@abloatai/ablo 0.30.2 → 0.32.0

package/dist/cli.cjs

@@ -787,8 +787,8 @@ ${import_picocolors2.default.gray(d2)}  ${t}
           if (i) process.stdout.write(`${I2}  ${l2}...`);
           else if (t === "timer") process.stdout.write(`${I2}  ${l2} ${O2(g2)}`);
           else {
-            const z7 = ".".repeat(Math.floor(w2)).slice(0, 3);
-            process.stdout.write(`${I2}  ${l2}${z7}`);
+            const z8 = ".".repeat(Math.floor(w2)).slice(0, 3);
+            process.stdout.write(`${I2}  ${l2}${z8}`);
           }
           h2 = h2 + 1 < n.length ? h2 + 1 : 0, w2 = w2 < n.length ? w2 + 0.125 : 0;
         }, r2);
@@ -959,6 +959,7 @@ var init_errorCodes = __esm({
       entity_not_found: wire("not_found", 404, false, "No row exists with the requested id. It may have been deleted, or the id may belong to a different environment."),
       model_not_found: wire("not_found", 404, false, "No row of this model exists with the requested id. It may have been deleted, or the id may belong to a different environment."),
       mutate_update_entity_not_found: wire("not_found", 404, false, "The row targeted by this update does not exist \u2014 it may have been deleted since you read it. Re-read before retrying."),
+      no_data_source_registered: wire("not_found", 404, false, "No database is connected to this plane yet, so there is nothing to check. Connect one with `ablo connect apply`, then run the check again."),
       task_id_missing: wire("server", 502, true, "The task-create response arrived without a task id, so the result cannot be used. Retry the request."),
       // ── data integrity / database constraints ──────────────────────────
       // Emitted when a database integrity constraint rejects a write. None are
@@ -1122,7 +1123,7 @@ var init_errorCodes = __esm({
       query_invalid_boolean: wire("validation", 400, false, "The query compared a boolean column against an invalid boolean literal."),
       protocol_version_unsupported: wire("transport", 426, false, "The client sync-protocol version is outside the range this server supports \u2014 upgrade the SDK (or the server was rolled back mid-fleet)."),
       database_unreachable: wire("validation", 400, false, "Ablo could not reach this database to check that it can stream replication. The connection string may be wrong, the host may not be reachable from Ablo's servers, or the credentials may not be accepted."),
-      database_not_replication_ready: wire("validation", 400, false, "This database is not set up for logical replication yet. Every failing item \u2014 wal_level, the publication, the replication grant, a replica identity \u2014 is listed in the error details with its exact fix. `ablo connect` prints the one-time setup; `ablo connect --check` verifies it."),
+      database_not_replication_ready: wire("validation", 400, false, "This database is not set up for logical replication yet. Every failing item \u2014 wal_level, the publication, the replication grant, a replica identity \u2014 is listed in the error details with its exact fix. `ablo connect` prints the one-time setup; `ablo connect check` verifies it."),
       replication_publication_drift: wire("validation", 400, false, "Your schema maps to tables that are not members of the replication publication, so their changes silently never stream and the source looks frozen. The missing tables and the exact `ALTER PUBLICATION \u2026 ADD TABLE \u2026` to add them are in the error details \u2014 Ablo never alters your database for you."),
       query_unknown_relation: wire("validation", 400, false, "The query references a relation the model does not define. Check the relation name against the schema."),
       query_relation_target_unknown: wire("schema", 500, false, "A relation in the query targets a model the schema does not define."),
@@ -1198,7 +1199,7 @@ var init_roles = __esm({
 });
 
 // src/coordination/schema.ts
-var import_zod3, targetRangeSchema, participantKindSchema, wireParticipantKindSchema, targetRefSchema, onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, claimStatusSchema, wireClaimBaseSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, claimLostSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatFieldsSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, commitOperationTypeSchema, commitOperationSchema, presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema;
+var import_zod3, targetRangeSchema, participantKindSchema, wireParticipantKindSchema, targetRefSchema, onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, claimStatusSchema, grantStampFields, wireClaimBaseSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, claimLostSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatFieldsSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, commitOperationTypeSchema, commitOperationSchema, presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema;
 var init_schema = __esm({
   "src/coordination/schema.ts"() {
     "use strict";
@@ -1289,6 +1290,21 @@ var init_schema = __esm({
       "expired",
       "canceled"
     ]);
+    grantStampFields = {
+      /**
+       * The monotonic fencing token minted for this grant (Option B). Strictly
+       * increasing per entity across successive grants, so a write that carries it
+       * is rejected at commit if a later holder already advanced the entity's
+       * high-water. A token-less write is simply not fence-checked.
+       */
+      fenceToken: import_zod3.z.number().optional(),
+      /**
+       * Lease origin (epoch ms): when THIS holding was acquired. The cumulative-
+       * hold ceiling measures a holder's fair share from here — and because it
+       * survives a re-announce, a reconnect cannot rewind the clock.
+       */
+      acquiredAt: import_zod3.z.number().optional()
+    };
     wireClaimBaseSchema = targetRefSchema.extend({
       claimId: import_zod3.z.string(),
       /**
@@ -1302,15 +1318,7 @@ var init_schema = __esm({
       /** Server-computed TTL deadline (epoch ms). Readers treat as advisory. */
       expiresAt: import_zod3.z.number(),
       status: claimStatusSchema.optional(),
-      /**
-       * The monotonic fencing token the server minted for this grant (Option B).
-       * Strictly increasing per entity across successive grants, so a write that
-       * carries it can be rejected at commit if a later holder already advanced the
-       * entity's high-water. Server-stamped on grant and never client-supplied;
-       * optional so every existing frame stays valid and a token-less write is
-       * simply not fence-checked.
-       */
-      fenceToken: import_zod3.z.number().optional()
+      ...grantStampFields
     });
     wireClaimSummarySchema = wireClaimBaseSchema.pick({
       claimId: true,
@@ -1755,9 +1763,9 @@ var init_query = __esm({
     CLOSE = {};
     Query = class extends Promise {
       constructor(strings, args, handler, canceller, options = {}) {
-        let resolve7, reject;
+        let resolve6, reject;
         super((a, b4) => {
-          resolve7 = a;
+          resolve6 = a;
           reject = b4;
         });
         this.tagged = Array.isArray(strings.raw);
@@ -1768,7 +1776,7 @@ var init_query = __esm({
         this.options = options;
         this.state = null;
         this.statement = null;
-        this.resolve = (x2) => (this.active = false, resolve7(x2));
+        this.resolve = (x2) => (this.active = false, resolve6(x2));
         this.reject = (x2) => (this.active = false, reject(x2));
         this.active = false;
         this.cancelled = null;
@@ -1816,12 +1824,12 @@ var init_query = __esm({
               if (this.executed && !this.active)
                 return { done: true };
               prev && prev();
-              const promise = new Promise((resolve7, reject) => {
+              const promise = new Promise((resolve6, reject) => {
                 this.cursorFn = (value) => {
-                  resolve7({ value, done: false });
+                  resolve6({ value, done: false });
                   return new Promise((r2) => prev = r2);
                 };
-                this.resolve = () => (this.active = false, resolve7({ done: true }));
+                this.resolve = () => (this.active = false, resolve6({ done: true }));
                 this.reject = (x2) => (this.active = false, reject(x2));
               });
               this.execute();
@@ -2419,12 +2427,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x2.on("drain", drain);
     return x2;
   }
-  async function cancel({ pid, secret }, resolve7, reject) {
+  async function cancel({ pid, secret }, resolve6, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect2();
       socket.once("error", reject);
-      socket.once("close", resolve7);
+      socket.once("close", resolve6);
     } catch (error2) {
       reject(error2);
     }
@@ -3447,7 +3455,7 @@ var init_subscribe = __esm({
 
 // node_modules/postgres/src/large.js
 function largeObject(sql, oid, mode2 = 131072 | 262144) {
-  return new Promise(async (resolve7, reject) => {
+  return new Promise(async (resolve6, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -3473,7 +3481,7 @@ function largeObject(sql, oid, mode2 = 131072 | 262144) {
           ) seek
         `
       };
-      resolve7(lo);
+      resolve6(lo);
       return new Promise(async (r2) => finish = r2);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -3635,8 +3643,8 @@ function Postgres(a, b4) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve7, reject) => {
-      const query = { reserve: resolve7, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve6, reject) => {
+      const query = { reserve: resolve6, reject };
       queries.push(query);
       closed.length && connect2(closed.shift(), query);
     });
@@ -3673,9 +3681,9 @@ function Postgres(a, b4) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve7, reject) => {
+        result = await new Promise((resolve6, reject) => {
           const x2 = fn2(sql2);
-          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve7, reject);
+          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve6, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -3732,8 +3740,8 @@ function Postgres(a, b4) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve7, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve7, reject) : query.cancelled = { resolve: resolve7, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve7());
+    return new Promise((resolve6, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve6, reject) : query.cancelled = { resolve: resolve6, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve6());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -3752,11 +3760,11 @@ function Postgres(a, b4) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve7) {
+  async function destroy(resolve6) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve7();
+    resolve6();
   }
   function connect2(c, query) {
     move(c, connecting);
@@ -3955,10 +3963,22 @@ function rewriteDatabaseUrl(ownerUrl, role, password) {
   url.password = password;
   return url.toString();
 }
+function readProjectReplicationUrlWithSource(cwd = process.cwd()) {
+  for (const variable of REPLICATION_URL_VARS) {
+    const value = process.env[variable];
+    if (value) return { url: value, variable };
+  }
+  for (const variable of REPLICATION_URL_VARS) {
+    const value = readProjectEnvValue(variable, cwd);
+    if (value) return { url: value, variable };
+  }
+  return null;
+}
 function readProjectDatabaseUrl(cwd = process.cwd()) {
-  const fromEnv = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
-  if (fromEnv) return fromEnv;
-  return readProjectEnvValue("DATABASE_URL", cwd);
+  return readProjectReplicationUrlWithSource(cwd)?.url ?? null;
+}
+function readProjectAdminDatabaseUrl(cwd = process.cwd()) {
+  return process.env.DATABASE_URL ?? readProjectEnvValue("DATABASE_URL", cwd);
 }
 function readProjectWriteDatabaseUrl(cwd = process.cwd()) {
   const fromEnv = process.env.ABLO_WRITE_DATABASE_URL;
@@ -3984,7 +4004,7 @@ function readProjectApiKey(cwd = process.cwd()) {
   }
   return null;
 }
-var import_crypto2, import_fs2, import_path;
+var import_crypto2, import_fs2, import_path, REPLICATION_URL_VARS;
 var init_dbRole = __esm({
   "src/cli/dbRole.ts"() {
     "use strict";
@@ -3994,6 +4014,7 @@ var init_dbRole = __esm({
     init_dist2();
     import_fs2 = require("fs");
     import_path = require("path");
+    REPLICATION_URL_VARS = ["ABLO_REPLICATION_DATABASE_URL"];
   }
 });
 
@@ -4816,6 +4837,9 @@ function coerceBackfill(raw) {
   if (raw !== "" && !Number.isNaN(Number(raw))) return Number(raw);
   return raw;
 }
+function apiBaseUrl() {
+  return (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+}
 function fmtSignal(s) {
   const sig = s;
   const where = sig.field ? `${sig.model}.${sig.field}` : sig.model;
@@ -5220,7 +5244,7 @@ async function push(argv) {
     } else if (code === "schema_provisioning_forbidden") {
       console.error(
         import_picocolors4.default.dim(
-          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors4.default.bold("npx ablo connect --register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
+          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors4.default.bold("npx ablo connect register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
         )
       );
     } else if (args.apiKey != null && classifyCredentialKind(args.apiKey) === "restricted") {
@@ -5264,129 +5288,19 @@ var init_push = __esm({
   }
 });
 
-// src/cli/remoteValidation.ts
-function dialFailureReason(err) {
-  if (err === null || typeof err !== "object") return null;
-  const coded = err;
-  const code = typeof coded.code === "string" ? coded.code : null;
-  if (code && DIAL_FAILURE_CODES.has(code)) {
-    return typeof coded.message === "string" && coded.message.length > 0 ? coded.message : code;
-  }
-  if (Array.isArray(coded.errors)) {
-    for (const member of coded.errors) {
-      const reason = dialFailureReason(member);
-      if (reason) return reason;
-    }
-  }
-  return null;
-}
-function validateEndpoint(baseUrl2) {
-  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources/validate`;
-}
-function describeRemoteFailure(failure) {
-  switch (failure.item) {
-    case "wal_level":
-      return {
-        label: failure.actual ? `wal_level is ${failure.actual} (need logical)` : `wal_level must be logical`,
-        fix: failure.fix
-      };
-    case "publication":
-      return { label: "the Ablo publication does not exist", fix: failure.fix };
-    case "replication_role":
-      return { label: "the DATABASE_URL role lacks the REPLICATION attribute", fix: failure.fix };
-    case "replica_identity":
-      return {
-        label: `published tables cannot replicate UPDATE/DELETE${failure.actual ? ` (${failure.actual})` : ""}`,
-        fix: failure.fix
-      };
-    case "write_role":
-      return { label: "ABLO_WRITE_DATABASE_URL is not a scoped DML role", fix: failure.fix };
-    case "row_security":
-      return { label: "the direct-write role does not enforce row_security", fix: failure.fix };
-    case "schema_privileges":
-      return { label: "the direct-write role has unsafe schema privileges", fix: failure.fix };
-    case "idempotency_ledger":
-      return { label: "ablo_idempotency is missing or has unsafe grants", fix: failure.fix };
-    case "table_privileges":
-      return {
-        label: `the direct-write role lacks application DML${failure.actual ? ` (${failure.actual})` : ""}`,
-        fix: failure.fix
-      };
-    case "logical_marker":
-      return { label: "the direct-write role cannot emit the correlation marker", fix: failure.fix };
-    default:
-      return { label: failure.item, fix: failure.fix };
-  }
-}
-function parseWireFailures(value) {
-  if (!Array.isArray(value)) return [];
-  const failures = [];
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object") continue;
-    const { item, actual, fix } = entry;
-    if (typeof item !== "string" || typeof fix !== "string") continue;
-    failures.push({ item, fix, ...typeof actual === "string" ? { actual } : {} });
-  }
-  return failures;
-}
-async function requestRemoteValidation(input) {
-  const doFetch = input.fetchImpl ?? fetch;
-  let res;
-  try {
-    res = await doFetch(validateEndpoint(input.apiUrl), {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${input.apiKey}` },
-      body: JSON.stringify({
-        connectionString: input.connectionString,
-        ...input.writeConnectionString ? { writeConnectionString: input.writeConnectionString } : {}
-      })
-    });
-  } catch (err) {
-    return {
-      ok: false,
-      status: 0,
-      message: `couldn't reach ${input.apiUrl}: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    const code = typeof body.code === "string" ? body.code : body.error?.code;
-    const message = typeof body.message === "string" ? body.message : typeof body.error?.message === "string" ? body.error.message : `HTTP ${res.status}`;
-    return {
-      ok: false,
-      status: res.status,
-      message,
-      ...typeof code === "string" ? { code } : {}
-    };
-  }
-  const reachable = body.reachable === true;
-  return {
-    ok: true,
-    reachable,
-    ready: body.ready === true,
-    ...typeof body.reason === "string" ? { reason: body.reason } : {},
-    failures: parseWireFailures(body.failures)
-  };
-}
-var DIAL_FAILURE_CODES;
-var init_remoteValidation = __esm({
-  "src/cli/remoteValidation.ts"() {
-    "use strict";
-    init_cjs_shims();
-    DIAL_FAILURE_CODES = /* @__PURE__ */ new Set([
-      "ENOTFOUND",
-      "EAI_AGAIN",
-      "ECONNREFUSED",
-      "ECONNRESET",
-      "ETIMEDOUT",
-      "ENETUNREACH",
-      "EHOSTUNREACH",
-      "CONNECT_TIMEOUT"
-    ]);
-  }
-});
-
 // src/source/migrations.ts
+function addColumnIfAbsent(column, definition) {
+  return `DO $$
+DECLARE ledger regclass := to_regclass('ablo_idempotency');
+BEGIN
+  IF ledger IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM pg_attribute
+    WHERE attrelid = ledger AND attname = '${column}' AND attnum > 0 AND NOT attisdropped
+  ) THEN
+    ALTER TABLE ablo_idempotency ADD COLUMN ${column} ${definition};
+  END IF;
+END $$;`;
+}
 function idempotencyLedgerMigrations() {
   return [
     {
@@ -5404,13 +5318,19 @@ function idempotencyLedgerMigrations() {
       // Nullable only for rows created by older adapter versions. New writes
       // always populate it; replaying a legacy NULL row fails closed because
       // the adapter cannot prove that the intent matches.
