@abloatai/ablo 0.30.2 → 0.31.0

package/dist/cli.cjs

@@ -1755,9 +1755,9 @@ var init_query = __esm({
     CLOSE = {};
     Query = class extends Promise {
       constructor(strings, args, handler, canceller, options = {}) {
-        let resolve7, reject;
+        let resolve6, reject;
         super((a, b4) => {
-          resolve7 = a;
+          resolve6 = a;
           reject = b4;
         });
         this.tagged = Array.isArray(strings.raw);
@@ -1768,7 +1768,7 @@ var init_query = __esm({
         this.options = options;
         this.state = null;
         this.statement = null;
-        this.resolve = (x2) => (this.active = false, resolve7(x2));
+        this.resolve = (x2) => (this.active = false, resolve6(x2));
         this.reject = (x2) => (this.active = false, reject(x2));
         this.active = false;
         this.cancelled = null;
@@ -1816,12 +1816,12 @@ var init_query = __esm({
               if (this.executed && !this.active)
                 return { done: true };
               prev && prev();
-              const promise = new Promise((resolve7, reject) => {
+              const promise = new Promise((resolve6, reject) => {
                 this.cursorFn = (value) => {
-                  resolve7({ value, done: false });
+                  resolve6({ value, done: false });
                   return new Promise((r2) => prev = r2);
                 };
-                this.resolve = () => (this.active = false, resolve7({ done: true }));
+                this.resolve = () => (this.active = false, resolve6({ done: true }));
                 this.reject = (x2) => (this.active = false, reject(x2));
               });
               this.execute();
@@ -2419,12 +2419,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x2.on("drain", drain);
     return x2;
   }
-  async function cancel({ pid, secret }, resolve7, reject) {
+  async function cancel({ pid, secret }, resolve6, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect2();
       socket.once("error", reject);
-      socket.once("close", resolve7);
+      socket.once("close", resolve6);
     } catch (error2) {
       reject(error2);
     }
@@ -3447,7 +3447,7 @@ var init_subscribe = __esm({
 
 // node_modules/postgres/src/large.js
 function largeObject(sql, oid, mode2 = 131072 | 262144) {
-  return new Promise(async (resolve7, reject) => {
+  return new Promise(async (resolve6, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -3473,7 +3473,7 @@ function largeObject(sql, oid, mode2 = 131072 | 262144) {
           ) seek
         `
       };
-      resolve7(lo);
+      resolve6(lo);
       return new Promise(async (r2) => finish = r2);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -3635,8 +3635,8 @@ function Postgres(a, b4) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve7, reject) => {
-      const query = { reserve: resolve7, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve6, reject) => {
+      const query = { reserve: resolve6, reject };
       queries.push(query);
       closed.length && connect2(closed.shift(), query);
     });
@@ -3673,9 +3673,9 @@ function Postgres(a, b4) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve7, reject) => {
+        result = await new Promise((resolve6, reject) => {
           const x2 = fn2(sql2);
-          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve7, reject);
+          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve6, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -3732,8 +3732,8 @@ function Postgres(a, b4) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve7, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve7, reject) : query.cancelled = { resolve: resolve7, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve7());
+    return new Promise((resolve6, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve6, reject) : query.cancelled = { resolve: resolve6, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve6());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -3752,11 +3752,11 @@ function Postgres(a, b4) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve7) {
+  async function destroy(resolve6) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve7();
+    resolve6();
   }
   function connect2(c, query) {
     move(c, connecting);
@@ -3955,10 +3955,22 @@ function rewriteDatabaseUrl(ownerUrl, role, password) {
   url.password = password;
   return url.toString();
 }
+function readProjectReplicationUrlWithSource(cwd = process.cwd()) {
+  for (const variable of REPLICATION_URL_VARS) {
+    const value = process.env[variable];
+    if (value) return { url: value, variable };
+  }
+  for (const variable of REPLICATION_URL_VARS) {
+    const value = readProjectEnvValue(variable, cwd);
+    if (value) return { url: value, variable };
+  }
+  return null;
+}
 function readProjectDatabaseUrl(cwd = process.cwd()) {
-  const fromEnv = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
-  if (fromEnv) return fromEnv;
-  return readProjectEnvValue("DATABASE_URL", cwd);
+  return readProjectReplicationUrlWithSource(cwd)?.url ?? null;
+}
+function readProjectAdminDatabaseUrl(cwd = process.cwd()) {
+  return process.env.DATABASE_URL ?? readProjectEnvValue("DATABASE_URL", cwd);
 }
 function readProjectWriteDatabaseUrl(cwd = process.cwd()) {
   const fromEnv = process.env.ABLO_WRITE_DATABASE_URL;
@@ -3984,7 +3996,7 @@ function readProjectApiKey(cwd = process.cwd()) {
   }
   return null;
 }
-var import_crypto2, import_fs2, import_path;
+var import_crypto2, import_fs2, import_path, REPLICATION_URL_VARS, DATABASE_URL_REMOVAL_VERSION;
 var init_dbRole = __esm({
   "src/cli/dbRole.ts"() {
     "use strict";
@@ -3994,6 +4006,8 @@ var init_dbRole = __esm({
     init_dist2();
     import_fs2 = require("fs");
     import_path = require("path");
+    REPLICATION_URL_VARS = ["ABLO_REPLICATION_DATABASE_URL", "DATABASE_URL"];
+    DATABASE_URL_REMOVAL_VERSION = "0.32.0";
   }
 });
 
@@ -5426,8 +5440,17 @@ var connectApply_exports = {};
 __export(connectApply_exports, {
   connectApplyPlan: () => connectApplyPlan,
   passwordClause: () => passwordClause,
+  postRegistrationOutcome: () => postRegistrationOutcome,
   runConnectApply: () => runConnectApply
 });
+function postRegistrationOutcome(input) {
+  if (input.registered) return { exitCode: 0, notice: null };
+  if (!input.rotating) return { exitCode: 1, notice: null };
+  return {
+    exitCode: 1,
+    notice: "The new passwords are set in your database, but Ablo could not be updated with them.\nAblo still holds the previous password, which no longer works \u2014 writes will fail until\nyou re-run `ablo connect --rotate` (each run is idempotent and rotates a fresh password)."
