error(import_picocolors4.default.red(`  Forbidden${code ? ` [${code}]` : ""}: ${serverMsg ?? "permission denied"}`));
+    console.error(import_picocolors4.default.dim(`  Push used ${import_picocolors4.default.bold(maskKey(args.apiKey))} from ${describeKeySource(keySource)}.`));
     if (code === "database_role_cannot_enforce_rls") {
       console.error(
-        import_picocolors3.default.dim(
-          `  Your database role bypasses row-level security. Run ${import_picocolors3.default.bold("npx ablo migrate")} to create a scoped (NOBYPASSRLS) role and repoint DATABASE_URL, then re-push.`
+        import_picocolors4.default.dim(
+          `  Your database role bypasses row-level security. Run ${import_picocolors4.default.bold("npx ablo migrate")} to create a scoped (NOBYPASSRLS) role and repoint DATABASE_URL, then re-push.`
         )
       );
     } else if (code === "database_tables_unforced_rls") {
       console.error(
-        import_picocolors3.default.dim(
-          `  One or more synced tables don't have FORCE ROW LEVEL SECURITY. Run ${import_picocolors3.default.bold("npx ablo migrate")} to (re)apply the tenant policies, then re-push.`
+        import_picocolors4.default.dim(
+          `  One or more synced tables don't have FORCE ROW LEVEL SECURITY. Run ${import_picocolors4.default.bold("npx ablo migrate")} to (re)apply the tenant policies, then re-push.`
         )
       );
     } else if (code === "capability_scope_denied" || code === "capability_invalid") {
       console.error(
-        import_picocolors3.default.dim(
-          `  This is a ${import_picocolors3.default.bold("database privilege")} error (Postgres 42501 / row-level security), not a key scope \u2014 a different API key won't help. The role behind this org's database can't write the target. Provision a writable, RLS-scoped role with ${import_picocolors3.default.bold("npx ablo migrate")}, or check the org's database registration. See docs/plans/read-path-logical-replication-vs-hosting.md.`
+        import_picocolors4.default.dim(
+          `  This is a ${import_picocolors4.default.bold("database privilege")} error (Postgres 42501 / row-level security), not a key scope \u2014 a different API key won't help. The role behind this org's database can't write the target. Provision a writable, RLS-scoped role with ${import_picocolors4.default.bold("npx ablo migrate")}, or check the org's database registration. See docs/plans/read-path-logical-replication-vs-hosting.md.`
         )
       );
     } else if (code === "schema_provisioning_forbidden") {
       console.error(
-        import_picocolors3.default.dim(
-          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors3.default.bold("npx ablo connect --register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
+        import_picocolors4.default.dim(
+          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors4.default.bold("npx ablo connect --register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
         )
       );
     } else if (args.apiKey != null && classifyCredentialKind(args.apiKey) === "restricted") {
       console.error(
-        import_picocolors3.default.dim(
-          `  Schema pushes need a SECRET key: ${import_picocolors3.default.bold("sk_test_")} (sandbox dev loop) or a dashboard ${import_picocolors3.default.bold("sk_live_")} (production deploy: ${import_picocolors3.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")}).`
+        import_picocolors4.default.dim(
+          `  Schema pushes need a SECRET key: ${import_picocolors4.default.bold("sk_test_")} (sandbox dev loop) or a dashboard ${import_picocolors4.default.bold("sk_live_")} (production deploy: ${import_picocolors4.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")}).`
         )
       );
     } else {
       console.error(
-        import_picocolors3.default.dim(
-          `  This key isn't authorized to push schema (needs ${import_picocolors3.default.bold("schema:push")}). ` + (keySource === "stored" ? `It's your stored ${import_picocolors3.default.bold("ablo login")} sandbox key \u2014 a key in ${import_picocolors3.default.bold(".env.local")} or ${import_picocolors3.default.bold("ABLO_API_KEY")} takes precedence, so put a schema:push key there (sandbox ${import_picocolors3.default.bold("sk_test_")} or production ${import_picocolors3.default.bold("sk_live_")}) and re-push. ` : `Use a schema:push key \u2014 a sandbox ${import_picocolors3.default.bold("sk_test_")} or production ${import_picocolors3.default.bold("sk_live_")}. `) + `Manage keys at https://abloatai.com`
+        import_picocolors4.default.dim(
+          `  This key isn't authorized to push schema (needs ${import_picocolors4.default.bold("schema:push")}). ` + (keySource === "stored" ? `It's your stored ${import_picocolors4.default.bold("ablo login")} sandbox key \u2014 a key in ${import_picocolors4.default.bold(".env.local")} or ${import_picocolors4.default.bold("ABLO_API_KEY")} takes precedence, so put a schema:push key there (sandbox ${import_picocolors4.default.bold("sk_test_")} or production ${import_picocolors4.default.bold("sk_live_")}) and re-push. ` : `Use a schema:push key \u2014 a sandbox ${import_picocolors4.default.bold("sk_test_")} or production ${import_picocolors4.default.bold("sk_live_")}. `) + `Manage keys at https://abloatai.com`
         )
       );
     }
   } else {
-    console.error(import_picocolors3.default.red(`  Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}`));
+    console.error(import_picocolors4.default.red(`  Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}`));
   }
   process.exit(1);
 }
@@ -280436,10 +281013,10 @@ var log = {
     console.log(`[migrate] ${msg}`, fields);
   },
   warn: (msg, fields) => {
-    console.warn(import_picocolors4.default.yellow(`[migrate] ${msg}`), fields);
+    console.warn(import_picocolors5.default.yellow(`[migrate] ${msg}`), fields);
   },
   error: (msg, fields) => {
-    console.error(import_picocolors4.default.red(`[migrate] ${msg}`), fields);
+    console.error(import_picocolors5.default.red(`[migrate] ${msg}`), fields);
   }
 };
 async function applyStatements(dbUrl, targetSchema, statements, concurrent = []) {
@@ -280513,7 +281090,7 @@ async function migrate(argv) {
   try {
     args = parseMigrateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors4.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
@@ -280524,11 +281101,11 @@ async function migrate(argv) {
   ].join("\n");
   const totalStatements = plan.statements.length + plan.concurrent.length;
   console.log(
-    `  ${import_picocolors4.default.dim("Schema")} ${import_picocolors4.default.bold(args.schemaPath)} \u2192 ${import_picocolors4.default.dim(`${Object.keys(schema.models).length} models, ${totalStatements} statements`)}`
+    `  ${import_picocolors5.default.dim("Schema")} ${import_picocolors5.default.bold(args.schemaPath)} \u2192 ${import_picocolors5.default.dim(`${Object.keys(schema.models).length} models, ${totalStatements} statements`)}`
   );
   if (args.outputFile) {
     (0, import_fs5.writeFileSync)(args.outputFile, sql + "\n");
-    console.log(`  ${import_picocolors4.default.green("\u2713")} SQL written to ${import_picocolors4.default.bold(args.outputFile)}`);
+    console.log(`  ${import_picocolors5.default.green("\u2713")} SQL written to ${import_picocolors5.default.bold(args.outputFile)}`);
     return;
   }
   if (args.dryRun) {
@@ -280538,7 +281115,7 @@ async function migrate(argv) {
   const dbUrl = readProjectDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors4.default.red(
+      import_picocolors5.default.red(
         "  No DATABASE_URL found (checked process env, .env.local, .env). Set it to apply, or use --dry-run to preview."