-      up: `ALTER TABLE ablo_idempotency
-  ADD COLUMN IF NOT EXISTS request_hash TEXT;`
+      //
+      // The column already exists on any current table (the CREATE above
+      // includes it), so this only matters when upgrading a pre-existing
+      // ledger. `ALTER TABLE ... ADD COLUMN IF NOT EXISTS` checks ownership
+      // BEFORE it evaluates IF NOT EXISTS, so on a ledger that predates the
+      // setup — owned by another role — the no-op still errors "must be owner".
+      // Guard on the catalog (readable regardless of ownership) so the ALTER
+      // runs only when the column is genuinely absent, keeping re-runs safe.
+      up: addColumnIfAbsent("request_hash", "TEXT")
     },
     {
       name: "ablo_idempotency_permanent_retention",
-      up: `ALTER TABLE ablo_idempotency
-  ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ NOT NULL DEFAULT 'infinity';`
+      up: addColumnIfAbsent("expires_at", `TIMESTAMPTZ NOT NULL DEFAULT 'infinity'`)
     }
   ];
 }
@@ -5421,13 +5341,460 @@ var init_migrations = __esm({
   }
 });
 
+// src/cli/connectSetup.ts
+function quoteIdent(id) {
+  return `"${id.replace(/"/g, '""')}"`;
+}
+function quoteLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function scopedSequenceGrant(tables, writeRole) {
+  const names = tables.map(quoteLiteral).join(", ");
+  return `DO $$
+DECLARE seq regclass;
+BEGIN
+  FOR seq IN
+    SELECT DISTINCT d.objid::regclass
+    FROM pg_depend d
+    JOIN pg_class s ON s.oid = d.objid AND s.relkind = 'S'
+    JOIN pg_class t ON t.oid = d.refobjid
+    JOIN pg_namespace n ON n.oid = t.relnamespace
+    WHERE d.deptype IN ('a', 'i') AND n.nspname = 'public' AND t.relname IN (${names})
+  LOOP
+    EXECUTE format('GRANT USAGE, SELECT ON SEQUENCE %s TO ${quoteIdent(writeRole)}', seq);
+  END LOOP;
+END $$;`;
+}
+function connectSetupSql(input) {
+  const role = input.role && input.role.length > 0 ? input.role : ABLO_REPLICATION_ROLE;
+  const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : ABLO_WRITE_ROLE;
+  const tables = input.tables ?? [];
+  const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
+  const tableList = tables.map(quoteIdent).join(", ");
+  const scoped = tables.length > 0;
+  const applicationGrant = scoped ? `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ${tableList} TO ${quoteIdent(writeRole)};` : `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${quoteIdent(writeRole)};`;
+  const replicationReadGrants = scoped ? [`GRANT SELECT ON TABLE ${tableList} TO ${quoteIdent(role)};`] : [
+    `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${quoteIdent(role)};`,
+    `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${quoteIdent(role)};`
+  ];
+  const writerSequenceGrants = scoped ? [scopedSequenceGrant(tables, writeRole)] : [`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${quoteIdent(writeRole)};`];
+  const ledger = idempotencyLedgerMigrations().map((migration) => migration.up);
+  return [
+    // 1. Turn on logical decoding. Requires a restart (it's not reloadable).
+    `ALTER SYSTEM SET wal_level = 'logical';`,
+    // 2. Publish the tables Ablo should read.
+    `CREATE PUBLICATION ${quoteIdent(ABLO_PUBLICATION)} ${publicationTarget};`,
+    // 3. A least-privilege role: it can stream replication and SELECT the
+    // published tables, nothing more.
+    `CREATE ROLE ${quoteIdent(role)} WITH REPLICATION LOGIN PASSWORD '<password>';`,
+    ...replicationReadGrants,
+    // 4. A distinct DML role: no replication, role administration, ownership,
+    // schema creation, or DDL. It runs NOBYPASSRLS with row_security on, so on a
+    // table that HAS row-level-security policies they govern its writes and it
+    // can't bypass them; on a table without policies there is nothing to apply
+    // and the table grants alone bound it.
+    `CREATE ROLE ${quoteIdent(writeRole)} WITH LOGIN PASSWORD '<write-password>' NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE NOREPLICATION NOINHERIT;`,
+    `ALTER ROLE ${quoteIdent(writeRole)} SET row_security = on;`,
+    `GRANT USAGE ON SCHEMA public TO ${quoteIdent(writeRole)};`,
+    applicationGrant,
+    ...writerSequenceGrants,
+    ...scoped ? [] : [
+      // "All tables" mode only: keep future tables/sequences writable so the
+      // publication doesn't outgrow the grant.
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(writeRole)};`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(writeRole)};`
+    ],
+    // 5. Direct uses the durable replay ledger but deliberately no outbox.
+    ...ledger,
+    `REVOKE ALL ON TABLE public.ablo_idempotency FROM PUBLIC;`,
+    `GRANT SELECT, INSERT, UPDATE ON TABLE public.ablo_idempotency TO ${quoteIdent(writeRole)};`,
+    `REVOKE DELETE ON TABLE public.ablo_idempotency FROM ${quoteIdent(writeRole)};`,
+    // The writer emits a transactional marker on your WAL so Ablo can correlate
+    // the committed row back to the originating write and confirm it — this
+    // EXECUTE grant is what makes that confirmation possible. Granted by lookup
+    // across every pg_logical_emit_message variant instead of one literal
+    // signature: PostgreSQL 17 adds an optional fourth `flush` parameter, so the
+    // historical three-argument form no longer exists there and a signature-
+    // pinned GRANT fails on an otherwise healthy database.
+    `-- required: grants the writer Ablo's WAL write-confirmation marker function
+DO $$
+DECLARE fn regprocedure;
+BEGIN
+  FOR fn IN
+    SELECT p.oid::regprocedure
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'pg_catalog' AND p.proname = 'pg_logical_emit_message'
+  LOOP
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO ${quoteIdent(writeRole)}', fn);
+  END LOOP;
+END $$;`
+  ];
+}
+async function probeReadiness(sql, opts = {}) {
+  const publication = opts.publication ?? ABLO_PUBLICATION;
+  const items = [];
+  const walRows = await sql.unsafe(
+    `SELECT setting FROM pg_settings WHERE name = 'wal_level'`
+  );
+  const walLevel = walRows[0]?.setting ?? "unknown";
+  items.push(
+    walLevel === "logical" ? { ok: true, label: `wal_level is ${import_picocolors6.default.bold("logical")}` } : {
+      ok: false,
+      label: `wal_level is ${import_picocolors6.default.bold(walLevel)} (need ${import_picocolors6.default.bold("logical")})`,
+      fix: `ALTER SYSTEM SET wal_level = 'logical'; then RESTART Postgres.
+On RDS/Aurora set rds.logical_replication = 1 in the parameter group, then reboot.
+On Neon enable Logical Replication in the project (Console \u2192 Settings \u2192 Logical Replication, or the API) \u2014 Neon forbids ALTER SYSTEM; the toggle sets wal_level=logical.`
+    }
+  );
+  const pubRows = await sql.unsafe(
+    `SELECT puballtables FROM pg_publication WHERE pubname = $1`,
+    [publication]
+  );
+  const pubRow = pubRows[0];
+  items.push(
+    pubRow ? {
+      ok: true,
+      label: `publication ${import_picocolors6.default.bold(publication)} exists ${import_picocolors6.default.dim(pubRow.puballtables ? "(all tables)" : "(table subset)")}`
+    } : {
+      ok: false,
+      label: `publication ${import_picocolors6.default.bold(publication)} not found`,
+      fix: `CREATE PUBLICATION ${quoteIdent(publication)} FOR ALL TABLES;`
+    }
+  );
+  const roleRows = await sql.unsafe(
+    `SELECT rolreplication, rolsuper FROM pg_roles WHERE rolname = current_user`
+  );
+  const role = roleRows[0];
+  const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper));
+  items.push(
+    hasReplication ? {
+      ok: true,
+      label: `the replication role can stream replication ${import_picocolors6.default.dim("(REPLICATION)")}`
+    } : {
+      ok: false,
+      label: `the replication role lacks the ${import_picocolors6.default.bold("REPLICATION")} attribute`,
+      fix: `ALTER ROLE current_user WITH REPLICATION;
+On RDS: GRANT rds_replication TO <your_role>;`
+    }
+  );
+  if (pubRows.length > 0) {
+    const badRows = await sql.unsafe(
+      `SELECT c.relname AS table_name, c.relreplident
+         FROM pg_publication_tables pt
+         JOIN pg_class c ON c.relname = pt.tablename
+         JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = pt.schemaname
+        WHERE pt.pubname = $1
+          AND (
+            c.relreplident = 'n'
+            OR (
+              c.relreplident = 'd'
+              AND NOT EXISTS (
+                SELECT 1 FROM pg_index i
+                 WHERE i.indrelid = c.oid AND i.indisprimary
+              )
+            )
+          )`,
+      [publication]
+    );
+    items.push(
+      badRows.length === 0 ? { ok: true, label: `all published tables have a usable REPLICA IDENTITY` } : {
+        ok: false,
+        label: `${badRows.length} published table${badRows.length === 1 ? "" : "s"} cannot replicate UPDATE/DELETE`,
+        fix: badRows.map(
+          (r2) => `${r2.table_name}: add a PRIMARY KEY, or ALTER TABLE ${quoteIdent(r2.table_name)} REPLICA IDENTITY FULL;`
+        ).join("\n")
+      }
+    );
+  }
+  return items;
+}
+function registerEndpoint(baseUrl2) {
+  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources`;
+}
+async function parseJsonBody(res, schema) {
+  const parsed = schema.safeParse(await res.json().catch(() => null));
+  return parsed.success ? parsed.data : {};
+}
+async function registerDirectDataSource(opts) {
+  let res;
+  try {
+    res = await fetch(registerEndpoint(opts.apiUrl), {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${opts.apiKey}` },
+      body: JSON.stringify({
+        connection: "direct",
+        connectionString: opts.replicationUrl,
+        writeConnectionString: opts.writeUrl,
+        route: opts.route
+      })
+    });
+  } catch (err) {
+    console.error(
+      import_picocolors6.default.red(
+        `
+  Couldn't reach ${opts.apiUrl}: ${err instanceof Error ? err.message : String(err)}
+`
+      )
+    );
+    return false;
+  }
+  if (res.ok) {
+    const body2 = await parseJsonBody(res, DataSourceRegisterSuccess);
+    const statusNote = body2.status === "active" ? `${opts.route}, active` : opts.route;
+    console.log(
+      `
+  ${import_picocolors6.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors6.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors6.default.dim(`(${body2.id})`)}` : ""} as a direct DataSource (${statusNote}).
+  Customer COMMIT is durable acceptance; correlated WAL promotes queued writes to confirmed.
+`
+    );
+    return true;
+  }
+  const body = await parseJsonBody(res, DataSourceRegisterError);
+  const code = body.code ?? body.error?.code;
+  const message = body.message ?? body.error?.message ?? `HTTP ${res.status}`;
+  console.error(import_picocolors6.default.red(`
+  Registration failed: ${message}`));
+  if (code === "forbidden") {
+    console.error(
+      import_picocolors6.default.dim(
+        `  Registering a database needs a ${import_picocolors6.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors6.default.bold("ablo login")} for one.`
+      )
+    );
+  } else if (code === "datasource_connection_unsupported") {
+    console.error(
+      import_picocolors6.default.dim(
+        `  This deployment can\u2019t accept connection strings \u2014 use a self-hosted/hosted engine, or the signed endpoint fallback.`
+      )
+    );
+  } else if (code === "database_not_replication_ready" || code === "data_source_blocked") {
+    for (const f of body.details?.failures ?? []) {
+      console.error(
+        `  ${import_picocolors6.default.red("\u2717")} ${import_picocolors6.default.bold(f.item ?? "item")}${f.actual ? import_picocolors6.default.dim(` (${f.actual})`) : ""}`
+      );
+      if (f.fix)
+        for (const line of f.fix.split("\n")) console.error(`      ${import_picocolors6.default.red("\u2022")} ${line}`);
+    }
+    console.error(
+      import_picocolors6.default.dim(`
+  Apply the fixes, verify with ${import_picocolors6.default.bold("ablo connect check")}, then re-run.`)
+    );
+  } else if (code === "database_unreachable" || code === "source_unreachable") {
+    if (body.details?.reason) console.error(import_picocolors6.default.dim(`  ${body.details.reason}`));
+    console.error(
+      import_picocolors6.default.dim(
+        `  Ablo's servers must be able to reach this database \u2014 a localhost or private-network
+  Postgres can't use the direct path. Establish an allowlist, PrivateLink, peering, or VPN.