+  };
+}
 function passwordClause(password, mode2) {
   return mode2 === "scram-verifier" ? scramSha256Verifier(password) : password.replace(/'/g, "''");
 }
@@ -5496,38 +5519,6 @@ function isPlaintextRefusal(err) {
   const message = err instanceof Error ? err.message : String(err);
   return /plaintext password/i.test(message);
 }
-function persistScopedUrls(vars, cwd = process.cwd()) {
-  const targets = [".env.local", ".env"];
-  const existing = targets.find((name) => (0, import_fs6.existsSync)((0, import_path4.resolve)(cwd, name)));
-  const file = existing ?? ".env.local";
-  const path = (0, import_path4.resolve)(cwd, file);
-  let content = (0, import_fs6.existsSync)(path) ? (0, import_fs6.readFileSync)(path, "utf8") : "";
-  for (const [name, value] of Object.entries(vars)) {
-    const line = `${name}=${value}`;
-    const pattern = new RegExp(`^${name}=.*$`, "m");
-    if (pattern.test(content)) {
-      content = content.replace(pattern, line);
-    } else {
-      content = `${content}${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
-`;
-    }
-  }
-  if (!(0, import_fs6.existsSync)(path)) {
-    (0, import_fs6.writeFileSync)(path, content, { mode: 384 });
-  } else {
-    (0, import_fs6.writeFileSync)(path, content);
-  }
-  const gitignorePath = (0, import_path4.resolve)(cwd, ".gitignore");
-  const gitignore = (0, import_fs6.existsSync)(gitignorePath) ? (0, import_fs6.readFileSync)(gitignorePath, "utf8") : "";
-  if (!/^\.env(\.local|\*|\.\*)?$/m.test(gitignore)) {
-    (0, import_fs6.appendFileSync)(
-      gitignorePath,
-      `${gitignore.endsWith("\n") || gitignore.length === 0 ? "" : "\n"}.env.local
-`
-    );
-  }
-  return file;
-}
 function printPlan2(steps, showSql) {
   console.log(`  This sets up your database for Ablo:
 `);
@@ -5578,16 +5569,38 @@ async function executePlan(sql, steps, rebuildPlaintext) {
   return { walDeferred };
 }
 async function runConnectApply(args) {
-  const adminUrl = readProjectDatabaseUrl();
+  const rotating = args.rotate;
+  const verb = rotating ? "connect --rotate" : "connect --apply";
+  const adminUrl = args.url ?? readProjectAdminDatabaseUrl();
   if (!adminUrl) {
     console.error(
-      import_picocolors6.default.red("  No DATABASE_URL found.") + import_picocolors6.default.dim(` Point it at your admin connection and re-run.`)
+      import_picocolors6.default.red("  No admin connection string.") + import_picocolors6.default.dim(` Pass ${import_picocolors6.default.bold("--url <admin-conn>")} (or set ${import_picocolors6.default.bold("DATABASE_URL")}) and re-run.`)
+    );
+    process.exit(1);
+  }
+  const adminSource = args.url ? "--url" : "DATABASE_URL";
+  let target = "your database";
+  try {
+    const parsed = new URL(adminUrl);
+    target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+  } catch {
+  }
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors6.default.red("  Not logged in.") + import_picocolors6.default.dim(
+        ` Run ${import_picocolors6.default.bold("ablo login")} (or set ${import_picocolors6.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
+      )
     );
     process.exit(1);
   }
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors6.default.dim("connect --apply")}  ${import_picocolors6.default.dim("set up your database for Ablo")}
+  ${brand("ablo")} ${import_picocolors6.default.dim(verb)}  ${import_picocolors6.default.dim(rotating ? "re-key the scoped roles" : "set up your database for Ablo")}
+`
+  );
+  console.log(
+    `  ${import_picocolors6.default.dim("\u2192")} ${import_picocolors6.default.bold(target)}${adminSource === "DATABASE_URL" ? import_picocolors6.default.dim("  (admin via DATABASE_URL)") : ""}
 `
   );
   const admin = src_default(adminUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
@@ -5604,7 +5617,7 @@ async function runConnectApply(args) {
   if (!capability || !(capability.rolsuper || capability.rolcreaterole)) {
     await admin.end({ timeout: 2 });
     console.error(
-      import_picocolors6.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors6.default.dim(` Point DATABASE_URL at your owner/admin connection and re-run.`)
+      import_picocolors6.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors6.default.dim(` Point ${import_picocolors6.default.bold("--url")} at your owner/admin connection and re-run.`)
     );
     process.exit(1);
   }
@@ -5631,7 +5644,7 @@ async function runConnectApply(args) {
       process.exit(1);
     }
     const proceed = await ye({
-      message: `Set this up in ${capability.rolname === "postgres" ? "your database" : `your database as ${capability.rolname}`}?`,
+      message: rotating ? `Re-key Ablo's roles on ${target}?` : `Provision Ablo on ${target}?`,
       initialValue: true
     });
     if (pD(proceed) || !proceed) {
@@ -5659,49 +5672,55 @@ async function runConnectApply(args) {
   const writeRole = args.writeRole && args.writeRole.length > 0 ? args.writeRole : ABLO_WRITE_ROLE;
   const replicationUrl = rewriteDatabaseUrl(adminUrl, role, replicationPassword);
   const writeUrl = rewriteDatabaseUrl(adminUrl, writeRole, writePassword);
-  const where = persistScopedUrls({
-    DATABASE_URL: replicationUrl,
-    ABLO_WRITE_DATABASE_URL: writeUrl
-  });
-  console.log(
-    `
-  ${import_picocolors6.default.green("\u2713")} Roles created \u2014 ${import_picocolors6.default.bold("DATABASE_URL")} + ${import_picocolors6.default.bold("ABLO_WRITE_DATABASE_URL")} updated in ${import_picocolors6.default.bold(where)}.