       )
     );
@@ -280546,7 +281123,7 @@ async function migrate(argv) {
   }
   try {
     await applyStatements(dbUrl, args.targetSchema, plan.statements, plan.concurrent);
-    console.log(`  ${import_picocolors4.default.green("\u2713")} Migration complete`);
+    console.log(`  ${import_picocolors5.default.green("\u2713")} Migration complete`);
   } catch {
     process.exit(1);
   }
@@ -280554,7 +281131,7 @@ async function migrate(argv) {
 
 // src/cli/connect.ts
 init_cjs_shims();
-var import_picocolors5 = __toESM(require_picocolors(), 1);
+var import_picocolors6 = __toESM(require_picocolors(), 1);
 var ABLO_PUBLICATION = "ablo_publication";
 var ABLO_REPLICATION_ROLE = "ablo_replicator";
 function parseConnectArgs(argv) {
@@ -280611,50 +281188,50 @@ function connectSetupSql(input) {
 function printConnectRecipe(args) {
   const sql = connectSetupSql({ tables: args.tables, role: args.role });
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("connect")}  ${import_picocolors5.default.dim("logical replication \u2014 the read path (your writes stay on your own backend)")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect")}  ${import_picocolors6.default.dim("logical replication \u2014 the read path (your writes stay on your own backend)")}
 `);
   console.log(
-    `  Ablo consumes your write-ahead log (WAL) via logical replication and ${import_picocolors5.default.bold("never")} runs DDL,
+    `  Ablo consumes your write-ahead log (WAL) via logical replication and ${import_picocolors6.default.bold("never")} runs DDL,
   owns, hosts, or migrates your schema. Your app continues to own the write path \u2014 Ablo tails
-  the changes and serves them as live shapes. Run this once against your Postgres ${import_picocolors5.default.dim("(as a superuser / DB owner)")}:
+  the changes and serves them as live shapes. Run this once against your Postgres ${import_picocolors6.default.dim("(as a superuser / DB owner)")}:
 `
   );
-  console.log(`  ${import_picocolors5.default.bold("1.")} Enable logical decoding ${import_picocolors5.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`);
-  console.log(`       ${import_picocolors5.default.cyan(sql[0])}`);
+  console.log(`  ${import_picocolors6.default.bold("1.")} Enable logical decoding ${import_picocolors6.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`);
+  console.log(`       ${import_picocolors6.default.cyan(sql[0])}`);
   console.log(
-    import_picocolors5.default.dim(
-      `       On Amazon RDS / Aurora you can't ALTER SYSTEM: set ${import_picocolors5.default.bold("rds.logical_replication = 1")} in the
+    import_picocolors6.default.dim(
+      `       On Amazon RDS / Aurora you can't ALTER SYSTEM: set ${import_picocolors6.default.bold("rds.logical_replication = 1")} in the
        instance's parameter group instead, then reboot.`
     )
   );
   console.log(`
-  ${import_picocolors5.default.bold("2.")} Publish the tables Ablo should read`);
-  console.log(`       ${import_picocolors5.default.cyan(sql[1])}`);
+  ${import_picocolors6.default.bold("2.")} Publish the tables Ablo should read`);
+  console.log(`       ${import_picocolors6.default.cyan(sql[1])}`);
   if (args.tables.length === 0) {
-    console.log(import_picocolors5.default.dim(`       (Scope it with ${import_picocolors5.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`));
+    console.log(import_picocolors6.default.dim(`       (Scope it with ${import_picocolors6.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`));
   }
   console.log(`
-  ${import_picocolors5.default.bold("3.")} Create a least-privilege replication role ${import_picocolors5.default.dim("(pick your own password)")}`);
-  console.log(`       ${import_picocolors5.default.cyan(sql[2])}`);
-  console.log(`       ${import_picocolors5.default.cyan(sql[3])}`);
-  console.log(`       ${import_picocolors5.default.cyan(sql[4])}`);
+  ${import_picocolors6.default.bold("3.")} Create a least-privilege replication role ${import_picocolors6.default.dim("(pick your own password)")}`);
+  console.log(`       ${import_picocolors6.default.cyan(sql[2])}`);
+  console.log(`       ${import_picocolors6.default.cyan(sql[3])}`);
+  console.log(`       ${import_picocolors6.default.cyan(sql[4])}`);
   console.log(
-    import_picocolors5.default.dim(
+    import_picocolors6.default.dim(
       `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
-       ${import_picocolors5.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
+       ${import_picocolors6.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
     )
   );
   console.log(
     `
-  ${import_picocolors5.default.bold("4.")} Put the role's connection string in ${import_picocolors5.default.bold("DATABASE_URL")}, then verify:
-       ${import_picocolors5.default.cyan("npx ablo connect --check")}
+  ${import_picocolors6.default.bold("4.")} Put the role's connection string in ${import_picocolors6.default.bold("DATABASE_URL")}, then verify:
+       ${import_picocolors6.default.cyan("npx ablo connect --check")}
 `
   );
   console.log(
-    import_picocolors5.default.dim(
+    import_picocolors6.default.dim(
       `  Reminder: this is the READ path \u2014 Ablo tails your WAL and never writes to your database.
   Your writes keep going through your own backend. (Ablo HOSTING your rows, or dialing in via
-  ${import_picocolors5.default.bold("databaseUrl")}, is the deprecated posture \u2014 see the read-path decision doc.)`
+  ${import_picocolors6.default.bold("databaseUrl")}, is the deprecated posture \u2014 see the read-path decision doc.)`
     )
   );
   console.log();
@@ -280672,11 +281249,11 @@ var SYNC_INFRA_TYPES = [
 ];
 function printCheckItem(item) {
   if (item.ok) {
-    console.log(`  ${import_picocolors5.default.green("\u2713")} ${item.label}`);
+    console.log(`  ${import_picocolors6.default.green("\u2713")} ${item.label}`);
   } else {
-    console.log(`  ${import_picocolors5.default.red("\u2717")} ${item.label}`);
+    console.log(`  ${import_picocolors6.default.red("\u2717")} ${item.label}`);
     if (item.fix) {
-      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors5.default.red("\u2022")} ${line}`);
+      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors6.default.red("\u2022")} ${line}`);
     }
   }
 }
@@ -280688,9 +281265,9 @@ async function probeReadiness(sql, opts = {}) {
   );
   const walLevel = walRows[0]?.setting ?? "unknown";
   items.push(
-    walLevel === "logical" ? { ok: true, label: `wal_level is ${import_picocolors5.default.bold("logical")}` } : {
+    walLevel === "logical" ? { ok: true, label: `wal_level is ${import_picocolors6.default.bold("logical")}` } : {
       ok: false,
-      label: `wal_level is ${import_picocolors5.default.bold(walLevel)} (need ${import_picocolors5.default.bold("logical")})`,
+      label: `wal_level is ${import_picocolors6.default.bold(walLevel)} (need ${import_picocolors6.default.bold("logical")})`,
       fix: `ALTER SYSTEM SET wal_level = 'logical'; then RESTART Postgres.