+  Only when no inbound route is possible, register the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.`
+      )
+    );
+  }
+  console.error();
+  return false;
+}
+var import_picocolors6, import_zod6, ABLO_PUBLICATION, ABLO_REPLICATION_ROLE, ABLO_WRITE_ROLE, DIRECT_DATA_SOURCE_ROUTES, DataSourceRegisterSuccess, DataSourceRegisterError;
+var init_connectSetup = __esm({
+  "src/cli/connectSetup.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_picocolors6 = __toESM(require_picocolors(), 1);
+    import_zod6 = require("zod");
+    init_migrations();
+    ABLO_PUBLICATION = "ablo_publication";
+    ABLO_REPLICATION_ROLE = "ablo_replicator";
+    ABLO_WRITE_ROLE = "ablo_writer";
+    DIRECT_DATA_SOURCE_ROUTES = [
+      "public-allowlist",
+      "privatelink",
+      "peering",
+      "vpn"
+    ];
+    DataSourceRegisterSuccess = import_zod6.z.object({
+      id: import_zod6.z.string().optional(),
+      host: import_zod6.z.string().optional(),
+      status: import_zod6.z.string().optional()
+    });
+    DataSourceRegisterError = import_zod6.z.object({
+      code: import_zod6.z.string().optional(),
+      message: import_zod6.z.string().optional(),
+      details: import_zod6.z.object({
+        failures: import_zod6.z.array(
+          import_zod6.z.object({
+            item: import_zod6.z.string().optional(),
+            actual: import_zod6.z.string().optional(),
+            fix: import_zod6.z.string().optional()
+          })
+        ).optional(),
+        reason: import_zod6.z.string().optional()
+      }).optional(),
+      error: import_zod6.z.object({ code: import_zod6.z.string().optional(), message: import_zod6.z.string().optional() }).optional()
+    });
+  }
+});
+
+// src/cli/disconnect.ts
+var disconnect_exports = {};
+__export(disconnect_exports, {
+  DISCONNECT_USAGE: () => DISCONNECT_USAGE,
+  disconnect: () => disconnect
+});
+function planeLabel(target) {
+  const confirmed = target.confirmed;
+  const project = confirmed?.project?.name ?? confirmed?.project?.slug ?? confirmed?.projectId ?? "the default project";
+  const env = confirmed?.environment ?? target.keyEnv ?? "unknown environment";
+  return { project, env };
+}
+async function disconnect(argv) {
+  let skipConfirm = false;
+  for (const arg of argv) {
+    if (arg === "--yes" || arg === "-y") skipConfirm = true;
+    else if (arg === "--help" || arg === "-h") {
+      console.log(DISCONNECT_USAGE);
+      return;
+    } else {
+      console.error(
+        import_picocolors7.default.red(`  Unknown flag ${import_picocolors7.default.bold(arg)}.`) + import_picocolors7.default.dim(` See ${import_picocolors7.default.bold("ablo connect deregister --help")}.`)
+      );
+      process.exit(1);
+    }
+  }
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors7.default.dim("connect deregister")}  ${import_picocolors7.default.dim("remove this project's data source")}
+`
+  );
+  const resolved = resolveEffectiveApiKey();
+  const apiKey = resolved.key;
+  const keySource = resolved.source ?? "stored";
+  if (!apiKey) {
+    console.error(
+      import_picocolors7.default.red(`  Disconnecting needs an API key, and none was found.`) + import_picocolors7.default.dim(
+        ` Run ${import_picocolors7.default.bold("ablo login")} (or set ${import_picocolors7.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors7.default.bold("ablo connect deregister")}.`
+      )
+    );
+    process.exit(1);
+  }
+  const apiUrl2 = apiBaseUrl();
+  const target = await resolveTarget({ url: apiUrl2, apiKey, keySource });
+  const { project, env } = planeLabel(target);
+  const envLabel = env === "production" ? import_picocolors7.default.yellow(env) : import_picocolors7.default.dim(env);
+  for (const mismatch of target.mismatches) {
+    console.log(`  ${import_picocolors7.default.yellow("\u26A0")}  ${describeMismatch(mismatch)}
+`);
+  }
+  if (!skipConfirm) {
+    if (!process.stdout.isTTY) {
+      console.error(
+        import_picocolors7.default.dim(`  Re-run with ${import_picocolors7.default.bold("--yes")} to disconnect in a non-interactive session.
+`)
+      );
+      process.exit(1);
+    }
+    const proceed = await ye({
+      message: `Disconnect the data source for ${import_picocolors7.default.bold(project)} in ${envLabel}?`,
+      initialValue: true
+    });
+    if (pD(proceed) || !proceed) {
+      console.log(import_picocolors7.default.dim(`  Nothing changed. The data source is still connected.
+`));
+      process.exit(0);
+    }
+  }
+  let res;
+  try {
+    res = await fetch(registerEndpoint(apiUrl2), {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${apiKey}` }
+    });
+  } catch (err) {
+    console.error(
+      import_picocolors7.default.red(`
+  Couldn't reach ${apiUrl2}: ${err instanceof Error ? err.message : String(err)}
+`)
+    );
+    process.exit(1);
+  }
+  if (res.ok) {
+    const body2 = await res.json().catch(() => ({}));
+    const parts = [];
+    if (body2.cleared?.direct) parts.push("the direct database registration");
+    if (body2.cleared?.endpoints) {
+      parts.push(
+        `${body2.cleared.endpoints} endpoint registration${body2.cleared.endpoints === 1 ? "" : "s"}`
+      );
+    }
+    const what = parts.length > 0 ? parts.join(" and ") : "the data source";
+    console.log(
+      `
+  ${import_picocolors7.default.green("\u2713")} Disconnected ${what} for ${import_picocolors7.default.bold(project)} in ${envLabel}. Reconnect with ${import_picocolors7.default.bold("ablo connect")}.
+`
+    );
+    return;
+  }
+  const body = await res.json().catch(() => ({}));
+  const code = body.code ?? body.error?.code;
+  const message = body.message ?? body.error?.message ?? `HTTP ${res.status}`;
+  if (code === "entity_not_found") {
+    console.log(import_picocolors7.default.dim(`  No data source registered for ${project} in ${env}.
+`));
+    return;
+  }
+  console.error(import_picocolors7.default.red(`
+  Disconnect failed: ${message}`));
+  if (code === "forbidden") {
+    console.error(
+      import_picocolors7.default.dim(
+        `  Disconnecting needs a ${import_picocolors7.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors7.default.bold("ablo login")} for one.`
+      )
+    );
+  }
+  console.error();
+  process.exit(1);
+}
+var import_picocolors7, DISCONNECT_USAGE;
+var init_disconnect = __esm({
+  "src/cli/disconnect.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_picocolors7 = __toESM(require_picocolors(), 1);
+    init_dist2();
+    init_config();
+    init_push();
+    init_theme();
+    init_connectSetup();
+    init_target();
+    DISCONNECT_USAGE = `${brand("ablo")} connect deregister  ${import_picocolors7.default.dim("remove this project's data source")}
+
+  Usage
+    npx ablo connect deregister          Remove the active project's data source (confirms first)
+    npx ablo connect deregister --yes    Skip the confirmation
+
+  Acts on one plane \u2014 the active project (${import_picocolors7.default.bold("ablo projects use")}) in the active
+  environment (${import_picocolors7.default.bold("ablo mode")}), shown before it runs. Removes the registration and
+  Ablo's replication state for that plane, so Ablo stops reading and writing the
+  database. Reconnect with ${import_picocolors7.default.bold("ablo connect")}.`;
+  }
+});
+
 // src/cli/connectApply.ts
 var connectApply_exports = {};
 __export(connectApply_exports, {
   connectApplyPlan: () => connectApplyPlan,
+  detectProvider: () => detectProvider,
+  ledgerBlockedBy: () => ledgerBlockedBy,
+  logicalReplicationGuidance: () => logicalReplicationGuidance,
   passwordClause: () => passwordClause,
+  postRegistrationOutcome: () => postRegistrationOutcome,
   runConnectApply: () => runConnectApply
 });
+function postRegistrationOutcome(input) {
+  if (input.registered) return { exitCode: 0, notice: null };
+  if (!input.rotating) return { exitCode: 1, notice: null };
+  return {
+    exitCode: 1,
+    notice: "The new passwords are set in your database, but Ablo could not be updated with them.\nAblo still holds the previous password, which no longer works \u2014 writes will fail until\nyou re-run `ablo connect rotate` (each run is idempotent and rotates a fresh password)."
+  };
+}
 function passwordClause(password, mode2) {
   return mode2 === "scram-verifier" ? scramSha256Verifier(password) : password.replace(/'/g, "''");
 }
@@ -5442,19 +5809,28 @@ function connectApplyPlan(input) {
   const role = input.role && input.role.length > 0 ? input.role : ABLO_REPLICATION_ROLE;
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
+  const provider = input.provider ?? "generic";
   const recipe = connectSetupSql({ tables, role, writeRole });
   const isWal = (s) => s.startsWith("ALTER SYSTEM SET wal_level");
   const isPublication = (s) => s.startsWith("CREATE PUBLICATION");
-  const isRoleCreate = (s) => /^CREATE ROLE /.test(s);
+  const isRoleCreate = (s) => s.startsWith("CREATE ROLE ");
   const grants = recipe.filter((s) => !isWal(s) && !isPublication(s) && !isRoleCreate(s));
   const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
-  return [
-    {
+  const walStep = input.walAlreadyLogical ? [] : [
+    provider === "generic" ? {
       key: "wal",
       title: "Turn on logical replication",
-      detail: "lets Ablo read your changes as they happen",
+      detail: "lets Ablo read your changes as they happen (needs a restart to take effect)",
       sql: [`ALTER SYSTEM SET wal_level = 'logical';`]
-    },
+    } : {
+      key: "wal",
+      title: "Turn on logical replication",
+      detail: logicalReplicationGuidance(provider),
+      sql: []
+    }
+  ];
+  return [
+    ...walStep,
     {
       key: "publication",
       title: "Publish your tables to Ablo",
@@ -5475,7 +5851,7 @@ END $$;`
     {
       key: "write-role",
       title: "Create a scoped writer role",
-      detail: `${writeRole} \u2014 writes rows through Ablo, and is subject to your row-level security`,
+      detail: `${writeRole} \u2014 writes rows through Ablo; where a table has row-level-security policies, they govern its writes too (it can't bypass them)`,
       sql: [
         idempotentRole(
           writeRole,
@@ -5496,53 +5872,23 @@ function isPlaintextRefusal(err) {
   const message = err instanceof Error ? err.message : String(err);
   return /plaintext password/i.test(message);
 }
-function persistScopedUrls(vars, cwd = process.cwd()) {
-  const targets = [".env.local", ".env"];
-  const existing = targets.find((name) => (0, import_fs6.existsSync)((0, import_path4.resolve)(cwd, name)));
-  const file = existing ?? ".env.local";
-  const path = (0, import_path4.resolve)(cwd, file);
-  let content = (0, import_fs6.existsSync)(path) ? (0, import_fs6.readFileSync)(path, "utf8") : "";
-  for (const [name, value] of Object.entries(vars)) {
-    const line = `${name}=${value}`;
-    const pattern = new RegExp(`^${name}=.*$`, "m");
-    if (pattern.test(content)) {
-      content = content.replace(pattern, line);
-    } else {
-      content = `${content}${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
-`;
-    }
-  }
-  if (!(0, import_fs6.existsSync)(path)) {
-    (0, import_fs6.writeFileSync)(path, content, { mode: 384 });
-  } else {
-    (0, import_fs6.writeFileSync)(path, content);
-  }
-  const gitignorePath = (0, import_path4.resolve)(cwd, ".gitignore");
-  const gitignore = (0, import_fs6.existsSync)(gitignorePath) ? (0, import_fs6.readFileSync)(gitignorePath, "utf8") : "";
-  if (!/^\.env(\.local|\*|\.\*)?$/m.test(gitignore)) {
-    (0, import_fs6.appendFileSync)(
-      gitignorePath,
-      `${gitignore.endsWith("\n") || gitignore.length === 0 ? "" : "\n"}.env.local
-`
-    );
-  }
-  return file;
-}
 function printPlan2(steps, showSql) {
   console.log(`  This sets up your database for Ablo:
 `);
   for (const step of steps) {
-    console.log(`    ${import_picocolors6.default.green("\u2022")} ${step.title}`);
+    console.log(`    ${import_picocolors8.default.green("\u2022")} ${step.title}`);
     if (showSql) {
       for (const statement of step.sql) {
-        for (const line of statement.split("\n")) console.log(`        ${import_picocolors6.default.dim(line)}`);
+        for (const line of statement.split("\n")) console.log(`        ${import_picocolors8.default.dim(line)}`);
       }
     }
   }
   console.log(
-    import_picocolors6.default.dim(`
+    import_picocolors8.default.dim(
+      `
   Your admin password stays on this machine.${showSql ? "" : " (--show-sql for the exact statements)"}
-`)
+`
+    )
   );
 }
 async function adminCanCreateRoles(sql) {
@@ -5551,8 +5897,54 @@ async function adminCanCreateRoles(sql) {
   );
   return rows[0] ?? null;
 }
+function ledgerBlockedBy(row) {
+  if (!row || row.is_owner || row.is_superuser) return null;
+  return row.owner;
+}
+async function unmanageableLedgerOwner(sql) {
+  const rows = await sql.unsafe(
+    `SELECT pg_get_userbyid(c.relowner) AS owner,
+            c.relowner = r.oid AS is_owner,
+            r.rolsuper AS is_superuser
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       JOIN pg_roles r ON r.rolname = current_user
+      WHERE c.relkind = 'r'
+        AND c.relname = 'ablo_idempotency'
+        AND n.nspname = 'public'`
+  );
+  return ledgerBlockedBy(rows[0]);
+}
+function detectProvider(hostOrTarget) {
+  const host = hostOrTarget.toLowerCase();
+  if (host.includes("neon.tech")) return "neon";
+  if (host.includes("supabase.co") || host.includes("supabase.com") || host.includes("pooler.supabase")) {
+    return "supabase";
+  }
+  if (host.includes("rds.amazonaws.com") || host.includes(".rds.")) return "rds";
+  return "generic";
+}
+function logicalReplicationGuidance(provider) {
+  switch (provider) {
+    case "neon":
+      return `enable logical replication in your Neon project settings \u2014 it can't be set over SQL`;
+    case "supabase":
+      return `raise wal_level to logical in your Supabase project's database settings`;