-`
-  );
-  const verifier = src_default(replicationUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
-  } });
-  let items;
-  try {
-    items = await probeReadiness(verifier);
-  } catch {
-    await verifier.end({ timeout: 2 }).catch(() => void 0);
-    console.log(import_picocolors6.default.dim(`  Verify when reachable:  `) + import_picocolors6.default.cyan("npx ablo connect --check") + "\n");
-    process.exit(0);
-  }
-  await verifier.end({ timeout: 2 });
-  const failed = items.filter((i) => !i.ok);
+  console.log(`
+  ${import_picocolors6.default.green("\u2713")} Roles ${rotating ? "re-keyed" : "created"}.
+`);
   if (walDeferred) {
     console.log(
       `  ${import_picocolors6.default.yellow("!")} One step left \u2014 logical replication needs a restart.
 ` + import_picocolors6.default.dim(`    RDS/Aurora: set rds.logical_replication=1, reboot.  Neon: enable it in settings.
 `) + `
-  Then:  ${import_picocolors6.default.cyan("npx ablo connect --register")}
+  Then re-run:  ${import_picocolors6.default.cyan(`npx ablo ${verb}`)}
 `
     );
     process.exit(0);
   }
-  if (failed.length === 0) {
-    console.log(`  ${import_picocolors6.default.green("\u2713")} Verified.  Next:  ${import_picocolors6.default.cyan("npx ablo connect --register")}
-`);
-  } else {
+  const verifier = src_default(replicationUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
+  } });
+  let items;
+  try {
+    items = await probeReadiness(verifier);
+  } catch {
+    items = null;
+    console.log(import_picocolors6.default.dim(`  Couldn't verify from here; Ablo will validate from its own network.
+`));
+  }
+  await verifier.end({ timeout: 2 }).catch(() => void 0);
+  const failed = items?.filter((i) => !i.ok) ?? [];
+  if (failed.length > 0) {
     for (const item of failed) console.log(`  ${import_picocolors6.default.yellow("!")} ${item.label}`);
     console.log(`
-  ${import_picocolors6.default.dim("Resolve, then")}  ${import_picocolors6.default.cyan("npx ablo connect --register")}
+  ${import_picocolors6.default.dim("Resolve, then re-run")}  ${import_picocolors6.default.cyan(`npx ablo ${verb}`)}
 `);
+    process.exit(1);
   }
-  process.exit(0);
+  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const registered = await registerDirectDataSource({
+    apiUrl: apiUrl2,
+    apiKey,
+    replicationUrl,
+    writeUrl,
+    route: args.route
+  });
+  const outcome = postRegistrationOutcome({ rotating, registered });
+  if (outcome.notice) {
+    console.error(`
+  ${import_picocolors6.default.red(outcome.notice.split("\n").join("\n  "))}
+`);
+  }
+  process.exit(outcome.exitCode);
 }
-var import_picocolors6, import_fs6, import_path4;
+var import_picocolors6;
 var init_connectApply = __esm({
   "src/cli/connectApply.ts"() {
     "use strict";
@@ -5709,10 +5728,10 @@ var init_connectApply = __esm({
     import_picocolors6 = __toESM(require_picocolors(), 1);
     init_src();
     init_dist2();
-    import_fs6 = require("fs");
-    import_path4 = require("path");
     init_connect();
     init_dbRole();
+    init_config();
+    init_push();
     init_theme();
   }
 });
@@ -5722,6 +5741,8 @@ function parseConnectArgs(argv) {
   let check2 = false;
   let register = false;
   let apply2 = false;
+  let rotate = false;
+  let url;
   let yes = false;
   let showSql = false;
   let auditInfra = false;
@@ -5741,6 +5762,12 @@ function parseConnectArgs(argv) {
       case "--apply":
         apply2 = true;
         break;
+      case "--rotate":
+        rotate = true;
+        break;
+      case "--url":
+        url = argv[++i] ?? url;
+        break;
       case "--yes":
       case "-y":
         yes = true;
@@ -5782,7 +5809,7 @@ function parseConnectArgs(argv) {
       code: "cli_invalid_arguments"
     });
   }
-  return { check: check2, register, apply: apply2, yes, showSql, auditInfra, tables, role, writeRole, route };
+  return { check: check2, register, apply: apply2, rotate, url, yes, showSql, auditInfra, tables, role, writeRole, route };
 }
 function quoteIdent(id) {
   return `"${id.replace(/"/g, '""')}"`;
@@ -6086,15 +6113,36 @@ async function auditTenantSyncInfra(sql) {
   }
   return artifacts;
 }
-function requireDatabaseUrl(verb) {
-  const dbUrl = readProjectDatabaseUrl();
-  if (!dbUrl) {
+function requireDatabaseUrl(verb, opts) {
+  const resolved = readProjectReplicationUrlWithSource();
+  if (!resolved) {
     console.error(
-      import_picocolors7.default.red("  No DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors7.default.dim(` Set it to the Postgres you want Ablo to read, then re-run ${import_picocolors7.default.bold(`ablo connect ${verb}`)}.`)
+      import_picocolors7.default.red("  No replication connection found (checked process env, .env.local, .env).") + import_picocolors7.default.dim(
+        ` Set ${import_picocolors7.default.bold("ABLO_REPLICATION_DATABASE_URL")} to the ${ABLO_REPLICATION_ROLE} connection printed by ${import_picocolors7.default.bold("ablo connect")}, then re-run ${import_picocolors7.default.bold(`ablo connect ${verb}`)}.`
+      )
     );
     process.exit(1);
   }
-  return dbUrl;
+  if (resolved.variable === "DATABASE_URL") {
+    console.warn(
+      import_picocolors7.default.yellow(`  ! Falling back to ${import_picocolors7.default.bold("DATABASE_URL")} for the replication role \u2014 deprecated,`) + import_picocolors7.default.dim(
+        ` removed in ${DATABASE_URL_REMOVAL_VERSION}.