 On RDS/Aurora set rds.logical_replication = 1 in the parameter group, then reboot.
 On Neon enable Logical Replication in the project (Console \u2192 Settings \u2192 Logical Replication, or the API) \u2014 Neon forbids ALTER SYSTEM; the toggle sets wal_level=logical.`
@@ -280704,10 +281281,10 @@ On Neon enable Logical Replication in the project (Console \u2192 Settings \u219
   items.push(
     pubRow ? {
       ok: true,
-      label: `publication ${import_picocolors5.default.bold(publication)} exists ${import_picocolors5.default.dim(pubRow.puballtables ? "(all tables)" : "(table subset)")}`
+      label: `publication ${import_picocolors6.default.bold(publication)} exists ${import_picocolors6.default.dim(pubRow.puballtables ? "(all tables)" : "(table subset)")}`
     } : {
       ok: false,
-      label: `publication ${import_picocolors5.default.bold(publication)} not found`,
+      label: `publication ${import_picocolors6.default.bold(publication)} not found`,
       fix: `CREATE PUBLICATION ${quoteIdent(publication)} FOR ALL TABLES;`
     }
   );
@@ -280717,9 +281294,9 @@ On Neon enable Logical Replication in the project (Console \u2192 Settings \u219
   const role = roleRows[0];
   const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper));
   items.push(
-    hasReplication ? { ok: true, label: `DATABASE_URL role can stream replication ${import_picocolors5.default.dim("(REPLICATION)")}` } : {
+    hasReplication ? { ok: true, label: `DATABASE_URL role can stream replication ${import_picocolors6.default.dim("(REPLICATION)")}` } : {
       ok: false,
-      label: `DATABASE_URL role lacks the ${import_picocolors5.default.bold("REPLICATION")} attribute`,
+      label: `DATABASE_URL role lacks the ${import_picocolors6.default.bold("REPLICATION")} attribute`,
       fix: `ALTER ROLE current_user WITH REPLICATION;
 On RDS: GRANT rds_replication TO <your_role>;`
     }
@@ -280777,7 +281354,7 @@ function requireDatabaseUrl(verb) {
   const dbUrl = readProjectDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors5.default.red("  No DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors5.default.dim(` Set it to the Postgres you want Ablo to read, then re-run ${import_picocolors5.default.bold(`ablo connect ${verb}`)}.`)
+      import_picocolors6.default.red("  No DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors6.default.dim(` Set it to the Postgres you want Ablo to read, then re-run ${import_picocolors6.default.bold(`ablo connect ${verb}`)}.`)
     );
     process.exit(1);
   }
@@ -280791,7 +281368,7 @@ async function probeAndReport(dbUrl) {
     items = await probeReadiness(sql);
   } catch (err) {
     const pg = err ?? {};
-    console.error(import_picocolors5.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors6.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -280802,17 +281379,17 @@ async function probeAndReport(dbUrl) {
 async function runCheck() {
   const dbUrl = requireDatabaseUrl("--check");
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("connect --check")}  ${import_picocolors5.default.dim("logical-replication readiness")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect --check")}  ${import_picocolors6.default.dim("logical-replication readiness")}
 `);
   const failures = await probeAndReport(dbUrl);
   console.log();
   if (failures === 0) {
-    console.log(`  ${import_picocolors5.default.green("\u2713")} Ready \u2014 Ablo can connect and tail this database's WAL.
+    console.log(`  ${import_picocolors6.default.green("\u2713")} Ready \u2014 Ablo can connect and tail this database's WAL.
 `);
     process.exit(0);
   }
   console.log(
-    `  ${import_picocolors5.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors5.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors5.default.bold("ablo connect --check")}.`)}
+    `  ${import_picocolors6.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors6.default.bold("ablo connect --check")}.`)}
 `
   );
   process.exit(1);
@@ -280825,18 +281402,18 @@ async function runRegister() {
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(
-      import_picocolors5.default.red("  Not logged in.") + import_picocolors5.default.dim(` Run ${import_picocolors5.default.bold("ablo login")} (or set ${import_picocolors5.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`)
+      import_picocolors6.default.red("  Not logged in.") + import_picocolors6.default.dim(` Run ${import_picocolors6.default.bold("ablo login")} (or set ${import_picocolors6.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("connect --register")}  ${import_picocolors5.default.dim("register this database for replication")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect --register")}  ${import_picocolors6.default.dim("register this database for replication")}
 `);
   const failures = await probeAndReport(dbUrl);
   if (failures > 0) {
     console.log(
       `
-  ${import_picocolors5.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors5.default.dim("\u2014 a database that isn\u2019t replication-ready can\u2019t stream. Fix the above, then re-run.")}
+  ${import_picocolors6.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim("\u2014 a database that isn\u2019t replication-ready can\u2019t stream. Fix the above, then re-run.")}
 `
     );
     process.exit(1);
@@ -280850,7 +281427,7 @@ async function runRegister() {
       body: JSON.stringify({ connectionString: dbUrl })
     });
   } catch (err) {
-    console.error(import_picocolors5.default.red(`
+    console.error(import_picocolors6.default.red(`
   Couldn't reach ${apiUrl2}: ${err instanceof Error ? err.message : String(err)}
 `));
     process.exit(1);
@@ -280859,7 +281436,7 @@ async function runRegister() {
     const body2 = await res.json().catch(() => ({}));
     console.log(
       `
-  ${import_picocolors5.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors5.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors5.default.dim(`(${body2.id})`)}` : ""} \u2014 Ablo will replicate this database on the next sync.
+  ${import_picocolors6.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors6.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors6.default.dim(`(${body2.id})`)}` : ""} \u2014 Ablo will replicate this database on the next sync.