+    case "rds":
+      return `set rds.logical_replication = 1 in the instance's parameter group, then reboot`;
+    case "generic":
+      return `run the ALTER SYSTEM above, then restart Postgres \u2014 wal_level is not reloadable`;
+  }
+}
+async function currentWalLevel(sql) {
+  try {
+    const rows = await sql.unsafe(`SHOW wal_level`);
+    return rows[0]?.wal_level ?? "";
+  } catch {
+    return "";
+  }
+}
 async function executePlan(sql, steps, rebuildPlaintext) {
-  let walDeferred = false;
   let plaintextSteps = null;
   for (const step of steps) {
     for (const statement of step.sql) {
@@ -5560,7 +5952,6 @@ async function executePlan(sql, steps, rebuildPlaintext) {
         await sql.unsafe(statement);
       } catch (err) {
         if (step.key === "wal") {
-          walDeferred = true;
           continue;
         }
         if ((step.key === "replication-role" || step.key === "write-role") && isPlaintextRefusal(err)) {
@@ -5575,39 +5966,86 @@ async function executePlan(sql, steps, rebuildPlaintext) {
       }
     }
   }
-  return { walDeferred };
 }
 async function runConnectApply(args) {
-  const adminUrl = readProjectDatabaseUrl();
+  const rotating = args.rotate;
+  const verb = rotating ? "connect rotate" : "connect apply";
+  const adminUrl = args.url ?? readProjectAdminDatabaseUrl();
   if (!adminUrl) {
     console.error(
-      import_picocolors6.default.red("  No DATABASE_URL found.") + import_picocolors6.default.dim(` Point it at your admin connection and re-run.`)
+      import_picocolors8.default.red("  No admin connection string.") + import_picocolors8.default.dim(
+        ` Pass ${import_picocolors8.default.bold("--url <admin-conn>")} (or set ${import_picocolors8.default.bold("DATABASE_URL")}) and re-run.`
+      )
+    );
+    process.exit(1);
+  }
+  const adminSource = args.url ? "--url" : "DATABASE_URL";
+  let target = "your database";
+  try {
+    const parsed = new URL(adminUrl);
+    target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+  } catch {
+  }
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors8.default.red("  Not logged in.") + import_picocolors8.default.dim(
+        ` Run ${import_picocolors8.default.bold("ablo login")} (or set ${import_picocolors8.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
+      )
     );
     process.exit(1);
   }
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors6.default.dim("connect --apply")}  ${import_picocolors6.default.dim("set up your database for Ablo")}
+  ${brand("ablo")} ${import_picocolors8.default.dim(verb)}  ${import_picocolors8.default.dim(rotating ? "re-key the scoped roles" : "set up your database for Ablo")}
 `
   );
-  const admin = src_default(adminUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
-  } });
+  console.log(
+    `  ${import_picocolors8.default.dim("\u2192")} ${import_picocolors8.default.bold(target)}${adminSource === "DATABASE_URL" ? import_picocolors8.default.dim("  (admin via DATABASE_URL)") : ""}
+`
+  );
+  const admin = src_default(adminUrl, {
+    max: 1,
+    prepare: false,
+    connect_timeout: 10,
+    onnotice: () => {
+    }
+  });
   let capability;
   try {
     capability = await adminCanCreateRoles(admin);
   } catch (err) {
     await admin.end({ timeout: 2 }).catch(() => void 0);
     const pg = err ?? {};
-    console.error(import_picocolors6.default.red(`  Couldn't connect: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors8.default.red(`  Couldn't connect: ${pg.message ?? String(err)}`));
     process.exit(1);
   }
   if (!capability || !(capability.rolsuper || capability.rolcreaterole)) {
     await admin.end({ timeout: 2 });
     console.error(
-      import_picocolors6.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors6.default.dim(` Point DATABASE_URL at your owner/admin connection and re-run.`)
+      import_picocolors8.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors8.default.dim(` Point ${import_picocolors8.default.bold("--url")} at your owner/admin connection and re-run.`)
+    );
+    process.exit(1);
+  }
+  const blockingOwner = await unmanageableLedgerOwner(admin).catch(() => null);
+  if (blockingOwner) {
+    await admin.end({ timeout: 2 });
+    console.error(
+      import_picocolors8.default.red(
+        `
+  ${import_picocolors8.default.bold("ablo_idempotency")} already exists on ${target}, owned by ${import_picocolors8.default.bold(blockingOwner)}, but you connected as ${import_picocolors8.default.bold(capability.rolname)}.`
+      ) + `
+  Ablo's setup grants the writer role access to this ledger, and Postgres reserves that
+  for the table's owner. Either re-run pointing ${import_picocolors8.default.bold("--url")} at ${import_picocolors8.default.bold(blockingOwner)}'s connection,
+  or drop the existing ledger so Ablo recreates it under this admin \u2014 it holds only
+  idempotency replay records, safe to drop when no commit is in flight:
+      ${import_picocolors8.default.cyan("DROP TABLE ablo_idempotency;")}
+`
     );
     process.exit(1);
   }
+  const provider = detectProvider(target);
+  const walReady = await currentWalLevel(admin) === "logical";
   const replicationPassword = generateRolePassword();
   const writePassword = generateRolePassword();
   const buildPlan = (mode2) => connectApplyPlan({
@@ -5617,7 +6055,9 @@ async function runConnectApply(args) {
     credentials: {
       replicationClause: passwordClause(replicationPassword, mode2),
       writeClause: passwordClause(writePassword, mode2)
-    }
+    },
+    walAlreadyLogical: walReady,
+    provider
   });
   const steps = buildPlan("scram-verifier");
   printPlan2(steps, args.showSql);
@@ -5625,31 +6065,32 @@ async function runConnectApply(args) {
     if (!process.stdout.isTTY) {
       await admin.end({ timeout: 2 });
       console.error(
-        import_picocolors6.default.dim(`  Re-run with ${import_picocolors6.default.bold("--yes")} to apply this in a non-interactive session.
+        import_picocolors8.default.dim(`  Re-run with ${import_picocolors8.default.bold("--yes")} to apply this in a non-interactive session.
 `)
       );
       process.exit(1);
     }
     const proceed = await ye({
-      message: `Set this up in ${capability.rolname === "postgres" ? "your database" : `your database as ${capability.rolname}`}?`,
+      message: rotating ? `Re-key Ablo's roles on ${target}?` : `Provision Ablo on ${target}?`,
       initialValue: true
     });
     if (pD(proceed) || !proceed) {
       await admin.end({ timeout: 2 });
-      console.log(import_picocolors6.default.dim(`  Nothing applied. Run ${import_picocolors6.default.bold("ablo connect")} to see the manual recipe.
-`));
+      console.log(
+        import_picocolors8.default.dim(`  Nothing applied. Run ${import_picocolors8.default.bold("ablo connect")} to see the manual recipe.
+`)
+      );
       process.exit(0);
     }
   }
-  let walDeferred = false;
   try {
-    ({ walDeferred } = await executePlan(admin, steps, () => buildPlan("plaintext")));
+    await executePlan(admin, steps, () => buildPlan("plaintext"));
   } catch (err) {
     await admin.end({ timeout: 2 }).catch(() => void 0);
     const pg = err ?? {};
     console.error(
-      import_picocolors6.default.red(`
-  Setup stopped: ${pg.message ?? String(err)}`) + import_picocolors6.default.dim(`  Every step is safe to re-run.
+      import_picocolors8.default.red(`
+  Setup stopped: ${pg.message ?? String(err)}`) + import_picocolors8.default.dim(`  Every step is safe to re-run.
 `)
     );
     process.exit(1);
@@ -5659,787 +6100,72 @@ async function runConnectApply(args) {
   const writeRole = args.writeRole && args.writeRole.length > 0 ? args.writeRole : ABLO_WRITE_ROLE;
   const replicationUrl = rewriteDatabaseUrl(adminUrl, role, replicationPassword);
   const writeUrl = rewriteDatabaseUrl(adminUrl, writeRole, writePassword);
-  const where = persistScopedUrls({
-    DATABASE_URL: replicationUrl,
-    ABLO_WRITE_DATABASE_URL: writeUrl
-  });
-  console.log(
-    `
-  ${import_picocolors6.default.green("\u2713")} Roles created \u2014 ${import_picocolors6.default.bold("DATABASE_URL")} + ${import_picocolors6.default.bold("ABLO_WRITE_DATABASE_URL")} updated in ${import_picocolors6.default.bold(where)}.
-`
-  );
-  const verifier = src_default(replicationUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
-  } });
-  let items;
-  try {
-    items = await probeReadiness(verifier);
-  } catch {
-    await verifier.end({ timeout: 2 }).catch(() => void 0);
-    console.log(import_picocolors6.default.dim(`  Verify when reachable:  `) + import_picocolors6.default.cyan("npx ablo connect --check") + "\n");
-    process.exit(0);
-  }
-  await verifier.end({ timeout: 2 });
-  const failed = items.filter((i) => !i.ok);
-  if (walDeferred) {
-    console.log(
-      `  ${import_picocolors6.default.yellow("!")} One step left \u2014 logical replication needs a restart.
-` + import_picocolors6.default.dim(`    RDS/Aurora: set rds.logical_replication=1, reboot.  Neon: enable it in settings.
-`) + `
-  Then:  ${import_picocolors6.default.cyan("npx ablo connect --register")}
-`
-    );
-    process.exit(0);
-  }
-  if (failed.length === 0) {
-    console.log(`  ${import_picocolors6.default.green("\u2713")} Verified.  Next:  ${import_picocolors6.default.cyan("npx ablo connect --register")}
-`);
-  } else {
-    for (const item of failed) console.log(`  ${import_picocolors6.default.yellow("!")} ${item.label}`);
-    console.log(`
-  ${import_picocolors6.default.dim("Resolve, then")}  ${import_picocolors6.default.cyan("npx ablo connect --register")}
-`);
-  }
-  process.exit(0);
-}
-var import_picocolors6, import_fs6, import_path4;
-var init_connectApply = __esm({
-  "src/cli/connectApply.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_picocolors6 = __toESM(require_picocolors(), 1);
-    init_src();
-    init_dist2();
-    import_fs6 = require("fs");
-    import_path4 = require("path");
-    init_connect();
-    init_dbRole();
-    init_theme();
-  }
-});
-
-// src/cli/connect.ts
-function parseConnectArgs(argv) {
-  let check2 = false;
-  let register = false;
-  let apply2 = false;
-  let yes = false;
-  let showSql = false;
-  let auditInfra = false;
-  let tables = [];
-  let role = ABLO_REPLICATION_ROLE;
-  let writeRole = ABLO_WRITE_ROLE;
-  let route = "public-allowlist";
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    switch (arg) {
-      case "--check":
-        check2 = true;
-        break;
-      case "--register":
-        register = true;
-        break;
-      case "--apply":
-        apply2 = true;
-        break;
-      case "--yes":
-      case "-y":
-        yes = true;
-        break;
-      case "--show-sql":
-        showSql = true;
-        break;
-      case "--audit-infra":
-        auditInfra = true;
-        break;
-      case "--tables": {
-        const value = argv[++i] ?? "";
-        tables = value.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-        break;
-      }
-      case "--role":
-        role = argv[++i] ?? role;
-        break;
-      case "--write-role":
-        writeRole = argv[++i] ?? writeRole;
-        break;
-      case "--route": {
-        const value = argv[++i] ?? "";
-        if (!DIRECT_DATA_SOURCE_ROUTES.includes(value)) {
-          throw new AbloValidationError(
-            `invalid direct route: ${value || "(missing)"} (expected ${DIRECT_DATA_SOURCE_ROUTES.join(", ")})`,
-            { code: "cli_invalid_arguments" }
-          );
-        }
-        route = value;
-        break;
-      }
-      default:
-        throw new AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
-    }
-  }
-  if (role === writeRole) {
-    throw new AbloValidationError("replication and write roles must be different", {
-      code: "cli_invalid_arguments"
-    });
-  }
-  return { check: check2, register, apply: apply2, yes, showSql, auditInfra, tables, role, writeRole, route };
-}
-function quoteIdent(id) {
-  return `"${id.replace(/"/g, '""')}"`;
-}
-function connectSetupSql(input) {
-  const role = input.role && input.role.length > 0 ? input.role : ABLO_REPLICATION_ROLE;
-  const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : ABLO_WRITE_ROLE;
-  const tables = input.tables ?? [];
-  const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
-  const applicationGrant = tables.length > 0 ? `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ${tables.map(quoteIdent).join(", ")} TO ${quoteIdent(writeRole)};` : `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${quoteIdent(writeRole)};`;
-  const ledger = idempotencyLedgerMigrations().map((migration) => migration.up);
-  return [
-    // 1. Turn on logical decoding. Requires a restart (it's not reloadable).
-    `ALTER SYSTEM SET wal_level = 'logical';`,
-    // 2. Publish the tables Ablo should read.
-    `CREATE PUBLICATION ${quoteIdent(ABLO_PUBLICATION)} ${publicationTarget};`,
-    // 3. A least-privilege role: it can stream replication and SELECT, nothing more.
-    `CREATE ROLE ${quoteIdent(role)} WITH REPLICATION LOGIN PASSWORD '<password>';`,
-    `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${quoteIdent(role)};`,
-    // Future tables get SELECT automatically, so the publication doesn't outgrow the grant.
-    `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${quoteIdent(role)};`,
-    // 4. A distinct DML role: no replication, role administration, ownership,
-    // schema creation, or DDL. It is subject to RLS on every transaction.
-    `CREATE ROLE ${quoteIdent(writeRole)} WITH LOGIN PASSWORD '<write-password>' NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE NOREPLICATION NOINHERIT;`,
-    `ALTER ROLE ${quoteIdent(writeRole)} SET row_security = on;`,
-    // PUBLIC can carry CREATE on older Postgres clusters. A role-level REVOKE
-    // cannot override that inherited grant, so harden the schema explicitly.