+    If this is your app's own connection string, this is NOT validating the ${import_picocolors7.default.bold(ABLO_REPLICATION_ROLE)} role.
+    Set ${import_picocolors7.default.bold("ABLO_REPLICATION_DATABASE_URL")} to the connection ${import_picocolors7.default.bold("ablo connect")} printed.
+`
+      )
+    );
+    if (!(opts?.allowDeprecatedFallback ?? false)) {
+      console.error(
+        import_picocolors7.default.red(`  Refusing to ${verb.replace(/^--/, "")} against a ${import_picocolors7.default.bold("DATABASE_URL")} fallback.`) + import_picocolors7.default.dim(
+          ` Set ${import_picocolors7.default.bold("ABLO_REPLICATION_DATABASE_URL")} explicitly and re-run. (${import_picocolors7.default.bold("ablo connect --check")} still accepts the fallback so you can inspect it.)
+`
+        )
+      );
+      process.exit(1);
+    }
+  }
+  return resolved.url;
 }
 function requireWriteDatabaseUrl(verb) {
   const dbUrl = readProjectWriteDatabaseUrl();
@@ -6192,7 +6240,7 @@ async function runRemoteCheck(dbUrl, writeDbUrl, localReason) {
   process.exit(1);
 }
 async function runCheck() {
-  const dbUrl = requireDatabaseUrl("--check");
+  const dbUrl = requireDatabaseUrl("--check", { allowDeprecatedFallback: true });
   const writeDbUrl = requireWriteDatabaseUrl("--check");
   console.log(`
   ${brand("ablo")} ${import_picocolors7.default.dim("connect --check")}  ${import_picocolors7.default.dim("direct-write + WAL readiness")}
@@ -6269,34 +6317,44 @@ async function runRegister(args) {
     process.exit(1);
   }
   const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const registered = await registerDirectDataSource({
+    apiUrl: apiUrl2,
+    apiKey,
+    replicationUrl: dbUrl,
+    writeUrl: writeDbUrl,
+    route: args.route
+  });
+  process.exit(registered ? 0 : 1);
+}
+async function registerDirectDataSource(opts) {
   let res;
   try {
-    res = await fetch(registerEndpoint(apiUrl2), {
+    res = await fetch(registerEndpoint(opts.apiUrl), {
       method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      headers: { "content-type": "application/json", authorization: `Bearer ${opts.apiKey}` },
       body: JSON.stringify({
         connection: "direct",
-        connectionString: dbUrl,
-        writeConnectionString: writeDbUrl,
-        route: args.route
+        connectionString: opts.replicationUrl,
+        writeConnectionString: opts.writeUrl,
+        route: opts.route
       })
     });
   } catch (err) {
     console.error(import_picocolors7.default.red(`
-  Couldn't reach ${apiUrl2}: ${err instanceof Error ? err.message : String(err)}
+  Couldn't reach ${opts.apiUrl}: ${err instanceof Error ? err.message : String(err)}
 `));
-    process.exit(1);
+    return false;
   }
   if (res.ok) {
     const body2 = await res.json().catch(() => ({}));
-    const statusNote = body2.status === "active" ? `${args.route}, active` : args.route;
+    const statusNote = body2.status === "active" ? `${opts.route}, active` : opts.route;
     console.log(
       `
   ${import_picocolors7.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors7.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors7.default.dim(`(${body2.id})`)}` : ""} as a direct DataSource (${statusNote}).
   Customer COMMIT is durable acceptance; correlated WAL promotes queued writes to confirmed.
 `
     );
-    process.exit(0);
+    return true;
   }
   const body = await res.json().catch(() => ({}));
   const code = body.code ?? body.error?.code;
@@ -6327,10 +6385,10 @@ async function runRegister(args) {
     );
   }
   console.error();
-  process.exit(1);
+  return false;
 }
 async function runAuditInfra() {
-  const dbUrl = requireDatabaseUrl("--audit-infra");
+  const dbUrl = requireDatabaseUrl("--audit-infra", { allowDeprecatedFallback: true });
   const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
   } });
   let artifacts;
@@ -6370,7 +6428,7 @@ async function connect(argv) {
     console.error(import_picocolors7.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  if (args.apply) {
+  if (args.apply || args.rotate) {
     const { runConnectApply: runConnectApply2 } = await Promise.resolve().then(() => (init_connectApply(), connectApply_exports));
     await runConnectApply2(args);
     return;
@@ -6429,16 +6487,21 @@ var init_connect = __esm({
   orders it with external changes, and confirms it. Your Postgres remains authoritative.
 
   Usage:
-    npx ablo connect --apply              Set it up for you: create the roles, publish, verify
+    npx ablo connect --apply              Set it up end to end: create the roles, publish, register
+    npx ablo connect --url <admin-conn>   Admin connection for --apply/--rotate (else DATABASE_URL)
+    npx ablo connect --rotate             New passwords for both scoped roles, then re-register
     npx ablo connect                      Print the exact setup SQL instead of running it
     npx ablo connect --tables a,b,c       Publish only these tables (default: all tables)
     npx ablo connect --role <name>        Name the replication role (default: ablo_replicator)
     npx ablo connect --write-role <name>  Name the DML role (default: ablo_writer)
     npx ablo connect --route <route>      public-allowlist | privatelink | peering | vpn
-    npx ablo connect --check              Validate DATABASE_URL + ABLO_WRITE_DATABASE_URL
+    npx ablo connect --check              Validate the scoped roles (ABLO_REPLICATION_DATABASE_URL + ABLO_WRITE_DATABASE_URL)
     npx ablo connect --register           Register both scoped credentials as one direct DataSource
     npx ablo connect --audit-infra        Read-only Stage 5 audit for deprecated Ablo sync tables/types
 
+  --apply registers with Ablo directly; the admin credential is used only on this
+  machine and never persisted. Your app holds only ABLO_API_KEY.