 `
     );
     process.exit(0);
@@ -280867,28 +281444,28 @@ async function runRegister() {
   const body = await res.json().catch(() => ({}));
   const code = body.code ?? body.error?.code;
   const message = body.message ?? body.error?.message ?? `HTTP ${res.status}`;
-  console.error(import_picocolors5.default.red(`
+  console.error(import_picocolors6.default.red(`
   Registration failed: ${message}`));
   if (code === "forbidden") {
-    console.error(import_picocolors5.default.dim(`  Registering a database needs a ${import_picocolors5.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors5.default.bold("ablo login")} for one.`));
+    console.error(import_picocolors6.default.dim(`  Registering a database needs a ${import_picocolors6.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors6.default.bold("ablo login")} for one.`));
   } else if (code === "datasource_connection_unsupported") {
     console.error(
-      import_picocolors5.default.dim(`  This deployment can\u2019t accept connection strings \u2014 use a self-hosted/hosted engine, or the signed endpoint fallback.`)
+      import_picocolors6.default.dim(`  This deployment can\u2019t accept connection strings \u2014 use a self-hosted/hosted engine, or the signed endpoint fallback.`)
     );
   } else if (code === "database_not_replication_ready") {
     for (const f of body.details?.failures ?? []) {
-      console.error(`  ${import_picocolors5.default.red("\u2717")} ${import_picocolors5.default.bold(f.item ?? "item")}${f.actual ? import_picocolors5.default.dim(` (${f.actual})`) : ""}`);
-      if (f.fix) for (const line of f.fix.split("\n")) console.error(`      ${import_picocolors5.default.red("\u2022")} ${line}`);
+      console.error(`  ${import_picocolors6.default.red("\u2717")} ${import_picocolors6.default.bold(f.item ?? "item")}${f.actual ? import_picocolors6.default.dim(` (${f.actual})`) : ""}`);
+      if (f.fix) for (const line of f.fix.split("\n")) console.error(`      ${import_picocolors6.default.red("\u2022")} ${line}`);
     }
-    console.error(import_picocolors5.default.dim(`
-  Apply the fixes, verify with ${import_picocolors5.default.bold("ablo connect --check")}, then re-run.`));
+    console.error(import_picocolors6.default.dim(`
+  Apply the fixes, verify with ${import_picocolors6.default.bold("ablo connect --check")}, then re-run.`));
   } else if (code === "database_unreachable") {
-    if (body.details?.reason) console.error(import_picocolors5.default.dim(`  ${body.details.reason}`));
+    if (body.details?.reason) console.error(import_picocolors6.default.dim(`  ${body.details.reason}`));
     console.error(
-      import_picocolors5.default.dim(
+      import_picocolors6.default.dim(
         `  Ablo's servers must be able to reach this database \u2014 a localhost or private-network
   Postgres can't be replicated by the hosted service. Use a reachable host (or a tunnel),
-  or the signed ${import_picocolors5.default.bold("dataSource()")} endpoint fallback.`
+  or the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.`
       )
     );
   }
@@ -280904,27 +281481,27 @@ async function runAuditInfra() {
     artifacts = await auditTenantSyncInfra(sql);
   } catch (err) {
     const pg = err ?? {};
-    console.error(import_picocolors5.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors6.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
   await sql.end({ timeout: 2 });
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("connect --audit-infra")}  ${import_picocolors5.default.dim("Stage 5 tenant DB sync-infra audit")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect --audit-infra")}  ${import_picocolors6.default.dim("Stage 5 tenant DB sync-infra audit")}
 `);
   const present = artifacts.filter((a) => a.present);
   if (present.length === 0) {
-    console.log(`  ${import_picocolors5.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
+    console.log(`  ${import_picocolors6.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
 `);
     process.exit(0);
   }
   for (const artifact of present) {
     const label = artifact.kind === "type" ? "type" : "relation";
-    console.log(`  ${import_picocolors5.default.yellow("!")} ${label} ${import_picocolors5.default.bold(`public.${artifact.name}`)} exists`);
+    console.log(`  ${import_picocolors6.default.yellow("!")} ${label} ${import_picocolors6.default.bold(`public.${artifact.name}`)} exists`);
   }
   console.log(
     `
-  ${import_picocolors5.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors5.default.dim("\u2014 do not drop automatically. Confirm the org/environment is log-authoritative, then follow ") + import_picocolors5.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors5.default.dim(".\n")
+  ${import_picocolors6.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors6.default.dim("\u2014 do not drop automatically. Confirm the org/environment is log-authoritative, then follow ") + import_picocolors6.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors6.default.dim(".\n")
   );
   process.exit(1);
 }
@@ -280933,7 +281510,7 @@ async function connect(argv) {
   try {
     args = parseConnectArgs(argv);
   } catch (err) {
-    console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors6.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (args.check) {
@@ -280967,7 +281544,7 @@ var CONNECT_USAGE = `  ablo connect \u2014 connect your database for the read pa
 init_cjs_shims();
 var import_fs6 = require("fs");
 var import_path4 = require("path");
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 var import_schema4 = require("@abloatai/ablo/schema");
 var DEFAULT_SCHEMA_PATH3 = "ablo/schema.ts";
 var DEFAULT_EXPORT3 = "schema";
@@ -280999,7 +281576,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors6.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors7.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -281008,18 +281585,18 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema4.serializeSchema)(schema));
     source = (0, import_schema4.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors6.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors7.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const abs = (0, import_path4.resolve)(process.cwd(), args.out);
   (0, import_fs6.mkdirSync)((0, import_path4.dirname)(abs), { recursive: true });
   (0, import_fs6.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors6.default.green("\u2713")} Generated types \u2192 ${import_picocolors6.default.bold(args.out)}`);
+  console.log(`  ${import_picocolors7.default.green("\u2713")} Generated types \u2192 ${import_picocolors7.default.bold(args.out)}`);
 }
 
 // src/cli/dev.ts
 init_cjs_shims();
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 var import_fs7 = require("fs");
 var import_path5 = require("path");
 var import_schema5 = require("@abloatai/ablo/schema");
@@ -281057,25 +281634,25 @@ function classifyKey(apiKey, activeMode) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors7.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors7.default.bold("ABLO_API_KEY")} (${import_picocolors7.default.bold("sk_test_")} = sandbox; ${import_picocolors7.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors7.default.dim(`Mode is currently '${activeMode}'.`)
+      reason: `No API key. Run ${import_picocolors8.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors8.default.bold("ABLO_API_KEY")} (${import_picocolors8.default.bold("sk_test_")} = sandbox; ${import_picocolors8.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors8.default.dim(`Mode is currently '${activeMode}'.`)
     };
   }
   if (apiKey.startsWith("sk_test_")) return { ok: true };
   if (apiKey.startsWith("sk_live_")) {
     return {
       ok: false,