-    `REVOKE CREATE ON SCHEMA public FROM PUBLIC;`,
-    `GRANT USAGE ON SCHEMA public TO ${quoteIdent(writeRole)};`,
-    applicationGrant,
-    `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${quoteIdent(writeRole)};`,
-    ...tables.length === 0 ? [
-      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(writeRole)};`,
-      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(writeRole)};`
-    ] : [],
-    // 5. Direct uses the durable replay ledger but deliberately no outbox.
-    ...ledger,
-    `REVOKE ALL ON TABLE public.ablo_idempotency FROM PUBLIC;`,
-    `GRANT SELECT, INSERT, UPDATE ON TABLE public.ablo_idempotency TO ${quoteIdent(writeRole)};`,
-    `REVOKE DELETE ON TABLE public.ablo_idempotency FROM ${quoteIdent(writeRole)};`,
-    // Grant every pg_logical_emit_message variant by lookup instead of one
-    // literal signature: PostgreSQL 17 adds an optional fourth `flush`
-    // parameter, so the historical three-argument form no longer exists there
-    // and a signature-pinned GRANT fails on an otherwise healthy database.
-    `DO $$
-DECLARE fn regprocedure;
-BEGIN
-  FOR fn IN
-    SELECT p.oid::regprocedure
-    FROM pg_proc p
-    JOIN pg_namespace n ON n.oid = p.pronamespace
-    WHERE n.nspname = 'pg_catalog' AND p.proname = 'pg_logical_emit_message'
-  LOOP
-    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO ${quoteIdent(writeRole)}', fn);
-  END LOOP;
-END $$;`
-  ];
-}
-function printConnectRecipe(args) {
-  const sql = connectSetupSql({
-    tables: args.tables,
-    role: args.role,
-    writeRole: args.writeRole
-  });
   console.log(`
-  ${brand("ablo")} ${import_picocolors7.default.dim("connect")}  ${import_picocolors7.default.dim("direct writes + WAL-settled sync")}
+  ${import_picocolors8.default.green("\u2713")} Roles ${rotating ? "re-keyed" : "created"}.
 `);
-  console.log(
-    `  Ablo applies coordinated writes directly to your Postgres with a scoped DML role. WAL
-  observes what committed, orders it with external writes, and confirms it in the sync log.
-  Your database stays authoritative; Ablo never owns or migrates your application tables.
-  Run this once against your Postgres ${import_picocolors7.default.dim("(as a superuser / DB owner)")}:
-`
-  );
-  console.log(`  ${import_picocolors7.default.bold("1.")} Enable logical decoding ${import_picocolors7.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`);
-  console.log(`       ${import_picocolors7.default.cyan(sql[0])}`);
-  console.log(
-    import_picocolors7.default.dim(
-      `       On Amazon RDS / Aurora you can't ALTER SYSTEM: set ${import_picocolors7.default.bold("rds.logical_replication = 1")} in the
-       instance's parameter group instead, then reboot.`
-    )
-  );
-  console.log(`
-  ${import_picocolors7.default.bold("2.")} Publish the tables Ablo should read`);
-  console.log(`       ${import_picocolors7.default.cyan(sql[1])}`);
-  if (args.tables.length === 0) {
-    console.log(import_picocolors7.default.dim(`       (Scope it with ${import_picocolors7.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`));
-  }
-  console.log(`
-  ${import_picocolors7.default.bold("3.")} Create the scoped replication role ${import_picocolors7.default.dim("(pick your own replication password)")}`);
-  console.log(`       ${import_picocolors7.default.cyan(sql[2])}`);
-  console.log(`       ${import_picocolors7.default.cyan(sql[3])}`);
-  console.log(`       ${import_picocolors7.default.cyan(sql[4])}`);
-  console.log(
-    import_picocolors7.default.dim(
-      `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
-       ${import_picocolors7.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
-    )
-  );
-  console.log(
-    `
-  ${import_picocolors7.default.bold("4.")} Create the separate DML role and permanent idempotency ledger ` + import_picocolors7.default.dim("(pick your own write password)")
-  );
-  for (const statement of sql.slice(5)) {
-    for (const line of statement.split("\n")) console.log(`       ${import_picocolors7.default.cyan(line)}`);
-  }
-  console.log(
-    import_picocolors7.default.dim(
-      `       The writer gets row DML + ledger access only. It has no REPLICATION, schema CREATE,
-       role administration, database creation, ownership, or customer-table DDL. Direct uses
-       ${import_picocolors7.default.bold("ablo_idempotency")} but no outbox; WAL carries the committed row changes.`
-    )
-  );
-  console.log(
-    `
-  ${import_picocolors7.default.bold("5.")} Configure both scoped connections, then verify:
-       ${import_picocolors7.default.bold("DATABASE_URL")}              ${import_picocolors7.default.dim(`\u2192 ${args.role} (replication only)`)}
-       ${import_picocolors7.default.bold("ABLO_WRITE_DATABASE_URL")}   ${import_picocolors7.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
-       ${import_picocolors7.default.cyan("npx ablo connect --check")}
-`
-  );
-  console.log(
-    import_picocolors7.default.dim(
-      `  Reachable databases use this direct path. If no inbound route can be established, use the
-  signed ${import_picocolors7.default.bold("dataSource()")} endpoint fallback; its correlated events confirm writes
-  without an Ablo-side customer database socket.`
-    )
-  );
-  console.log();
-}
-function printCheckItem(item) {
-  if (item.ok) {
-    console.log(`  ${import_picocolors7.default.green("\u2713")} ${item.label}`);
-  } else {
-    console.log(`  ${import_picocolors7.default.red("\u2717")} ${item.label}`);
-    if (item.fix) {
-      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors7.default.red("\u2022")} ${line}`);
-    }
-  }
-}
-async function probeReadiness(sql, opts = {}) {
-  const publication = opts.publication ?? ABLO_PUBLICATION;
-  const items = [];
-  const walRows = await sql.unsafe(
-    `SELECT setting FROM pg_settings WHERE name = 'wal_level'`
-  );
-  const walLevel = walRows[0]?.setting ?? "unknown";
-  items.push(
-    walLevel === "logical" ? { ok: true, label: `wal_level is ${import_picocolors7.default.bold("logical")}` } : {
-      ok: false,
-      label: `wal_level is ${import_picocolors7.default.bold(walLevel)} (need ${import_picocolors7.default.bold("logical")})`,
-      fix: `ALTER SYSTEM SET wal_level = 'logical'; then RESTART Postgres.
-On RDS/Aurora set rds.logical_replication = 1 in the parameter group, then reboot.
-On Neon enable Logical Replication in the project (Console \u2192 Settings \u2192 Logical Replication, or the API) \u2014 Neon forbids ALTER SYSTEM; the toggle sets wal_level=logical.`
-    }
-  );
-  const pubRows = await sql.unsafe(
-    `SELECT puballtables FROM pg_publication WHERE pubname = $1`,
-    [publication]
-  );
-  const pubRow = pubRows[0];
-  items.push(
-    pubRow ? {
-      ok: true,
-      label: `publication ${import_picocolors7.default.bold(publication)} exists ${import_picocolors7.default.dim(pubRow.puballtables ? "(all tables)" : "(table subset)")}`
-    } : {
-      ok: false,
-      label: `publication ${import_picocolors7.default.bold(publication)} not found`,
-      fix: `CREATE PUBLICATION ${quoteIdent(publication)} FOR ALL TABLES;`
-    }
-  );
-  const roleRows = await sql.unsafe(
-    `SELECT rolreplication, rolsuper FROM pg_roles WHERE rolname = current_user`
-  );
-  const role = roleRows[0];
-  const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper));
-  items.push(
-    hasReplication ? { ok: true, label: `DATABASE_URL role can stream replication ${import_picocolors7.default.dim("(REPLICATION)")}` } : {
-      ok: false,
-      label: `DATABASE_URL role lacks the ${import_picocolors7.default.bold("REPLICATION")} attribute`,
-      fix: `ALTER ROLE current_user WITH REPLICATION;
-On RDS: GRANT rds_replication TO <your_role>;`
-    }
-  );
-  if (pubRows.length > 0) {
-    const badRows = await sql.unsafe(
-      `SELECT c.relname AS table_name, c.relreplident
-         FROM pg_publication_tables pt
-         JOIN pg_class c ON c.relname = pt.tablename
-         JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = pt.schemaname
-        WHERE pt.pubname = $1
-          AND (
-            c.relreplident = 'n'
-            OR (
-              c.relreplident = 'd'
-              AND NOT EXISTS (
-                SELECT 1 FROM pg_index i
-                 WHERE i.indrelid = c.oid AND i.indisprimary
-              )
-            )
-          )`,
-      [publication]
-    );
-    items.push(
-      badRows.length === 0 ? { ok: true, label: `all published tables have a usable REPLICA IDENTITY` } : {
-        ok: false,
-        label: `${badRows.length} published table${badRows.length === 1 ? "" : "s"} cannot replicate UPDATE/DELETE`,
-        fix: badRows.map(
-          (r2) => `${r2.table_name}: add a PRIMARY KEY, or ALTER TABLE ${quoteIdent(r2.table_name)} REPLICA IDENTITY FULL;`
-        ).join("\n")
-      }
-    );
-  }
-  return items;
-}
-async function probeDirectWriteReadiness(sql, opts = {}) {
-  const schema = opts.schema ?? "public";
-  const publication = opts.publication ?? ABLO_PUBLICATION;
-  const items = [];
-  const roleRows = await sql.unsafe(
-    `SELECT rolname, rolsuper, rolbypassrls, rolcreatedb, rolcreaterole, rolreplication
-       FROM pg_roles WHERE rolname = current_user`
-  );
-  const role = roleRows[0];
-  const dangerous = Boolean(
-    !role || role.rolsuper || role.rolbypassrls || role.rolcreatedb || role.rolcreaterole || role.rolreplication
-  );
-  items.push(
-    dangerous ? {
-      ok: false,
-      label: `ABLO_WRITE_DATABASE_URL is not a scoped DML role`,
-      fix: `Use ${ABLO_WRITE_ROLE} from the setup recipe: NOSUPERUSER, NOBYPASSRLS, NOCREATEDB, NOCREATEROLE, NOREPLICATION.`
-    } : { ok: true, label: `write role ${import_picocolors7.default.bold(role?.rolname ?? ABLO_WRITE_ROLE)} is DML-only` }
-  );
-  const schemaRows = await sql.unsafe(
-    `SELECT
-       has_schema_privilege(current_user, $1, 'USAGE') AS usage,
-       has_schema_privilege(current_user, $1, 'CREATE') AS create,
-       current_setting('row_security') AS row_security`,
-    [schema]
-  );
-  const schemaRow = schemaRows[0];
-  items.push(
-    schemaRow?.usage && !schemaRow.create && schemaRow.row_security === "on" ? { ok: true, label: `writer uses ${schema} with RLS on and no schema CREATE` } : {
-      ok: false,
-      label: `writer schema/RLS privileges are not least-privilege`,
-      fix: `REVOKE CREATE ON SCHEMA ${quoteIdent(schema)} FROM PUBLIC; GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)}; ALTER ROLE ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)} SET row_security = on;`
-    }
-  );
-  const ledgerName = `${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")}`;
-  const ledgerRows = await sql.unsafe(
-    `SELECT
-       to_regclass($1) IS NOT NULL AS present,
-       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'SELECT,INSERT,UPDATE') END AS writes,
-       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'DELETE') END AS deletes`,
-    [ledgerName]
-  );
-  const ledger = ledgerRows[0];
-  items.push(
-    ledger?.present && ledger.writes && !ledger.deletes ? { ok: true, label: `${import_picocolors7.default.bold("ablo_idempotency")} is durable and protected from DELETE` } : {
-      ok: false,
-      label: `${import_picocolors7.default.bold("ablo_idempotency")} is missing or has unsafe grants`,
-      fix: `Apply the DML-role and idempotency-ledger statements printed by ${import_picocolors7.default.bold("ablo connect")}.`
-    }
-  );
-  const tableRows = await sql.unsafe(
-    `SELECT format('%I.%I', schemaname, tablename) AS relation
-       FROM pg_publication_tables
-      WHERE pubname = $1 AND schemaname = $2 AND tablename <> 'ablo_idempotency'
-        AND NOT has_table_privilege(
-          current_user,
-          format('%I.%I', schemaname, tablename),
-          'SELECT,INSERT,UPDATE,DELETE'
-        )`,
-    [publication, schema]
-  );
-  items.push(
-    tableRows.length === 0 ? { ok: true, label: `writer can apply DML to every published application table` } : {
-      ok: false,
-      label: `writer lacks DML on ${tableRows.length} published table${tableRows.length === 1 ? "" : "s"}`,
-      fix: `Grant SELECT, INSERT, UPDATE, DELETE on: ${tableRows.map((row) => row.relation).join(", ")}`
-    }
-  );
-  return items;
-}
-async function auditTenantSyncInfra(sql) {
-  const artifacts = [];
-  for (const name of SYNC_INFRA_RELATIONS) {
-    const rows = await sql.unsafe(
-      `SELECT to_regclass($1)::text AS reg`,
-      [`public.${name}`]
-    );
-    artifacts.push({ kind: "relation", name, present: rows[0]?.reg != null });
-  }
-  for (const name of SYNC_INFRA_TYPES) {
-    const rows = await sql.unsafe(
-      `SELECT to_regtype($1)::text AS reg`,
-      [`public.${name}`]
-    );
-    artifacts.push({ kind: "type", name, present: rows[0]?.reg != null });
-  }
-  return artifacts;
-}
-function requireDatabaseUrl(verb) {
-  const dbUrl = readProjectDatabaseUrl();
-  if (!dbUrl) {
-    console.error(
-      import_picocolors7.default.red("  No DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors7.default.dim(` Set it to the Postgres you want Ablo to read, then re-run ${import_picocolors7.default.bold(`ablo connect ${verb}`)}.`)
-    );
-    process.exit(1);
-  }
-  return dbUrl;
-}
-function requireWriteDatabaseUrl(verb) {
-  const dbUrl = readProjectWriteDatabaseUrl();
-  if (!dbUrl) {
+  if (!walReady) {
     console.error(
-      import_picocolors7.default.red("  No ABLO_WRITE_DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors7.default.dim(
-        ` Set it to the ${ABLO_WRITE_ROLE} connection printed by ${import_picocolors7.default.bold("ablo connect")}, then re-run ${import_picocolors7.default.bold(`ablo connect ${verb}`)}. The replication credential is never reused for DML.`
-      )
+      `  ${import_picocolors8.default.yellow("!")} One step left \u2014 logical replication isn't on yet.