+
   --apply also takes --yes (skip the confirm) and --show-sql (show the exact statements).`;
   }
 });
@@ -131336,7 +131399,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve7 = factory2.createUniqueName("resolve");
+          const resolve6 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -131345,7 +131408,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve7
+              resolve6
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -131362,7 +131425,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve7, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve6, reject]
               )
             )
           ]);
@@ -217971,8 +218034,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request2 = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve7, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve7, reject });
+          const promise = new Promise((resolve6, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve6, reject });
           });
           this.installer.send(request2);
           return promise;
@@ -220245,7 +220308,7 @@ var require_path_browserify = __commonJS({
     }
     var posix = {
       // path.resolve([from ...], to)
-      resolve: function resolve7() {
+      resolve: function resolve6() {
         var resolvedPath = "";
         var resolvedAbsolute = false;
         var cwd;
@@ -225145,41 +225208,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push2(value) {
-        var p2 = new Promise(function(resolve7, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve7(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function unshift(value) {
-        var p2 = new Promise(function(resolve7, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve7(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function drained() {
-        var p2 = new Promise(function(resolve7) {
+        var p2 = new Promise(function(resolve6) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve7();
+              resolve6();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve7();
+                resolve6();
                 queue.drain = previousDrain;
               };
             }
@@ -225676,9 +225739,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve7(stats) : reject(error);
+            return error === null ? resolve6(stats) : reject(error);
           });
         });
       }
@@ -225703,10 +225766,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve7(entries);
+              resolve6(entries);
             } else {
               reject(error);
             }
@@ -225716,10 +225779,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve7(entries));
+          stream.once("end", () => resolve6(entries));
         });
       }
     };
@@ -258625,12 +258688,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
     };
     var NodeRuntimeFileSystem = class {
       delete(path2) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rm(path2, { recursive: true }, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258649,12 +258712,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         }));
       }
       readFile(filePath, encoding = "utf-8") {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.readFile(filePath, encoding, (err, data) => {
             if (err)
               reject(err);
             else
-              resolve7(data);
+              resolve6(data);
           });
         });
       }
@@ -258662,12 +258725,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         return fs__namespace.readFileSync(filePath, encoding);
       }
       async writeFile(filePath, fileText) {
-        await new Promise((resolve7, reject) => {
+        await new Promise((resolve6, reject) => {
           fs__namespace.writeFile(filePath, fileText, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258681,12 +258744,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.mkdirSync(dirPath, { recursive: true });
       }
       move(srcPath, destPath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rename(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258694,12 +258757,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.renameSync(srcPath, destPath);
       }
       copy(srcPath, destPath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.copyFile(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258707,15 +258770,15 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.copyFileSync(srcPath, destPath);
       }
       stat(path2) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.stat(path2, (err, stat) => {
             if (err) {
               if (err.code === "ENOENT" || err.code === "ENOTDIR")
-                resolve7(void 0);
+                resolve6(void 0);
               else
                 reject(err);
             } else {
-              resolve7(stat);
+              resolve6(stat);
             }
           });
         });
@@ -282394,8 +282457,8 @@ Node text: ${this.#forgottenText}`;
 init_cjs_shims();
 init_dist2();
 var import_picocolors21 = __toESM(require_picocolors(), 1);
-var import_fs13 = require("fs");
-var import_path8 = require("path");
+var import_fs12 = require("fs");
+var import_path7 = require("path");
 var import_child_process3 = require("child_process");
 
 // src/cli/migrate.ts
@@ -282511,7 +282574,7 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [])
         if (pg.code === import_schema3.PG_LOCK_NOT_AVAILABLE && attempt < maxLockAttempts) {
           const backoffMs = (0, import_schema3.ddlLockRetryBackoffMs)(attempt);
           log.warn("schema change blocked by a lock; backing off and retrying", { targetSchema, attempt, backoffMs });
-          await new Promise((resolve7) => setTimeout(resolve7, backoffMs));
+          await new Promise((resolve6) => setTimeout(resolve6, backoffMs));
           continue;
         }
         throw err;
@@ -282588,8 +282651,8 @@ init_push();
 // src/cli/generate.ts
 init_cjs_shims();
 init_errors();
-var import_fs7 = require("fs");
-var import_path5 = require("path");
+var import_fs6 = require("fs");
+var import_path4 = require("path");
 var import_picocolors8 = __toESM(require_picocolors(), 1);
 var import_schema4 = require("@abloatai/ablo/schema");
 init_push();
@@ -282635,9 +282698,9 @@ async function generate(argv) {