-      reason: `Production schema deploys run one-shot: ${import_picocolors7.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors7.default.bold("ablo mode production")}). ${import_picocolors7.default.bold("--watch")} is sandbox-only.`
+      reason: `Production schema deploys run one-shot: ${import_picocolors8.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors8.default.bold("ablo mode production")}). ${import_picocolors8.default.bold("--watch")} is sandbox-only.`
     };
   }
   if (classifyCredentialKind(apiKey) === "restricted") {
     return {
       ok: false,
-      reason: `Restricted (${import_picocolors7.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors7.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors7.default.bold("sk_live_")} with ${import_picocolors7.default.bold("npx ablo push")} for a production deploy.`
+      reason: `Restricted (${import_picocolors8.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors8.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors8.default.bold("sk_live_")} with ${import_picocolors8.default.bold("npx ablo push")} for a production deploy.`
     };
   }
   return {
     ok: false,
-    reason: `${import_picocolors7.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors7.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors7.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors7.default.bold("npx ablo push")}).`
+    reason: `${import_picocolors8.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors8.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors8.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors8.default.bold("npx ablo push")}).`
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
@@ -281085,7 +281662,7 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
   if (!(0, import_fs7.existsSync)(envPath)) {
     (0, import_fs7.writeFileSync)(envPath, `${line}
 `, { mode: 384 });
-    action = `Created ${import_picocolors7.default.bold(".env.local")} with ${import_picocolors7.default.bold("ABLO_API_KEY")}`;
+    action = `Created ${import_picocolors8.default.bold(".env.local")} with ${import_picocolors8.default.bold("ABLO_API_KEY")}`;
   } else {
     const content = (0, import_fs7.readFileSync)(envPath, "utf8");
     const match = /^ABLO_API_KEY=(.*)$/m.exec(content);
@@ -281093,12 +281670,12 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
     if (!match) {
       (0, import_fs7.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
 `);
-      action = `Added ${import_picocolors7.default.bold("ABLO_API_KEY")} to ${import_picocolors7.default.bold(".env.local")}`;
+      action = `Added ${import_picocolors8.default.bold("ABLO_API_KEY")} to ${import_picocolors8.default.bold(".env.local")}`;
     } else if (existing === apiKey) {
-      action = `${import_picocolors7.default.bold(".env.local")} already has this key`;
+      action = `${import_picocolors8.default.bold(".env.local")} already has this key`;
     } else {
       (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
-      action = `Updated ${import_picocolors7.default.bold("ABLO_API_KEY")} in ${import_picocolors7.default.bold(".env.local")} ${import_picocolors7.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
+      action = `Updated ${import_picocolors8.default.bold("ABLO_API_KEY")} in ${import_picocolors8.default.bold(".env.local")} ${import_picocolors8.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
   }
   const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
@@ -281112,7 +281689,7 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
 `}.env.local
 `
     );
-    gitignoreNote = ` Added ${import_picocolors7.default.bold(".env.local")} to ${import_picocolors7.default.bold(".gitignore")} so the key can't be committed.`;
+    gitignoreNote = ` Added ${import_picocolors8.default.bold(".env.local")} to ${import_picocolors8.default.bold(".gitignore")} so the key can't be committed.`;
   }
   return `${action}.${gitignoreNote}`;
 }
@@ -281127,7 +281704,7 @@ async function runPush(schema, args) {
   if (ok) {
     return {
       ok: true,
-      message: body.unchanged ? `schema unchanged ${import_picocolors7.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors7.default.dim(`(v${body.version}, hash ${body.hash})`)}`
+      message: body.unchanged ? `schema unchanged ${import_picocolors8.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors8.default.dim(`(v${body.version}, hash ${body.hash})`)}`
     };
   }
   if (status2 === 409) {
@@ -281137,33 +281714,33 @@ async function runPush(schema, args) {
       (s) => s.shadowed != null
     );
     const lines = [
-      import_picocolors7.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
+      import_picocolors8.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
       "",
-      ...unexecutable.map((u2) => import_picocolors7.default.red(fmtSignal(u2))),
-      ...warnings.map((w2) => import_picocolors7.default.yellow(fmtSignal(w2))),
+      ...unexecutable.map((u2) => import_picocolors8.default.red(fmtSignal(u2))),
+      ...warnings.map((w2) => import_picocolors8.default.yellow(fmtSignal(w2))),
       "",
       ...hasShadowed ? [
-        import_picocolors7.default.dim(
+        import_picocolors8.default.dim(
           "  These models exist in the baseline above but not in your push. Sandbox readers"
         ),
-        import_picocolors7.default.dim(
+        import_picocolors8.default.dim(
           "  fall back to the production schema until you push your own, so applying this drops them."
         ),
         ""
       ] : [],
-      import_picocolors7.default.dim(
-        `  Fix: ${import_picocolors7.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors7.default.bold("--rename old:new")} if you renamed a model.`
+      import_picocolors8.default.dim(
+        `  Fix: ${import_picocolors8.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors8.default.bold("--rename old:new")} if you renamed a model.`
       )
     ];
     return { ok: false, message: lines.join("\n") };
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors7.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors7.default.bold("sandbox")} key with ${import_picocolors7.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors7.default.cyan("https://abloatai.com")}.`;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors8.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors8.default.bold("sandbox")} key with ${import_picocolors8.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors8.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
-` + import_picocolors7.default.dim(hint)
+` + import_picocolors8.default.dim(hint)
     };
   }
   return { ok: false, message: `Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}` };
@@ -281173,25 +281750,25 @@ async function dev(argv) {
   try {
     args = parseDevArgs(argv);
   } catch (err) {
-    console.error(import_picocolors7.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors8.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.apiKey) args.apiKey = resolveEffectiveApiKey("sandbox").key;
   const key = classifyKey(args.apiKey, getMode());
   if (!key.ok) {
-    console.error(import_picocolors7.default.red(`  ${key.reason}`));
+    console.error(import_picocolors8.default.red(`  ${key.reason}`));
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors7.default.dim("push")} ${import_picocolors7.default.dim("(sandbox)")}
+  ${brand("ablo")} ${import_picocolors8.default.dim("push")} ${import_picocolors8.default.dim("(sandbox)")}
 `);
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors7.default.dim("schema")}  ${import_picocolors7.default.bold(args.schemaPath)} ${import_picocolors7.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
+    `  ${import_picocolors8.default.dim("schema")}  ${import_picocolors8.default.bold(args.schemaPath)} ${import_picocolors8.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
   );