+    ${logicalReplicationGuidance(provider)}.
+
+  Then re-run:  ${import_picocolors8.default.cyan(`npx ablo ${verb}`)}
+`
     );
     process.exit(1);
   }
-  return dbUrl;
-}
-async function probeAndReport(dbUrl, kind = "replication") {
-  const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
-  } });
+  const verifier = src_default(replicationUrl, {
+    max: 1,
+    prepare: false,
+    connect_timeout: 10,
+    onnotice: () => {
+    }
+  });
   let items;
   try {
-    items = kind === "replication" ? await probeReadiness(sql) : await probeDirectWriteReadiness(sql);
-  } catch (err) {
-    await sql.end({ timeout: 2 }).catch(() => void 0);
-    const dial = dialFailureReason(err);
-    if (dial) return { kind: "no-dial", reason: dial };
-    const pg = err ?? {};
-    console.error(import_picocolors7.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
-    process.exit(1);
+    items = await probeReadiness(verifier);
+  } catch {
+    items = null;
+    console.log(import_picocolors8.default.dim(`  Couldn't verify from here; Ablo will validate from its own network.
+`));
   }
-  await sql.end({ timeout: 2 });
-  for (const item of items) printCheckItem(item);
-  return { kind: "probed", failures: items.filter((i) => !i.ok).length };
-}
-async function runRemoteCheck(dbUrl, writeDbUrl, localReason) {
-  console.log(
-    `  This machine can't reach one or both scoped connections (${import_picocolors7.default.dim(localReason)}).
-  That is not the verdict: direct writes and replication run from Ablo's infrastructure.
-  Asking Ablo to check both roles from its side\u2026
-`
-  );
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    console.error(
-      import_picocolors7.default.red(`  The engine-side check needs an API key, and none was found.`) + import_picocolors7.default.dim(
-        ` Run ${import_picocolors7.default.bold("ablo login")} (or set ${import_picocolors7.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors7.default.bold("ablo connect --check")}.`
-      )
-    );
+  await verifier.end({ timeout: 2 }).catch(() => void 0);
+  const failed = items?.filter((i) => !i.ok) ?? [];
+  if (failed.length > 0) {
+    for (const item of failed) console.log(`  ${import_picocolors8.default.yellow("!")} ${item.label}`);
+    console.log(`
+  ${import_picocolors8.default.dim("Resolve, then re-run")}  ${import_picocolors8.default.cyan(`npx ablo ${verb}`)}
+`);
     process.exit(1);
   }
-  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
-  const result = await requestRemoteValidation({
+  const apiUrl2 = apiBaseUrl();
+  const registered = await registerDirectDataSource({
     apiUrl: apiUrl2,
     apiKey,
-    connectionString: dbUrl,
-    writeConnectionString: writeDbUrl
+    replicationUrl,
+    writeUrl,
+    route: args.route
   });
-  if (!result.ok) {
-    console.error(import_picocolors7.default.red(`  The engine-side check failed: ${result.message}`));
-    if (result.code === "forbidden") {
-      console.error(
-        import_picocolors7.default.dim(`  Checking a database from Ablo's side needs a ${import_picocolors7.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors7.default.bold("ablo login")} for one.`)
-      );
-    }
-    console.error();
-    process.exit(1);
-  }
-  if (!result.reachable) {
-    console.error(
-      `  ${import_picocolors7.default.red("\u2717")} Ablo's infrastructure can't reach both direct connections${result.reason ? ` ${import_picocolors7.default.dim(`(${result.reason})`)}` : ""}.`
-    );
-    console.error(
-      import_picocolors7.default.dim(
-        `  Direct needs a route Ablo's servers can dial \u2014 public allowlist, PrivateLink, peering,
-  or VPN. Only when no inbound route can exist, use the signed ${import_picocolors7.default.bold("dataSource()")} endpoint fallback.
-`
-      )
-    );
-    process.exit(1);
-  }
-  for (const failure of result.failures) {
-    const { label, fix } = describeRemoteFailure(failure);
-    printCheckItem({ ok: false, label, fix });
-  }
-  console.log();
-  if (result.ready) {
-    console.log(
-      `  ${import_picocolors7.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Both direct DML and WAL settlement are available.
-`
-    );
-    process.exit(0);
-  }
-  const count = result.failures.length;
-  console.log(
-    `  ${import_picocolors7.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors7.default.dim(`\u2014 found by Ablo's infrastructure. Apply the fixes above, then re-run ${import_picocolors7.default.bold("ablo connect --check")}.`)}
-`
-  );
-  process.exit(1);
-}
-async function runCheck() {
-  const dbUrl = requireDatabaseUrl("--check");
-  const writeDbUrl = requireWriteDatabaseUrl("--check");
-  console.log(`
-  ${brand("ablo")} ${import_picocolors7.default.dim("connect --check")}  ${import_picocolors7.default.dim("direct-write + WAL readiness")}
-`);
-  console.log(`  ${import_picocolors7.default.bold("Replication role")}
-`);
-  const replication = await probeAndReport(dbUrl, "replication");
-  console.log(`
-  ${import_picocolors7.default.bold("Direct-write role")}
+  const outcome = postRegistrationOutcome({ rotating, registered });
+  if (outcome.notice) {
+    console.error(`
+  ${import_picocolors8.default.red(outcome.notice.split("\n").join("\n  "))}
 `);
-  const write = await probeAndReport(writeDbUrl, "write");
-  if (replication.kind === "no-dial" || write.kind === "no-dial") {
-    const reasons = [
-      replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
-      write.kind === "no-dial" ? `write: ${write.reason}` : null
-    ].filter((reason) => reason !== null);
-    return runRemoteCheck(dbUrl, writeDbUrl, reasons.join("; "));
-  }
-  const failures = replication.failures + write.failures;
-  console.log();
-  if (failures === 0) {
-    console.log(`  ${import_picocolors7.default.green("\u2713")} Ready \u2014 Ablo can apply scoped DML and settle it from WAL.
-`);
-    process.exit(0);
   }
-  console.log(
-    `  ${import_picocolors7.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors7.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors7.default.bold("ablo connect --check")}.`)}
-`
-  );
-  process.exit(1);
-}
-function registerEndpoint(baseUrl2) {
-  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources`;
-}
-async function runRegister(args) {
-  const dbUrl = requireDatabaseUrl("--register");
-  const writeDbUrl = requireWriteDatabaseUrl("--register");
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    console.error(
-      import_picocolors7.default.red("  Not logged in.") + import_picocolors7.default.dim(` Run ${import_picocolors7.default.bold("ablo login")} (or set ${import_picocolors7.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`)
-    );
-    process.exit(1);
-  }
-  console.log(`
-  ${brand("ablo")} ${import_picocolors7.default.dim("connect --register")}  ${import_picocolors7.default.dim("register a direct DataSource")}
-`);
-  console.log(`  ${import_picocolors7.default.bold("Replication role")}
-`);
-  const replication = await probeAndReport(dbUrl, "replication");
-  console.log(`
-  ${import_picocolors7.default.bold("Direct-write role")}
-`);
-  const write = await probeAndReport(writeDbUrl, "write");
-  const noDial = [
-    replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
-    write.kind === "no-dial" ? `write: ${write.reason}` : null
-  ].filter((reason) => reason !== null);
-  const failures = (replication.kind === "probed" ? replication.failures : 0) + (write.kind === "probed" ? write.failures : 0);
-  if (noDial.length > 0) {
-    console.log(
-      `  This machine can't reach one or both scoped connections (${import_picocolors7.default.dim(noDial.join("; "))}) \u2014 continuing anyway.
-  Ablo validates both credentials from the infrastructure that will use them and refuses
-  registration unless replication and direct DML are both ready.
-`
-    );
-  }
-  if (failures > 0) {
-    console.log(
-      `
-  ${import_picocolors7.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors7.default.dim("\u2014 direct registration requires both scoped roles. Fix the above, then re-run.")}
-`
-    );
-    process.exit(1);
-  }
-  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
-  let res;
-  try {
-    res = await fetch(registerEndpoint(apiUrl2), {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({
-        connection: "direct",
-        connectionString: dbUrl,
-        writeConnectionString: writeDbUrl,
-        route: args.route
-      })
-    });
-  } catch (err) {
-    console.error(import_picocolors7.default.red(`
-  Couldn't reach ${apiUrl2}: ${err instanceof Error ? err.message : String(err)}
-`));
-    process.exit(1);
-  }
-  if (res.ok) {
-    const body2 = await res.json().catch(() => ({}));
-    const statusNote = body2.status === "active" ? `${args.route}, active` : args.route;
-    console.log(
-      `
-  ${import_picocolors7.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors7.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors7.default.dim(`(${body2.id})`)}` : ""} as a direct DataSource (${statusNote}).
-  Customer COMMIT is durable acceptance; correlated WAL promotes queued writes to confirmed.
-`
-    );
-    process.exit(0);
-  }
-  const body = await res.json().catch(() => ({}));
-  const code = body.code ?? body.error?.code;
-  const message = body.message ?? body.error?.message ?? `HTTP ${res.status}`;
-  console.error(import_picocolors7.default.red(`
-  Registration failed: ${message}`));
-  if (code === "forbidden") {
-    console.error(import_picocolors7.default.dim(`  Registering a database needs a ${import_picocolors7.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors7.default.bold("ablo login")} for one.`));
-  } else if (code === "datasource_connection_unsupported") {
-    console.error(
-      import_picocolors7.default.dim(`  This deployment can\u2019t accept connection strings \u2014 use a self-hosted/hosted engine, or the signed endpoint fallback.`)
-    );
-  } else if (code === "database_not_replication_ready" || code === "data_source_blocked") {
-    for (const f of body.details?.failures ?? []) {
-      console.error(`  ${import_picocolors7.default.red("\u2717")} ${import_picocolors7.default.bold(f.item ?? "item")}${f.actual ? import_picocolors7.default.dim(` (${f.actual})`) : ""}`);
-      if (f.fix) for (const line of f.fix.split("\n")) console.error(`      ${import_picocolors7.default.red("\u2022")} ${line}`);
-    }
-    console.error(import_picocolors7.default.dim(`
-  Apply the fixes, verify with ${import_picocolors7.default.bold("ablo connect --check")}, then re-run.`));
-  } else if (code === "database_unreachable" || code === "source_unreachable") {
-    if (body.details?.reason) console.error(import_picocolors7.default.dim(`  ${body.details.reason}`));
-    console.error(
-      import_picocolors7.default.dim(
-        `  Ablo's servers must be able to reach this database \u2014 a localhost or private-network
-  Postgres can't use the direct path. Establish an allowlist, PrivateLink, peering, or VPN.
-  Only when no inbound route is possible, register the signed ${import_picocolors7.default.bold("dataSource()")} endpoint fallback.`
-      )
-    );
-  }
-  console.error();
-  process.exit(1);
-}
-async function runAuditInfra() {
-  const dbUrl = requireDatabaseUrl("--audit-infra");
-  const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
-  } });
-  let artifacts;
-  try {
-    artifacts = await auditTenantSyncInfra(sql);
-  } catch (err) {
-    const pg = err ?? {};
-    console.error(import_picocolors7.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
-    await sql.end({ timeout: 2 });
-    process.exit(1);
-  }
-  await sql.end({ timeout: 2 });
-  console.log(`
-  ${brand("ablo")} ${import_picocolors7.default.dim("connect --audit-infra")}  ${import_picocolors7.default.dim("Stage 5 tenant DB sync-infra audit")}
-`);
-  const present = artifacts.filter((a) => a.present);
-  if (present.length === 0) {
-    console.log(`  ${import_picocolors7.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
-`);
-    process.exit(0);
-  }
-  for (const artifact of present) {
-    const label = artifact.kind === "type" ? "type" : "relation";
-    console.log(`  ${import_picocolors7.default.yellow("!")} ${label} ${import_picocolors7.default.bold(`public.${artifact.name}`)} exists`);
-  }
-  console.log(
-    `
-  ${import_picocolors7.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors7.default.dim("\u2014 do not drop automatically. Confirm the org/environment is log-authoritative, then follow ") + import_picocolors7.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors7.default.dim(".\n")
-  );
-  process.exit(1);
-}
-async function connect(argv) {
-  let args;
-  try {
-    args = parseConnectArgs(argv);
-  } catch (err) {
-    console.error(import_picocolors7.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
-    process.exit(1);
-  }
-  if (args.apply) {
-    const { runConnectApply: runConnectApply2 } = await Promise.resolve().then(() => (init_connectApply(), connectApply_exports));
-    await runConnectApply2(args);
-    return;
-  }
-  if (args.check) {
-    await runCheck();
-    return;
-  }
-  if (args.register) {
-    await runRegister(args);
-    return;
-  }
-  if (args.auditInfra) {
-    await runAuditInfra();
-    return;
-  }
-  printConnectRecipe(args);
+  process.exit(outcome.exitCode);
 }
-var import_picocolors7, ABLO_PUBLICATION, ABLO_REPLICATION_ROLE, ABLO_WRITE_ROLE, DIRECT_DATA_SOURCE_ROUTES, SYNC_INFRA_RELATIONS, SYNC_INFRA_TYPES, CONNECT_USAGE;
-var init_connect = __esm({
-  "src/cli/connect.ts"() {
+var import_picocolors8;
+var init_connectApply = __esm({
+  "src/cli/connectApply.ts"() {
     "use strict";
     init_cjs_shims();
-    init_errors();
-    import_picocolors7 = __toESM(require_picocolors(), 1);
+    import_picocolors8 = __toESM(require_picocolors(), 1);
     init_src();
+    init_dist2();
+    init_connectSetup();
     init_dbRole();
     init_config();
     init_push();
     init_theme();
-    init_remoteValidation();
-    init_migrations();
-    ABLO_PUBLICATION = "ablo_publication";
-    ABLO_REPLICATION_ROLE = "ablo_replicator";
-    ABLO_WRITE_ROLE = "ablo_writer";
-    DIRECT_DATA_SOURCE_ROUTES = [
-      "public-allowlist",
-      "privatelink",
-      "peering",
-      "vpn"
-    ];
-    SYNC_INFRA_RELATIONS = [
-      "sync_deltas",
-      "sync_id_seq",
-      "sync_metadata",
-      "mutation_log"
-    ];
-    SYNC_INFRA_TYPES = [
-      "participant_kind",
-      "backfill_provenance",
-      "confirmation_state"
-    ];
-    CONNECT_USAGE = `  ablo connect \u2014 direct writes, settled by logical replication
-
-  Ablo applies coordinated DML with a scoped writer role. WAL observes what committed,
-  orders it with external changes, and confirms it. Your Postgres remains authoritative.