     console.error(import_picocolors8.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  const abs = (0, import_path5.resolve)(process.cwd(), args.out);
-  (0, import_fs7.mkdirSync)((0, import_path5.dirname)(abs), { recursive: true });
-  (0, import_fs7.writeFileSync)(abs, source);
+  const abs = (0, import_path4.resolve)(process.cwd(), args.out);
+  (0, import_fs6.mkdirSync)((0, import_path4.dirname)(abs), { recursive: true });
+  (0, import_fs6.writeFileSync)(abs, source);
   console.log(`  ${import_picocolors8.default.green("\u2713")} Generated types \u2192 ${import_picocolors8.default.bold(args.out)}`);
 }
 
@@ -282647,8 +282710,8 @@ init_errors();
 init_credentialPolicy();
 var import_picocolors9 = __toESM(require_picocolors(), 1);
 init_dist2();
-var import_fs8 = require("fs");
-var import_path6 = require("path");
+var import_fs7 = require("fs");
+var import_path5 = require("path");
 var import_schema5 = require("@abloatai/ablo/schema");
 init_push();
 init_config();
@@ -282709,34 +282772,34 @@ function classifyKey(apiKey, activeMode) {
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
-  const envPath = (0, import_path6.resolve)(cwd, ".env.local");
+  const envPath = (0, import_path5.resolve)(cwd, ".env.local");
   const line = `ABLO_API_KEY=${apiKey}`;
   let action;
-  if (!(0, import_fs8.existsSync)(envPath)) {
-    (0, import_fs8.writeFileSync)(envPath, `${line}
+  if (!(0, import_fs7.existsSync)(envPath)) {
+    (0, import_fs7.writeFileSync)(envPath, `${line}
 `, { mode: 384 });
     action = `Created ${import_picocolors9.default.bold(".env.local")} with ${import_picocolors9.default.bold("ABLO_API_KEY")}`;
   } else {
-    const content = (0, import_fs8.readFileSync)(envPath, "utf8");
+    const content = (0, import_fs7.readFileSync)(envPath, "utf8");
     const match = /^ABLO_API_KEY=(.*)$/m.exec(content);
     const existing = match?.[1] ?? "";
     if (!match) {
-      (0, import_fs8.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
+      (0, import_fs7.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
 `);
       action = `Added ${import_picocolors9.default.bold("ABLO_API_KEY")} to ${import_picocolors9.default.bold(".env.local")}`;
     } else if (existing === apiKey) {
       action = `${import_picocolors9.default.bold(".env.local")} already has this key`;
     } else {
-      (0, import_fs8.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
+      (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
       action = `Updated ${import_picocolors9.default.bold("ABLO_API_KEY")} in ${import_picocolors9.default.bold(".env.local")} ${import_picocolors9.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
   }
-  const gitignorePath = (0, import_path6.resolve)(cwd, ".gitignore");
-  const gitignore = (0, import_fs8.existsSync)(gitignorePath) ? (0, import_fs8.readFileSync)(gitignorePath, "utf8") : "";
+  const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
+  const gitignore = (0, import_fs7.existsSync)(gitignorePath) ? (0, import_fs7.readFileSync)(gitignorePath, "utf8") : "";
   const ignored = /^(\.env\.local|\.env\*|\.env\.\*|\.env.*)$/m.test(gitignore);
   let gitignoreNote = "";
   if (!ignored) {
-    (0, import_fs8.writeFileSync)(
+    (0, import_fs7.writeFileSync)(
       gitignorePath,
       `${gitignore.endsWith("\n") || gitignore.length === 0 ? gitignore : `${gitignore}
 `}.env.local
@@ -282838,12 +282901,12 @@ async function dev(argv) {
   }
   console.log(`  Your app is wired for the sandbox.`);
   if (!args.watch) return;
-  const abs = (0, import_path6.resolve)(process.cwd(), args.schemaPath);
+  const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
   console.log(`  ${import_picocolors9.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
 `);
   let timer2 = null;
   let pushing = false;
-  const watcher = (0, import_fs8.watch)(abs, () => {
+  const watcher = (0, import_fs7.watch)(abs, () => {
     if (timer2) clearTimeout(timer2);
     timer2 = setTimeout(() => {
       void rePush();
@@ -283534,7 +283597,7 @@ async function logs(argv) {
 
 // src/cli/webhooks.ts
 init_cjs_shims();
-var import_fs9 = require("fs");
+var import_fs8 = require("fs");
 var import_picocolors14 = __toESM(require_picocolors(), 1);
 init_credentialPolicy();
 init_config();
@@ -283600,11 +283663,11 @@ async function api(apiKey, method, path, body) {
   return await res.json();
 }
 function writeSecretToEnv(secret) {
-  const file = (0, import_fs9.existsSync)(".env.local") ? ".env.local" : (0, import_fs9.existsSync)(".env") ? ".env" : ".env.local";
+  const file = (0, import_fs8.existsSync)(".env.local") ? ".env.local" : (0, import_fs8.existsSync)(".env") ? ".env" : ".env.local";
   const line = `${ENV_KEY}=${secret}`;
   let next;
-  if ((0, import_fs9.existsSync)(file)) {
-    const existing = (0, import_fs9.readFileSync)(file, "utf-8");
+  if ((0, import_fs8.existsSync)(file)) {
+    const existing = (0, import_fs8.readFileSync)(file, "utf-8");
     next = new RegExp(`^${ENV_KEY}=.*$`, "m").test(existing) ? existing.replace(new RegExp(`^${ENV_KEY}=.*$`, "m"), line) : `${existing.replace(/\n*$/, "")}
 ${line}
 `;
@@ -283612,7 +283675,7 @@ ${line}
     next = `${line}
 `;
   }
-  (0, import_fs9.writeFileSync)(file, next);
+  (0, import_fs8.writeFileSync)(file, next);
   return file;
 }
 function printEndpoint(e2) {
@@ -284028,7 +284091,7 @@ init_cjs_shims();
 init_errors();
 var import_picocolors17 = __toESM(require_picocolors(), 1);
 init_src();
-var import_fs10 = require("fs");
+var import_fs9 = require("fs");
 init_theme();
 var DEFAULT_OUT2 = "ablo/schema.ts";
 var DEFAULT_IMPORT = "@abloatai/ablo/schema";
@@ -284148,7 +284211,7 @@ async function pull(argv) {
     console.error(import_picocolors17.default.red(`  No database.`) + import_picocolors17.default.dim(` Set ${import_picocolors17.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
     process.exit(1);
   }
-  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs9.existsSync)(args.out) && !args.force) {
     console.error(
       import_picocolors17.default.red(`  ${args.out} already exists.`) + import_picocolors17.default.dim(` Re-run with ${import_picocolors17.default.bold("--force")} to overwrite.`)
     );
@@ -284170,7 +284233,7 @@ async function pull(argv) {
     );
     process.exit(1);
   }