-  console.log(`  ${import_picocolors7.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
-  console.log(`  ${import_picocolors7.default.dim("api")}     ${args.url}
+  console.log(`  ${import_picocolors8.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
+  console.log(`  ${import_picocolors8.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
   s.start("Pushing schema definition (sandbox)");
@@ -281200,16 +281777,16 @@ async function dev(argv) {
   if (!first.ok) process.exit(1);
   if (process.env.ABLO_API_KEY) {
     console.log(`
-  ${import_picocolors7.default.green("\u2713")} ${import_picocolors7.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
+  ${import_picocolors8.default.green("\u2713")} ${import_picocolors8.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
   } else {
     console.log(`
-  ${import_picocolors7.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
-    console.log(`  ${import_picocolors7.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
+  ${import_picocolors8.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
+    console.log(`  ${import_picocolors8.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
   console.log(`  Your app is wired for the sandbox.`);
   if (!args.watch) return;
   const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
-  console.log(`  ${import_picocolors7.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
+  console.log(`  ${import_picocolors8.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
 `);
   let timer2 = null;
   let pushing = false;
@@ -281229,7 +281806,7 @@ async function dev(argv) {
       const r2 = await runPush(next, args);
       s2.stop(r2.message, r2.ok ? 0 : 1);
     } catch (err) {
-      s2.stop(import_picocolors7.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
+      s2.stop(import_picocolors8.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
     } finally {
       pushing = false;
     }
@@ -281237,7 +281814,7 @@ async function dev(argv) {
   const stop = () => {
     watcher.close();
     console.log(`
-  ${import_picocolors7.default.dim("stopped.")}`);
+  ${import_picocolors8.default.dim("stopped.")}`);
     process.exit(0);
   };
   process.on("SIGINT", stop);
@@ -281249,7 +281826,7 @@ async function dev(argv) {
 // src/cli/login.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 var CLIENT_ID = "ablo-cli";
 var stripSlash = (u2) => u2.replace(/\/+$/, "");
 var AUTH_URL = stripSlash(process.env.ABLO_AUTH_URL ?? "https://auth.abloatai.com");
@@ -281307,9 +281884,9 @@ async function deviceLogin(argv, deps = {}) {
   const code = await codeRes.json();
   const approvePath = `/cli?user_code=${code.user_code}`;
   const url = account === "signup" ? `${DASHBOARD_URL}/signup?next=${encodeURIComponent(approvePath)}` : `${DASHBOARD_URL}${approvePath}`;
-  Me(`${import_picocolors8.default.bold(code.user_code)}
+  Me(`${import_picocolors9.default.bold(code.user_code)}
 
-${import_picocolors8.default.dim(url)}`, "Approve in your browser");
+${import_picocolors9.default.dim(url)}`, "Approve in your browser");
   openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -281376,7 +281953,7 @@ ${import_picocolors8.default.dim(url)}`, "Approve in your browser");
     if (reason) M2.error(reason);
     else if (provRes) M2.error(`Key provisioning returned ${provRes.status} from ${DASHBOARD_URL}/api/cli/provision-key.`);
     M2.error(
-      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors8.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors8.default.bold("ABLO_API_KEY")}.`
+      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors9.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors9.default.bold("ABLO_API_KEY")}.`
     );
     process.exit(1);
   }
@@ -281396,9 +281973,9 @@ ${import_picocolors8.default.dim(url)}`, "Approve in your browser");
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
   s.stop(`Saved keys to ${path}`);
-  const where = prov.project ? ` ${import_picocolors8.default.dim(`(project ${prov.project.slug})`)}` : "";
+  const where = prov.project ? ` ${import_picocolors9.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
-    `${import_picocolors8.default.green("\u2713")} Logged in ${import_picocolors8.default.dim("(sandbox)")}${where}. Run ${import_picocolors8.default.bold("npx ablo push")} to push your schema.`
+    `${import_picocolors9.default.green("\u2713")} Logged in ${import_picocolors9.default.dim("(sandbox)")}${where}. Run ${import_picocolors9.default.bold("npx ablo push")} to push your schema.`
   );
 }
 async function login(argv = [], deps = {}) {
@@ -281407,20 +281984,20 @@ async function login(argv = [], deps = {}) {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors8.default.green("\u2713")} Logged out ${import_picocolors8.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors9.default.green("\u2713")} Logged out ${import_picocolors9.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors8.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors9.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_API_KEY) {
     console.log(
-      import_picocolors8.default.dim(`  Note: ${import_picocolors8.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
+      import_picocolors9.default.dim(`  Note: ${import_picocolors9.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
     );
   }
 }
 
 // src/cli/mode.ts
 init_cjs_shims();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 var PREFIX = { sandbox: "sk_test_", production: "rk_live_" };
 function hintFor(m2, current) {
   const parts = [];
@@ -281430,10 +282007,10 @@ function hintFor(m2, current) {
 }
 function apply(m2) {
   setMode(m2);
-  console.log(`  ${import_picocolors9.default.green("\u2713")} now in ${import_picocolors9.default.bold(m2)}`);
+  console.log(`  ${import_picocolors10.default.green("\u2713")} now in ${import_picocolors10.default.bold(m2)}`);
   if (!getKeyEntry(m2)) {
     console.log(
-      import_picocolors9.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors9.default.bold("ablo login")} or ${import_picocolors9.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
+      import_picocolors10.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors10.default.bold("ablo login")} or ${import_picocolors10.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
     );
   }
 }
@@ -281446,14 +282023,14 @@ async function mode(argv) {
   }
   if (arg) {
     console.error(
-      import_picocolors9.default.red(`  unknown mode: ${arg}`) + import_picocolors9.default.dim(` (expected ${import_picocolors9.default.bold("sandbox")} or ${import_picocolors9.default.bold("production")})`)
+      import_picocolors10.default.red(`  unknown mode: ${arg}`) + import_picocolors10.default.dim(` (expected ${import_picocolors10.default.bold("sandbox")} or ${import_picocolors10.default.bold("production")})`)
     );
     process.exit(1);
   }
   const current = getMode();
   if (!process.stdin.isTTY || process.env.CI) {
     console.error(
-      import_picocolors9.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors9.default.bold("ablo mode sandbox") + import_picocolors9.default.dim(" | ") + import_picocolors9.default.bold("ablo mode production") + import_picocolors9.default.dim(`  (current: ${current})`)
+      import_picocolors10.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors10.default.bold("ablo mode sandbox") + import_picocolors10.default.dim(" | ") + import_picocolors10.default.bold("ablo mode production") + import_picocolors10.default.dim(`  (current: ${current})`)
     );
     process.exit(1);
   }
@@ -281472,206 +282049,6 @@ async function mode(argv) {
   apply(selected);
 }
 
-// src/cli/projects.ts
-init_cjs_shims();
-var import_picocolors10 = __toESM(require_picocolors(), 1);
-function apiUrl() {
-  return (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
-}
-function requireKey() {