-
-  Usage:
-    npx ablo connect --apply              Set it up for you: create the roles, publish, verify
-    npx ablo connect                      Print the exact setup SQL instead of running it
-    npx ablo connect --tables a,b,c       Publish only these tables (default: all tables)
-    npx ablo connect --role <name>        Name the replication role (default: ablo_replicator)
-    npx ablo connect --write-role <name>  Name the DML role (default: ablo_writer)
-    npx ablo connect --route <route>      public-allowlist | privatelink | peering | vpn
-    npx ablo connect --check              Validate DATABASE_URL + ABLO_WRITE_DATABASE_URL
-    npx ablo connect --register           Register both scoped credentials as one direct DataSource
-    npx ablo connect --audit-infra        Read-only Stage 5 audit for deprecated Ablo sync tables/types
-
-  --apply also takes --yes (skip the confirm) and --show-sql (show the exact statements).`;
   }
 });
 
@@ -131336,7 +131062,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve7 = factory2.createUniqueName("resolve");
+          const resolve6 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -131345,7 +131071,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve7
+              resolve6
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -131362,7 +131088,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve7, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve6, reject]
               )
             )
           ]);
@@ -217971,8 +217697,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request2 = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve7, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve7, reject });
+          const promise = new Promise((resolve6, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve6, reject });
           });
           this.installer.send(request2);
           return promise;
@@ -218460,11 +218186,11 @@ var require_commonjs2 = __commonJS({
               if (pad) {
                 const need = width - c.length;
                 if (need > 0) {
-                  const z7 = new Array(need + 1).join("0");
+                  const z8 = new Array(need + 1).join("0");
                   if (i < 0) {
-                    c = "-" + z7 + c.slice(1);
+                    c = "-" + z8 + c.slice(1);
                   } else {
-                    c = z7 + c;
+                    c = z8 + c;
                   }
                 }
               }
@@ -220245,7 +219971,7 @@ var require_path_browserify = __commonJS({
     }
     var posix = {
       // path.resolve([from ...], to)
-      resolve: function resolve7() {
+      resolve: function resolve6() {
         var resolvedPath = "";
         var resolvedAbsolute = false;
         var cwd;
@@ -225145,41 +224871,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push2(value) {
-        var p2 = new Promise(function(resolve7, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve7(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function unshift(value) {
-        var p2 = new Promise(function(resolve7, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve7(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function drained() {
-        var p2 = new Promise(function(resolve7) {
+        var p2 = new Promise(function(resolve6) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve7();
+              resolve6();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve7();
+                resolve6();
                 queue.drain = previousDrain;
               };
             }
@@ -225676,9 +225402,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve7(stats) : reject(error);
+            return error === null ? resolve6(stats) : reject(error);
           });
         });
       }
@@ -225703,10 +225429,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve7(entries);
+              resolve6(entries);
             } else {
               reject(error);
             }
@@ -225716,10 +225442,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve7(entries));
+          stream.once("end", () => resolve6(entries));
         });
       }
     };
@@ -258625,12 +258351,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
     };
     var NodeRuntimeFileSystem = class {
       delete(path2) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rm(path2, { recursive: true }, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258649,12 +258375,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         }));
       }
       readFile(filePath, encoding = "utf-8") {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.readFile(filePath, encoding, (err, data) => {
             if (err)
               reject(err);
             else
-              resolve7(data);
+              resolve6(data);
           });
         });
       }
@@ -258662,12 +258388,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         return fs__namespace.readFileSync(filePath, encoding);
       }
       async writeFile(filePath, fileText) {
-        await new Promise((resolve7, reject) => {
+        await new Promise((resolve6, reject) => {
           fs__namespace.writeFile(filePath, fileText, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258681,12 +258407,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.mkdirSync(dirPath, { recursive: true });
       }
       move(srcPath, destPath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rename(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258694,12 +258420,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.renameSync(srcPath, destPath);
       }
       copy(srcPath, destPath) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.copyFile(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve7();
+              resolve6();
           });
         });
       }
@@ -258707,15 +258433,15 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.copyFileSync(srcPath, destPath);
       }
       stat(path2) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.stat(path2, (err, stat) => {
             if (err) {
               if (err.code === "ENOENT" || err.code === "ENOTDIR")
-                resolve7(void 0);
+                resolve6(void 0);
               else
                 reject(err);
             } else {
-              resolve7(stat);
+              resolve6(stat);
             }
           });
         });
@@ -282393,9 +282119,9 @@ Node text: ${this.#forgottenText}`;
 // src/cli/index.ts
 init_cjs_shims();
 init_dist2();
-var import_picocolors21 = __toESM(require_picocolors(), 1);
-var import_fs13 = require("fs");
-var import_path8 = require("path");
+var import_picocolors23 = __toESM(require_picocolors(), 1);
+var import_fs12 = require("fs");
+var import_path7 = require("path");
 var import_child_process3 = require("child_process");
 
 // src/cli/migrate.ts
@@ -282511,7 +282237,7 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [])
         if (pg.code === import_schema3.PG_LOCK_NOT_AVAILABLE && attempt < maxLockAttempts) {
           const backoffMs = (0, import_schema3.ddlLockRetryBackoffMs)(attempt);
           log.warn("schema change blocked by a lock; backing off and retrying", { targetSchema, attempt, backoffMs });
-          await new Promise((resolve7) => setTimeout(resolve7, backoffMs));
+          await new Promise((resolve6) => setTimeout(resolve6, backoffMs));
           continue;
         }
         throw err;
@@ -282581,16 +282307,747 @@ async function migrate(argv) {
   }
 }
 
+// src/cli/connect.ts
+init_cjs_shims();
+init_errors();
+var import_picocolors9 = __toESM(require_picocolors(), 1);
+init_src();
+init_dbRole();
+init_config();
+init_push();
+init_theme();
+
+// src/cli/remoteValidation.ts
+init_cjs_shims();
+var DIAL_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "CONNECT_TIMEOUT"
+]);
+function dialFailureReason(err) {
+  if (err === null || typeof err !== "object") return null;
+  const coded = err;
+  const code = typeof coded.code === "string" ? coded.code : null;
+  if (code && DIAL_FAILURE_CODES.has(code)) {
+    return typeof coded.message === "string" && coded.message.length > 0 ? coded.message : code;
+  }
+  if (Array.isArray(coded.errors)) {
+    for (const member of coded.errors) {
+      const reason = dialFailureReason(member);
+      if (reason) return reason;
+    }
+  }
+  return null;
+}
+function validateEndpoint(baseUrl2) {
+  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources/validate`;
+}
+function describeRemoteFailure(failure) {
+  switch (failure.item) {
+    case "wal_level":
+      return {
+        label: failure.actual ? `wal_level is ${failure.actual} (need logical)` : `wal_level must be logical`,
+        fix: failure.fix
+      };
+    case "publication":
+      return { label: "the Ablo publication does not exist", fix: failure.fix };
+    case "replication_role":
+      return { label: "the DATABASE_URL role lacks the REPLICATION attribute", fix: failure.fix };
+    case "replica_identity":
+      return {
+        label: `published tables cannot replicate UPDATE/DELETE${failure.actual ? ` (${failure.actual})` : ""}`,
+        fix: failure.fix
+      };
+    case "write_role":
+      return { label: "ABLO_WRITE_DATABASE_URL is not a scoped DML role", fix: failure.fix };
+    case "row_security":
+      return { label: "the direct-write role does not enforce row_security", fix: failure.fix };
+    case "schema_privileges":
+      return { label: "the direct-write role has unsafe schema privileges", fix: failure.fix };
+    case "idempotency_ledger":
+      return { label: "ablo_idempotency is missing or has unsafe grants", fix: failure.fix };
+    case "table_privileges":
+      return {
+        label: `the direct-write role lacks application DML${failure.actual ? ` (${failure.actual})` : ""}`,
+        fix: failure.fix
+      };
+    case "logical_marker":
+      return { label: "the direct-write role cannot emit the correlation marker", fix: failure.fix };
+    default:
+      return { label: failure.item, fix: failure.fix };
+  }
+}
+function parseWireFailures(value) {
+  if (!Array.isArray(value)) return [];
+  const failures = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object") continue;
+    const { item, actual, fix } = entry;
+    if (typeof item !== "string" || typeof fix !== "string") continue;
+    failures.push({ item, fix, ...typeof actual === "string" ? { actual } : {} });
+  }
+  return failures;
+}
+async function requestRemoteValidation(input) {
+  const doFetch = input.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await doFetch(validateEndpoint(input.apiUrl), {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${input.apiKey}` },
+      body: JSON.stringify({
+        ...input.connectionString ? { connectionString: input.connectionString } : {},
+        ...input.writeConnectionString ? { writeConnectionString: input.writeConnectionString } : {}
+      })
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      message: `couldn't reach ${input.apiUrl}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const code = typeof body.code === "string" ? body.code : body.error?.code;
+    const message = typeof body.message === "string" ? body.message : typeof body.error?.message === "string" ? body.error.message : `HTTP ${res.status}`;
+    return {
+      ok: false,
+      status: res.status,
+      message,
+      ...typeof code === "string" ? { code } : {}
+    };
+  }
+  const reachable = body.reachable === true;
+  return {
+    ok: true,
+    reachable,
+    ready: body.ready === true,
+    ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    failures: parseWireFailures(body.failures)
+  };
+}
+
+// src/cli/connect.ts
+init_connectSetup();
+function parseConnectArgs(argv) {
+  let check2 = false;
+  let register = false;
+  let apply2 = false;
+  let rotate = false;
+  let url;
+  let yes = false;
+  let showSql = false;
+  let scan = false;
+  let tables = [];
+  let role = ABLO_REPLICATION_ROLE;
+  let writeRole = ABLO_WRITE_ROLE;
+  let route = "public-allowlist";
+  let start = 0;
+  const lead = argv[0];
+  if (lead !== void 0 && !lead.startsWith("-")) {
+    switch (lead) {
+      case "register":
+        register = true;
+        break;
+      case "check":
+        check2 = true;
+        break;
+      case "apply":
+        apply2 = true;
+        break;
+      case "rotate":
+        rotate = true;
+        break;
+      case "scan":
+        scan = true;
+        break;
+      default:
+        throw new AbloValidationError(
+          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan)`,
+          { code: "cli_invalid_arguments" }
+        );
+    }
+    start = 1;
+  }
+  for (let i = start; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--url":
+        url = argv[++i] ?? url;
+        break;
+      case "--yes":
+      case "-y":
+        yes = true;
+        break;
+      case "--show-sql":
+        showSql = true;
+        break;
+      case "--tables": {
+        const value = argv[++i] ?? "";
+        tables = value.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+        break;
+      }
+      case "--role":
+        role = argv[++i] ?? role;
+        break;
+      case "--write-role":
+        writeRole = argv[++i] ?? writeRole;
+        break;
+      case "--route": {
+        const value = argv[++i] ?? "";
+        if (!DIRECT_DATA_SOURCE_ROUTES.includes(value)) {
+          throw new AbloValidationError(
+            `invalid direct route: ${value || "(missing)"} (expected ${DIRECT_DATA_SOURCE_ROUTES.join(", ")})`,
+            { code: "cli_invalid_arguments" }
+          );
+        }
+        route = value;
+        break;
+      }
+      default:
+        throw new AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+    }
+  }
+  if (role === writeRole) {
+    throw new AbloValidationError("replication and write roles must be different", {
+      code: "cli_invalid_arguments"
+    });
+  }
+  return {
+    check: check2,
+    register,
+    apply: apply2,
+    rotate,
+    url,
+    yes,
+    showSql,
+    scan,
+    tables,
+    role,
+    writeRole,
+    route
+  };
+}
+function printConnectRecipe(args) {
+  const sql = connectSetupSql({
+    tables: args.tables,
+    role: args.role,
+    writeRole: args.writeRole
+  });
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors9.default.dim("connect")}  ${import_picocolors9.default.dim("direct writes + WAL-settled sync")}
+`
+  );
+  console.log(
+    `  Ablo applies coordinated writes directly to your Postgres with a scoped DML role. WAL
+  observes what committed, orders it with external writes, and confirms it in the sync log.
+  Your database stays authoritative; Ablo never owns or migrates your application tables.
+
+  ${import_picocolors9.default.bold("ablo connect apply")} runs every step below for you from a one-time admin
+  connection and leaves your app holding only ${import_picocolors9.default.bold("ABLO_API_KEY")}. To do it by hand,
+  run this once against your Postgres ${import_picocolors9.default.dim("(as a superuser / DB owner)")}:
+`
+  );
+  console.log(
+    `  ${import_picocolors9.default.bold("1.")} Enable logical decoding ${import_picocolors9.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`
+  );
+  console.log(`       ${import_picocolors9.default.cyan(sql[0])}`);
+  console.log(
+    import_picocolors9.default.dim(
+      `       Managed hosts don't take ALTER SYSTEM: on Amazon RDS / Aurora set ${import_picocolors9.default.bold("rds.logical_replication = 1")}
+       in the parameter group and reboot; on Neon or Supabase enable logical replication in the
+       project settings. ${import_picocolors9.default.bold("ablo connect apply")} detects the host and does the right thing.`
+    )
+  );
+  console.log(`
+  ${import_picocolors9.default.bold("2.")} Publish the tables Ablo should read`);
+  console.log(`       ${import_picocolors9.default.cyan(sql[1])}`);
+  if (args.tables.length === 0) {
+    console.log(
+      import_picocolors9.default.dim(
+        `       (Scope it with ${import_picocolors9.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`
+      )
+    );
+  }
+  const writerStart = sql.findIndex((s) => s.includes("NOSUPERUSER NOBYPASSRLS"));
+  const replicationStatements = sql.slice(2, writerStart);
+  const writerStatements = sql.slice(writerStart);
+  console.log(
+    `
+  ${import_picocolors9.default.bold("3.")} Create the scoped replication role ${import_picocolors9.default.dim("(pick your own replication password)")}`
+  );
+  for (const statement of replicationStatements) {
+    for (const line of statement.split("\n")) console.log(`       ${import_picocolors9.default.cyan(line)}`);
+  }
+  console.log(
+    import_picocolors9.default.dim(
+      `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
+       ${import_picocolors9.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
+    )
+  );
+  console.log(
+    `
+  ${import_picocolors9.default.bold("4.")} Create the separate DML role and the idempotency ledger ` + import_picocolors9.default.dim("(pick your own write password)")
+  );
+  for (const statement of writerStatements) {
+    for (const line of statement.split("\n")) console.log(`       ${import_picocolors9.default.cyan(line)}`);
+  }
+  console.log(
+    import_picocolors9.default.dim(
+      `       The writer gets row DML + ledger access only. It has no REPLICATION, schema CREATE,
+       role administration, database creation, ownership, or customer-table DDL. Direct uses
+       ${import_picocolors9.default.bold("ablo_idempotency")} but no outbox; WAL carries the committed row changes.