-  (0, import_fs10.writeFileSync)(args.out, result.source);
+  (0, import_fs9.writeFileSync)(args.out, result.source);
   console.log(`  ${import_picocolors17.default.green("\u2713")} wrote ${import_picocolors17.default.bold(args.out)} ${import_picocolors17.default.dim(`(${result.models.length} models)`)}`);
   console.log(`  ${import_picocolors17.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped > 0) {
@@ -284187,7 +284250,7 @@ async function pull(argv) {
 init_cjs_shims();
 init_errors();
 var import_picocolors18 = __toESM(require_picocolors(), 1);
-var import_fs11 = require("fs");
+var import_fs10 = require("fs");
 init_theme();
 
 // src/cli/schemaIr.ts
@@ -284474,13 +284537,13 @@ async function prismaPull(argv) {
     console.error(import_picocolors18.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  if (!(0, import_fs11.existsSync)(args.schema)) {
+  if (!(0, import_fs10.existsSync)(args.schema)) {
     console.error(
       import_picocolors18.default.red(`  No Prisma schema at ${import_picocolors18.default.bold(args.schema)}.`) + import_picocolors18.default.dim(` Pass a path: ${import_picocolors18.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
-  if ((0, import_fs11.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
       import_picocolors18.default.red(`  ${args.out} already exists.`) + import_picocolors18.default.dim(` Re-run with ${import_picocolors18.default.bold("--force")} to overwrite.`)
     );
@@ -284491,7 +284554,7 @@ async function prismaPull(argv) {
 `);
   let result;
   try {
-    const src = (0, import_fs11.readFileSync)(args.schema, "utf8");
+    const src = (0, import_fs10.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
     console.error(import_picocolors18.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
@@ -284503,7 +284566,7 @@ async function prismaPull(argv) {
     );
     process.exit(1);
   }
-  (0, import_fs11.writeFileSync)(args.out, result.source);
+  (0, import_fs10.writeFileSync)(args.out, result.source);
   console.log(`  ${import_picocolors18.default.green("\u2713")} wrote ${import_picocolors18.default.bold(args.out)} ${import_picocolors18.default.dim(`(${result.models.length} models)`)}`);
   console.log(`  ${import_picocolors18.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
@@ -284521,8 +284584,8 @@ async function prismaPull(argv) {
 init_cjs_shims();
 var import_picocolors19 = __toESM(require_picocolors(), 1);
 init_errors();
-var import_fs12 = require("fs");
-var import_path7 = require("path");
+var import_fs11 = require("fs");
+var import_path6 = require("path");
 init_theme();
 var DEFAULT_OUT4 = "ablo/schema.ts";
 var DEFAULT_IMPORT3 = "@abloatai/ablo/schema";
@@ -284650,7 +284713,7 @@ function parseDrizzlePullArgs(argv) {
 async function loadModule(path) {
   const { createJiti } = await import("jiti");
   const jiti = createJiti(process.cwd());
-  const mod = await jiti.import((0, import_path7.resolve)(path));
+  const mod = await jiti.import((0, import_path6.resolve)(path));
   return mod;
 }
 async function drizzlePull(argv) {
@@ -284667,11 +284730,11 @@ async function drizzlePull(argv) {
     );
     process.exit(1);
   }
-  if (!(0, import_fs12.existsSync)(args.schema)) {
+  if (!(0, import_fs11.existsSync)(args.schema)) {
     console.error(import_picocolors19.default.red(`  No file at ${import_picocolors19.default.bold(args.schema)}.`));
     process.exit(1);
   }
-  if ((0, import_fs12.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
       import_picocolors19.default.red(`  ${args.out} already exists.`) + import_picocolors19.default.dim(` Re-run with ${import_picocolors19.default.bold("--force")} to overwrite.`)
     );
@@ -284696,7 +284759,7 @@ async function drizzlePull(argv) {
     );
     process.exit(1);
   }
-  (0, import_fs12.writeFileSync)(args.out, result.source);
+  (0, import_fs11.writeFileSync)(args.out, result.source);
   console.log(`  ${import_picocolors19.default.green("\u2713")} wrote ${import_picocolors19.default.bold(args.out)} ${import_picocolors19.default.dim(`(${result.models.length} models)`)}`);
   console.log(`  ${import_picocolors19.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
@@ -284971,7 +285034,7 @@ async function ensureInitProject(opts) {
   const slug = opts.project ?? projectSlugFromPackageName(
     (() => {
       try {
-        return JSON.parse((0, import_fs13.readFileSync)("package.json", "utf-8")).name;
+        return JSON.parse((0, import_fs12.readFileSync)("package.json", "utf-8")).name;
       } catch {
         return void 0;
       }
@@ -284988,7 +285051,7 @@ async function ensureInitProject(opts) {
 function detectOrm(override) {
   if (override === "prisma" || override === "drizzle" || override === "none") return override;
   try {
-    const pkg = JSON.parse((0, import_fs13.readFileSync)("package.json", "utf-8"));
+    const pkg = JSON.parse((0, import_fs12.readFileSync)("package.json", "utf-8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (deps["@prisma/client"] || deps.prisma) return "prisma";
     if (deps["drizzle-orm"]) return "drizzle";
@@ -284997,8 +285060,8 @@ function detectOrm(override) {
   return "none";
 }
 function detectNextLayout() {
-  const useSrc = (0, import_fs13.existsSync)((0, import_path8.join)("src", "app")) || !(0, import_fs13.existsSync)("app") && (0, import_fs13.existsSync)("src");
-  return useSrc ? { appBase: (0, import_path8.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
+  const useSrc = (0, import_fs12.existsSync)((0, import_path7.join)("src", "app")) || !(0, import_fs12.existsSync)("app") && (0, import_fs12.existsSync)("src");
+  return useSrc ? { appBase: (0, import_path7.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
 }
 async function chooseOption(name, flagValue, fallback, allowed, interactive, prompt) {
   if (flagValue !== void 0) {
@@ -285024,7 +285087,7 @@ async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
   Ie(`${brand("ablo")} ${import_picocolors21.default.dim("sync engine")}`);
-  if (!(0, import_fs13.existsSync)("package.json")) {
+  if (!(0, import_fs12.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
   }
@@ -285093,8 +285156,8 @@ async function init(args = []) {
     );
   }
   const layout = framework === "nextjs" ? detectNextLayout() : { appBase: "app", aliasBase: "." };