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    console.error(
-      import_picocolors10.default.red("  No API key.") + import_picocolors10.default.dim(
-        ` Run ${import_picocolors10.default.bold("npx ablo login")} \u2014 or set ${import_picocolors10.default.bold("ABLO_API_KEY")} (${import_picocolors10.default.bold("sk_test_")} = sandbox; ${import_picocolors10.default.bold("sk_live_")} = production).`
-      )
-    );
-    process.exit(1);
-  }
-  return apiKey;
-}
-async function request(path, apiKey, init2 = {}) {
-  const res = await fetch(`${apiUrl()}${path}`, {
-    method: init2.method ?? "GET",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${apiKey}`
-    },
-    ...init2.body !== void 0 ? { body: JSON.stringify(init2.body) } : {}
-  });
-  let body = {};
-  try {
-    body = await res.json();
-  } catch {
-  }
-  return { status: res.status, body };
-}
-async function listProjects(apiKey) {
-  try {
-    const { status: status2, body } = await request("/api/v1/projects", apiKey);
-    if (status2 !== 200 || !Array.isArray(body.data)) return null;
-    return body.data;
-  } catch {
-    return null;
-  }
-}
-async function fetchProjects() {
-  const all = await listProjects(requireKey());
-  if (!all) {
-    console.error(import_picocolors10.default.red("  Could not list projects \u2014 is the API reachable and the key valid?"));
-    process.exit(1);
-  }
-  return all;
-}
-function projectSlugFromPackageName(name) {
-  if (typeof name !== "string") return void 0;
-  const slug = name.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 64);
-  if (!slug || slug === "default") return void 0;
-  return slug;
-}
-async function ensureProject(slug, name) {
-  const apiKey = resolveApiKey();
-  if (!apiKey) return null;
-  try {
-    const { status: status2, body } = await request("/api/v1/projects", apiKey, {
-      method: "POST",
-      body: { slug, ...name ? { name } : {} }
-    });
-    if (status2 === 201) {
-      const created = body;
-      setActiveProject({ id: created.id, slug: created.slug });
-      return { id: created.id, slug: created.slug, created: true };
-    }
-    if (body.code === "project_slug_taken") {
-      const all = await listProjects(apiKey);
-      const existing = all?.find((p2) => p2.slug === slug);
-      if (!existing) return null;
-      setActiveProject({ id: existing.id, slug: existing.slug });
-      return { id: existing.id, slug: existing.slug, created: false };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function printList(projects2) {
-  const active = getActiveProject();
-  for (const p2 of projects2) {
-    const isActive = active ? active.id === p2.id : p2.default;
-    const marker = isActive ? import_picocolors10.default.green("\u25CF") : import_picocolors10.default.dim("\u25CB");
-    const tags = [p2.default ? import_picocolors10.default.dim("default") : "", isActive ? import_picocolors10.default.green("active") : ""].filter(Boolean).join(import_picocolors10.default.dim(", "));
-    console.log(
-      `  ${marker} ${p2.slug.padEnd(20)} ${import_picocolors10.default.dim(p2.id)}${tags ? `  ${tags}` : ""}`
-    );
-  }
-}
-async function projects(argv) {
-  const sub = argv[0];
-  if (sub === "list" || sub === void 0) {
-    console.log(`
-  ${brand("ablo")} ${import_picocolors10.default.dim("projects")}
-`);
-    printList(await fetchProjects());
-    console.log();
-    return;
-  }
-  if (sub === "create") {
-    const slug = argv[1];
-    if (!slug || slug.startsWith("-")) {
-      console.error(import_picocolors10.default.red('  usage: ablo projects create <slug> [--name "Display Name"]'));
-      process.exit(1);
-    }
-    const nameIdx = argv.indexOf("--name");
-    const name = nameIdx >= 0 ? argv[nameIdx + 1] : void 0;
-    const { status: status2, body } = await request("/api/v1/projects", requireKey(), {
-      method: "POST",
-      body: { slug, ...name ? { name } : {} }
-    });
-    if (status2 !== 201) {
-      console.error(
-        import_picocolors10.default.red(`  Create failed (${status2}): ${String(body.message ?? body.code ?? "")}`)
-      );
-      if (body.code === "project_slug_taken") {
-        console.error(import_picocolors10.default.dim(`  Pick another slug, or switch to it: ${import_picocolors10.default.bold(`ablo projects use ${slug}`)}`));
-      }
-      process.exit(1);
-    }
-    const created = body;
-    console.log(`  ${import_picocolors10.default.green("\u2713")} Created project ${import_picocolors10.default.bold(created.slug)} ${import_picocolors10.default.dim(`(${created.id})`)}`);
-    console.log(
-      import_picocolors10.default.dim(`  Make it active with ${import_picocolors10.default.bold(`ablo projects use ${created.slug}`)}; mint its keys in the dashboard.`)
-    );
-    return;
-  }
-  if (sub === "rename") {
-    const ref = argv[1];
-    const name = argv.slice(2).join(" ").trim();
-    if (!ref || ref.startsWith("-") || !name) {
-      console.error(import_picocolors10.default.red("  usage: ablo projects rename <slug|id> <new name>"));
-      process.exit(1);
-    }
-    const all = await fetchProjects();
-    const target = all.find((p2) => p2.slug === ref || p2.id === ref);
-    if (!target) {
-      console.error(import_picocolors10.default.red(`  No project "${ref}".`) + import_picocolors10.default.dim(" Run ablo projects list."));
-      process.exit(1);
-    }
-    if (target.default) {
-      console.error(import_picocolors10.default.red("  The default project cannot be renamed."));
-      process.exit(1);
-    }
-    const { status: status2, body } = await request(`/api/v1/projects/${target.id}`, requireKey(), {
-      method: "PATCH",
-      body: { name }
-    });
-    if (status2 !== 200) {
-      console.error(
-        import_picocolors10.default.red(`  Rename failed (${status2}): ${String(body.message ?? body.code ?? "")}`)
-      );
-      process.exit(1);
-    }
-    const updated = body;
-    console.log(
-      `  ${import_picocolors10.default.green("\u2713")} Renamed ${import_picocolors10.default.bold(updated.slug)} \u2192 ${import_picocolors10.default.bold(updated.name ?? updated.slug)} ${import_picocolors10.default.dim(`(${updated.id})`)}`
-    );
-    return;
-  }
-  if (sub === "use") {
-    const ref = argv[1];
-    if (!ref) {
-      console.error(import_picocolors10.default.red("  usage: ablo projects use <slug|id|default>"));
-      process.exit(1);
-    }
-    const all = await fetchProjects();
-    const target = all.find((p2) => p2.slug === ref || p2.id === ref);
-    if (!target) {
-      console.error(import_picocolors10.default.red(`  No project "${ref}".`) + import_picocolors10.default.dim(" Run ablo projects list."));
-      process.exit(1);
-    }
-    if (target.default) {
-      setActiveProject(void 0);
-      console.log(`  ${import_picocolors10.default.green("\u2713")} now targeting the ${import_picocolors10.default.bold("default")} project`);
-    } else {
-      setActiveProject({ id: target.id, slug: target.slug });
-      console.log(`  ${import_picocolors10.default.green("\u2713")} now targeting project ${import_picocolors10.default.bold(target.slug)} ${import_picocolors10.default.dim(`(${target.id})`)}`);
-    }
-    const guard = guardActiveProjectKey();
-    if (!guard.ok) {
-      const loginCmd = guard.activeProfile === DEFAULT_PROFILE ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
-      console.log(
-        import_picocolors10.default.dim(`  No key stored for this project yet \u2014 run ${import_picocolors10.default.bold(loginCmd)} to mint one.`)
-      );
-    }
-    return;
-  }
-  console.error(
-    import_picocolors10.default.red(`  unknown subcommand: ${sub}`) + import_picocolors10.default.dim(
-      ` (expected ${import_picocolors10.default.bold("list")}, ${import_picocolors10.default.bold("create")}, ${import_picocolors10.default.bold("rename")}, or ${import_picocolors10.default.bold("use")})`