-  const abloDir = (0, import_path8.join)(layout.aliasBase, "ablo");
-  (0, import_fs13.mkdirSync)(abloDir, { recursive: true });
+  const abloDir = (0, import_path7.join)(layout.aliasBase, "ablo");
+  (0, import_fs12.mkdirSync)(abloDir, { recursive: true });
   const created = [];
   let schemaSource = generateSchema();
   let schemaNote = "";
@@ -285120,28 +285183,28 @@ async function init(args = []) {
       }
     }
   }
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "schema.ts"), schemaSource);
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "schema.ts"), schemaSource);
   created.push(`${abloDir}/schema.ts${schemaNote}`);
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "index.ts"), generateSyncConfig(auth));
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth));
   created.push(`${abloDir}/index.ts`);
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "register.ts"), generateRegister());
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "register.ts"), generateRegister());
   created.push(`${abloDir}/register.ts`);
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "data-source.ts"), generateDataSource(orm));
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "data-source.ts"), generateDataSource(orm));
     created.push(`${abloDir}/data-source.ts${orm === "drizzle" ? " (Drizzle)" : " (Prisma)"}`);
   }
   const envFile = framework === "nextjs" ? ".env.local" : ".env";
   const resolvedKey = process.env.ABLO_API_KEY ? void 0 : resolveApiKey("sandbox");
   const wireRealKey = envFile === ".env.local" && Boolean(resolvedKey);
   const envBody = generateEnv(storage, { includeApiKey: !wireRealKey });
-  if (!(0, import_fs13.existsSync)(envFile)) {
-    (0, import_fs13.writeFileSync)(envFile, envBody);
+  if (!(0, import_fs12.existsSync)(envFile)) {
+    (0, import_fs12.writeFileSync)(envFile, envBody);
     created.push(envFile);
   } else {
-    const existing = (0, import_fs13.readFileSync)(envFile, "utf-8");
+    const existing = (0, import_fs12.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
-      (0, import_fs13.writeFileSync)(envFile, existing + "\n" + envBody);
+      (0, import_fs12.writeFileSync)(envFile, existing + "\n" + envBody);
       created.push(`${envFile} ${import_picocolors21.default.dim("(appended)")}`);
     } else {
       created.push(`${envFile} ${import_picocolors21.default.dim("(already configured)")}`);
@@ -285152,26 +285215,26 @@ async function init(args = []) {
     created.push(`.env.local ${import_picocolors21.default.dim("(ABLO_API_KEY set from your login)")}`);
   }
   if (agent) {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "agent.ts"), generateAgent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "agent.ts"), generateAgent());
     created.push(`${abloDir}/agent.ts`);
   }
   if (framework === "nextjs") {
     if (storage === "endpoint") {
-      const webhookDir = (0, import_path8.join)(layout.appBase, "api", "ablo", "webhooks");
-      (0, import_fs13.mkdirSync)(webhookDir, { recursive: true });
-      (0, import_fs13.writeFileSync)((0, import_path8.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
+      const webhookDir = (0, import_path7.join)(layout.appBase, "api", "ablo", "webhooks");
+      (0, import_fs12.mkdirSync)(webhookDir, { recursive: true });
+      (0, import_fs12.writeFileSync)((0, import_path7.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
       created.push(`${webhookDir}/route.ts${orm === "prisma" ? " (Prisma mirror)" : " (add your database write)"}`);
     }
-    const providersPath = (0, import_path8.join)(layout.appBase, "providers.tsx");
-    (0, import_fs13.writeFileSync)(providersPath, generateProviders());
-    created.push(`${providersPath} ${import_picocolors21.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
-    const sessionDir = (0, import_path8.join)(layout.appBase, "api", "ablo-session");
-    (0, import_fs13.mkdirSync)(sessionDir, { recursive: true });
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors21.default.dim("(wire your auth)")}`);
+    const providersPath = (0, import_path7.join)(layout.appBase, "providers.tsx");
+    (0, import_fs12.writeFileSync)(providersPath, generateProviders());
+    created.push(`${providersPath} ${import_picocolors21.default.dim(`(wrap ${(0, import_path7.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    const sessionDir = (0, import_path7.join)(layout.appBase, "api", "ablo-session");
+    (0, import_fs12.mkdirSync)(sessionDir, { recursive: true });
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(sessionDir, "route.ts"), generateSessionRoute());
+    created.push(`${(0, import_path7.join)(sessionDir, "route.ts")} ${import_picocolors21.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "TaskList.tsx"), generateComponent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
   Me(created.map((f) => `${import_picocolors21.default.green("\u2713")} ${f}`).join("\n"), "Created");
@@ -285199,7 +285262,7 @@ async function init(args = []) {
       `Provision your DB: ${import_picocolors21.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors21.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors21.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors21.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors21.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors21.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors21.default.bold((0, import_path7.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors21.default.bold("<Providers>")} (${(0, import_path7.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors21.default.bold((0, import_path7.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
     `Run ${import_picocolors21.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
@@ -285607,9 +285670,9 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
 `;
 }
 function detectPackageManager() {
-  if ((0, import_fs13.existsSync)("pnpm-lock.yaml")) return "pnpm";
-  if ((0, import_fs13.existsSync)("yarn.lock")) return "yarn";
-  if ((0, import_fs13.existsSync)("bun.lockb")) return "bun";
+  if ((0, import_fs12.existsSync)("pnpm-lock.yaml")) return "pnpm";
+  if ((0, import_fs12.existsSync)("yarn.lock")) return "yarn";
+  if ((0, import_fs12.existsSync)("bun.lockb")) return "bun";
   return "npm";
 }
 main().catch((err) => {