-    )
-  );
-  process.exit(1);
-}
-
 // src/cli/status.ts
 init_cjs_shims();
 var import_picocolors11 = __toESM(require_picocolors(), 1);
@@ -281761,17 +282138,44 @@ function formatConflict(conflict) {
   const parts = ["user", "agent", "system"].flatMap((k3) => conflict[k3] ? [`${k3}:${conflict[k3]}`] : []);
   return parts.length ? `{${parts.join(",")}}` : "";
 }
+function printTargetLines(target, localProject) {
+  const confirmed = target?.confirmed ?? null;
+  if (confirmed?.organizationId) {
+    console.log(`  ${import_picocolors11.default.dim("org")}     ${import_picocolors11.default.dim(confirmed.organizationId)}`);
+  }
+  let projectLine;
+  if (confirmed?.project) {
+    const p2 = confirmed.project;
+    projectLine = p2.isDefault ? `${import_picocolors11.default.bold("default")} ${import_picocolors11.default.dim("(org-default)")}` : `${import_picocolors11.default.bold(p2.slug)} ${import_picocolors11.default.dim(`(${p2.id})`)}`;
+  } else if (confirmed) {
+    projectLine = `${import_picocolors11.default.bold("default")} ${import_picocolors11.default.dim("(org-default)")}`;
+  } else if (localProject) {
+    projectLine = `${import_picocolors11.default.bold(localProject.slug)} ${import_picocolors11.default.dim(`(${localProject.id})`)} ${import_picocolors11.default.yellow("(unconfirmed)")}`;
+  } else {
+    projectLine = `${import_picocolors11.default.bold("default")} ${target ? import_picocolors11.default.yellow("(unconfirmed)") : import_picocolors11.default.dim("(org-default)")}`;
+  }
+  console.log(`  ${import_picocolors11.default.dim("project")} ${projectLine}`);
+  const env = confirmed?.environment ?? target?.keyEnv ?? null;
+  if (env) {
+    const suffix = confirmed ? "" : ` ${import_picocolors11.default.yellow("(unconfirmed)")}`;
+    console.log(`  ${import_picocolors11.default.dim("env")}     ${import_picocolors11.default.bold(env)}${suffix}`);
+  }
+  for (const m2 of target?.mismatches ?? []) {
+    console.log(`  ${import_picocolors11.default.yellow("\u26A0")} ${import_picocolors11.default.yellow(describeMismatch(m2))}`);
+  }
+}
 async function status(args = []) {
   const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
   const cfg = readConfig();
   const mode2 = getMode();
+  const effective = resolveEffectiveApiKey();
+  const target = effective.key ? await resolveTarget({ url: apiUrl2, apiKey: effective.key, keySource: effective.source ?? "stored" }) : null;
   if (args.includes("--json")) {
     const entry = getKeyEntry(mode2);
     const key2 = describeEffectiveKey(mode2, process.env.ABLO_API_KEY, entry);
     const plan2 = resolvePushPlan();
     const activeProject2 = getActiveProject();
-    const effective2 = resolveEffectiveApiKey();
-    const pushed = await fetchPushedSchema(apiUrl2, effective2.key);
+    const pushed = await fetchPushedSchema(apiUrl2, effective.key);
     const out = {
       mode: mode2,
       // The locally-active project (`ablo projects use`); null = org-default.
@@ -281780,8 +282184,8 @@ async function status(args = []) {
       // 'env' | '.env.local' | '.env' | 'stored'. Key confusion is a common
       // source of trouble, and the source is usually the answer.
       effectiveKey: {
-        prefix: effective2.key ? effective2.key.slice(0, 12) : null,
-        source: effective2.source
+        prefix: effective.key ? effective.key.slice(0, 12) : null,
+        source: effective.source
       },
       keyPrefix: key2.keyPrefix,
       keySource: key2.keySource,
@@ -281791,6 +282195,19 @@ async function status(args = []) {
       keyMatchesStoredActiveKey: key2.keyMatchesStoredActiveKey,
       keyMismatch: key2.keyMismatch,
       organizationId: entry?.organizationId ?? null,
+      // The SERVER-CONFIRMED plane this key resolves to — the authoritative
+      // answer to "where does a push land", independent of the local
+      // `project`/`mode` preferences above. Null when the server didn't answer.
+      confirmedTarget: target?.confirmed ? {
+        organizationId: target.confirmed.organizationId,
+        environment: target.confirmed.environment,
+        project: target.confirmed.project,
+        projectId: target.confirmed.projectId,
+        sandboxId: target.confirmed.sandboxId
+      } : null,
+      // Divergences between local intent and the confirmed plane (project not
+      // selected, mode not the key's environment). Empty when aligned.
+      mismatches: target?.mismatches ?? [],
       // What `ablo push` would do right now — the answer to "why did push
       // demand a different key".
       push: {
@@ -281804,6 +282221,7 @@ async function status(args = []) {
       schema: pushed ? {
         active: pushed.active,
         version: pushed.version ?? null,
+        hash: pushed.hash ?? null,
         pushedAt: pushed.pushedAt ?? null,
         models: pushed.models
       } : null,
@@ -281816,7 +282234,6 @@ async function status(args = []) {
   console.log(`
   ${brand("ablo")} ${import_picocolors11.default.dim("status")}
 `);
-  const effective = resolveEffectiveApiKey();
   if (effective.key && effective.source && effective.source !== "stored") {
     const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
     console.log(
@@ -281832,9 +282249,7 @@ async function status(args = []) {
     console.log(`  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.yellow(key.keyMismatch.message)}`);
   }
   const activeProject = getActiveProject();
-  console.log(
-    `  ${import_picocolors11.default.dim("project")} ${activeProject ? `${import_picocolors11.default.bold(activeProject.slug)} ${import_picocolors11.default.dim(`(${activeProject.id})`)}` : import_picocolors11.default.bold("default")}`
-  );
+  printTargetLines(target, activeProject);
   for (const m2 of ["sandbox", "production"]) {
     const entry = getKeyEntry(m2);
     const marker = m2 === mode2 ? import_picocolors11.default.green("\u25CF") : import_picocolors11.default.dim("\u25CB");
@@ -281845,8 +282260,7 @@ async function status(args = []) {
       console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors11.default.dim("\u2014 no key")}`);
     }
   }
-  const org = activeEntry?.organizationId;
-  if (org) console.log(`  ${import_picocolors11.default.dim("org")}     ${org}`);
+  const org = target?.confirmed?.organizationId ?? activeEntry?.organizationId;
   const plan = resolvePushPlan();
   console.log(
     `  ${import_picocolors11.default.dim("push")}    ${plan.apiKey ? `${import_picocolors11.default.bold(plan.flow)} ${import_picocolors11.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors11.default.bold(plan.flow)} ${import_picocolors11.default.yellow("\u2014 no credential")} ${import_picocolors11.default.dim(`(run ${import_picocolors11.default.bold("ablo login")} or set ${import_picocolors11.default.bold("ABLO_API_KEY")})`)}`}`
@@ -281860,7 +282274,8 @@ async function status(args = []) {
     if (pushed?.active) {
       const when = pushed.pushedAt ? ` ${import_picocolors11.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
       const ver = pushed.version != null ? ` ${import_picocolors11.default.dim(`(rev ${pushed.version})`)}` : "";
-      console.log(`  ${import_picocolors11.default.dim("schema")}  ${import_picocolors11.default.bold(`${pushed.models.length} models pushed`)}${ver}${when}`);
+      const hashLabel = pushed.hash ? ` ${import_picocolors11.default.dim(`hash ${pushed.hash}`)}` : "";
+      console.log(`  ${import_picocolors11.default.dim("schema")}  ${import_picocolors11.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
       for (const m2 of pushed.models) {
         const tn = m2.typename === m2.key ? import_picocolors11.default.dim(`typename=${m2.typename}`) : import_picocolors11.default.yellow(`typename=${m2.typename}`);
         const conflict = formatConflict(m2.conflict);