+       Each ledger row carries an ${import_picocolors9.default.bold("expires_at")}; the writer can't DELETE (tamper-
+       resistance), so prune it from your own admin/cron when convenient:
+       ${import_picocolors9.default.bold("DELETE FROM ablo_idempotency WHERE expires_at < now();")}`
+    )
+  );
+  console.log(
+    `
+  ${import_picocolors9.default.bold("5.")} Register the two roles with Ablo. Set them just long enough to register \u2014
+     Ablo holds them from here, so your app keeps only ${import_picocolors9.default.bold("ABLO_API_KEY")}:
+       ${import_picocolors9.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors9.default.dim(`\u2192 ${args.role} (replication only)`)}
+       ${import_picocolors9.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors9.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
+       ${import_picocolors9.default.cyan("npx ablo connect register")}
+`
+  );
+  console.log(
+    `  ${import_picocolors9.default.bold("6.")} Verify readiness ${import_picocolors9.default.dim("(checked from Ablo\u2019s side \u2014 needs only ABLO_API_KEY):")}
+       ${import_picocolors9.default.cyan("npx ablo connect check")}
+`
+  );
+  console.log(
+    import_picocolors9.default.dim(
+      `  Reachable databases use this direct path. If no inbound route can be established, use the
+  signed ${import_picocolors9.default.bold("dataSource()")} endpoint fallback; its correlated events confirm writes
+  without an Ablo-side customer database socket.`
+    )
+  );
+  console.log();
+}
+var SYNC_INFRA_RELATIONS = [
+  "sync_deltas",
+  "sync_id_seq",
+  "sync_metadata",
+  "mutation_log"
+];
+var SYNC_INFRA_TYPES = ["participant_kind", "backfill_provenance", "confirmation_state"];
+function printCheckItem(item) {
+  if (item.ok) {
+    console.log(`  ${import_picocolors9.default.green("\u2713")} ${item.label}`);
+  } else {
+    console.log(`  ${import_picocolors9.default.red("\u2717")} ${item.label}`);
+    if (item.fix) {
+      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors9.default.red("\u2022")} ${line}`);
+    }
+  }
+}
+async function probeDirectWriteReadiness(sql, opts = {}) {
+  const schema = opts.schema ?? "public";
+  const publication = opts.publication ?? ABLO_PUBLICATION;
+  const items = [];
+  const roleRows = await sql.unsafe(
+    `SELECT rolname, rolsuper, rolbypassrls, rolcreatedb, rolcreaterole, rolreplication
+       FROM pg_roles WHERE rolname = current_user`
+  );
+  const role = roleRows[0];
+  const dangerous = Boolean(
+    !role || role.rolsuper || role.rolbypassrls || role.rolcreatedb || role.rolcreaterole || role.rolreplication
+  );
+  items.push(
+    dangerous ? {
+      ok: false,
+      label: `ABLO_WRITE_DATABASE_URL is not a scoped DML role`,
+      fix: `Use ${ABLO_WRITE_ROLE} from the setup recipe: NOSUPERUSER, NOBYPASSRLS, NOCREATEDB, NOCREATEROLE, NOREPLICATION.`
+    } : { ok: true, label: `write role ${import_picocolors9.default.bold(role?.rolname ?? ABLO_WRITE_ROLE)} is DML-only` }
+  );
+  const schemaRows = await sql.unsafe(
+    `SELECT
+       has_schema_privilege(current_user, $1, 'USAGE') AS usage,
+       has_schema_privilege(current_user, $1, 'CREATE') AS create,
+       current_setting('row_security') AS row_security`,
+    [schema]
+  );
+  const schemaRow = schemaRows[0];
+  items.push(
+    schemaRow?.usage && !schemaRow.create && schemaRow.row_security === "on" ? { ok: true, label: `writer uses ${schema} with row_security on and no schema CREATE` } : {
+      ok: false,
+      label: `writer schema/RLS privileges are not least-privilege`,
+      fix: `REVOKE CREATE ON SCHEMA ${quoteIdent(schema)} FROM PUBLIC; GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)}; ALTER ROLE ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)} SET row_security = on;`
+    }
+  );
+  const ledgerName = `${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")}`;
+  const ledgerRows = await sql.unsafe(
+    `SELECT
+       to_regclass($1) IS NOT NULL AS present,
+       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'SELECT,INSERT,UPDATE') END AS writes,
+       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'DELETE') END AS deletes`,
+    [ledgerName]
+  );
+  const ledger = ledgerRows[0];
+  items.push(
+    ledger?.present && ledger.writes && !ledger.deletes ? { ok: true, label: `${import_picocolors9.default.bold("ablo_idempotency")} is durable and protected from DELETE` } : {
+      ok: false,
+      label: `${import_picocolors9.default.bold("ablo_idempotency")} is missing or has unsafe grants`,
+      fix: `Apply the DML-role and idempotency-ledger statements printed by ${import_picocolors9.default.bold("ablo connect")}.`
+    }
+  );
+  const tableRows = await sql.unsafe(
+    `SELECT format('%I.%I', schemaname, tablename) AS relation
+       FROM pg_publication_tables
+      WHERE pubname = $1 AND schemaname = $2 AND tablename <> 'ablo_idempotency'
+        AND NOT has_table_privilege(
+          current_user,
+          format('%I.%I', schemaname, tablename),
+          'SELECT,INSERT,UPDATE,DELETE'
+        )`,
+    [publication, schema]
+  );
+  items.push(
+    tableRows.length === 0 ? { ok: true, label: `writer can apply DML to every published application table` } : {
+      ok: false,
+      label: `writer lacks DML on ${tableRows.length} published table${tableRows.length === 1 ? "" : "s"}`,
+      fix: `Grant SELECT, INSERT, UPDATE, DELETE on: ${tableRows.map((row) => row.relation).join(", ")}`
+    }
+  );
+  const rlsCoverageRows = await sql.unsafe(
+    `SELECT
+       count(*)::int AS total,
+       (count(*) FILTER (WHERE c.relrowsecurity))::int AS with_rls
+       FROM pg_publication_tables pt
+       JOIN pg_class c ON c.relname = pt.tablename
+       JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = pt.schemaname
+      WHERE pt.pubname = $1 AND pt.schemaname = $2 AND pt.tablename <> 'ablo_idempotency'`,
+    [publication, schema]
+  );
+  const coverage = rlsCoverageRows[0];
+  if (coverage && coverage.total > 0) {
+    const { total, with_rls: withRls } = coverage;
+    const plural = total === 1 ? "" : "s";
+    items.push(
+      withRls === total ? {
+        ok: true,
+        label: `row-level security governs the writer on all ${total} published table${plural}`
+      } : {
+        ok: true,
+        label: `row-level security governs the writer on ${withRls} of ${total} published tables \u2014 the other ${total - withRls} have no policies, so the writer's table grants alone bound it`
+      }
+    );
+  }
+  const ownerBypassRows = await sql.unsafe(
+    `SELECT format('%I.%I', n.nspname, c.relname) AS relation
+       FROM pg_publication_tables pt
+       JOIN pg_class c ON c.relname = pt.tablename
+       JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = pt.schemaname
+      WHERE pt.pubname = $1 AND pt.schemaname = $2 AND pt.tablename <> 'ablo_idempotency'
+        AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = current_user)
+        AND c.relrowsecurity = true
+        AND c.relforcerowsecurity = false`,
+    [publication, schema]
+  );
+  items.push(
+    ownerBypassRows.length === 0 ? {
+      ok: true,
+      label: `row-level security is enforced on the writer \u2014 it owns no published table that could bypass its own policies`
+    } : {
+      ok: false,
+      label: `writer owns ${ownerBypassRows.length} published table${ownerBypassRows.length === 1 ? "" : "s"} whose RLS is enabled but not forced \u2014 its policies are silently skipped`,
+      fix: `A table owner bypasses row-level security unless the table forces it. Reassign these tables to another owner, or force it: ${ownerBypassRows.map((r2) => `ALTER TABLE ${r2.relation} FORCE ROW LEVEL SECURITY;`).join(" ")}`
+    }
+  );
+  return items;
+}
+async function auditTenantSyncInfra(sql) {
+  const artifacts = [];
+  for (const name of SYNC_INFRA_RELATIONS) {
+    const rows = await sql.unsafe(`SELECT to_regclass($1)::text AS reg`, [
+      `public.${name}`
+    ]);
+    artifacts.push({ kind: "relation", name, present: rows[0]?.reg != null });
+  }
+  for (const name of SYNC_INFRA_TYPES) {
+    const rows = await sql.unsafe(`SELECT to_regtype($1)::text AS reg`, [
+      `public.${name}`
+    ]);
+    artifacts.push({ kind: "type", name, present: rows[0]?.reg != null });
+  }
+  return artifacts;
+}
+function requireScopedUrl(kind, verb) {
+  if (kind === "replication") {
+    const resolved = readProjectReplicationUrlWithSource();
+    if (resolved) return resolved.url;
+    console.error(
+      import_picocolors9.default.red("  No replication connection found (checked process env, .env.local, .env).") + import_picocolors9.default.dim(
+        ` Set ${import_picocolors9.default.bold("ABLO_REPLICATION_DATABASE_URL")} to the ${ABLO_REPLICATION_ROLE} connection printed by ${import_picocolors9.default.bold("ablo connect")}, then re-run ${import_picocolors9.default.bold(`ablo connect ${verb}`)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const dbUrl = readProjectWriteDatabaseUrl();
+  if (dbUrl) return dbUrl;
+  console.error(
+    import_picocolors9.default.red("  No ABLO_WRITE_DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors9.default.dim(
+      ` Set it to the ${ABLO_WRITE_ROLE} connection printed by ${import_picocolors9.default.bold("ablo connect")}, then re-run ${import_picocolors9.default.bold(`ablo connect ${verb}`)}. The replication credential is never reused for DML.`
+    )
+  );
+  process.exit(1);
+}
+async function probeAndReport(dbUrl, kind = "replication") {
+  const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
+  } });
+  let items;
+  try {
+    items = kind === "replication" ? await probeReadiness(sql) : await probeDirectWriteReadiness(sql);
+  } catch (err) {
+    await sql.end({ timeout: 2 }).catch(() => void 0);
+    const dial = dialFailureReason(err);
+    if (dial) return { kind: "no-dial", reason: dial };
+    const pg = err ?? {};
+    console.error(import_picocolors9.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
+    process.exit(1);
+  }
+  await sql.end({ timeout: 2 });
+  for (const item of items) printCheckItem(item);
+  return { kind: "probed", failures: items.filter((i) => !i.ok).length };
+}
+async function runCheck() {
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors9.default.dim("connect check")}  ${import_picocolors9.default.dim("direct-write + WAL readiness")}
+`
+  );
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors9.default.red("  No API key found.") + import_picocolors9.default.dim(
+        ` Run ${import_picocolors9.default.bold("ablo login")} (or set ${import_picocolors9.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors9.default.bold("ablo connect check")}.`
+      )
+    );
+    process.exit(1);
+  }
+  const apiUrl2 = apiBaseUrl();
+  const result = await requestRemoteValidation({ apiUrl: apiUrl2, apiKey });
+  if (!result.ok) {
+    if (result.code === "no_data_source_registered") {
+      console.error(
+        `  ${import_picocolors9.default.yellow("\u2014")} No database is connected to this plane yet, so there's nothing to check.
+` + import_picocolors9.default.dim(
+          `  Connect one with ${import_picocolors9.default.bold("ablo connect apply")}, then re-run ${import_picocolors9.default.bold("ablo connect check")}.
+`
+        )
+      );
+      process.exit(1);
+    }
+    console.error(import_picocolors9.default.red(`  The check failed: ${result.message}`));
+    if (result.code === "forbidden") {
+      console.error(
+        import_picocolors9.default.dim(
+          `  Checking a connected database needs a ${import_picocolors9.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors9.default.bold("ablo login")} for one.`
+        )
+      );
+    }
+    console.error();
+    process.exit(1);
+  }
+  if (!result.reachable) {
+    console.error(
+      `  ${import_picocolors9.default.red("\u2717")} Ablo's infrastructure can't reach your database${result.reason ? ` ${import_picocolors9.default.dim(`(${result.reason})`)}` : ""}.`
+    );
+    console.error(
+      import_picocolors9.default.dim(
+        `  Direct needs a route Ablo's servers can dial \u2014 public allowlist, PrivateLink, peering,
+  or VPN. Only when no inbound route can exist, use the signed ${import_picocolors9.default.bold("dataSource()")} endpoint fallback.
+`
+      )
+    );
+    process.exit(1);
+  }
+  for (const failure of result.failures) {
+    const { label, fix } = describeRemoteFailure(failure);
+    printCheckItem({ ok: false, label, fix });
+  }
+  console.log();
+  if (result.ready) {
+    console.log(
+      `  ${import_picocolors9.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Ablo can apply scoped DML and settle it from WAL.
+`
+    );
+    process.exit(0);
+  }
+  const count = result.failures.length;
+  console.log(
+    `  ${import_picocolors9.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors9.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors9.default.bold("ablo connect check")}.`)}
+`
+  );
+  process.exit(1);
+}
+async function runRegister(args) {
+  const dbUrl = requireScopedUrl("replication", "register");
+  const writeDbUrl = requireScopedUrl("write", "register");
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors9.default.red("  Not logged in.") + import_picocolors9.default.dim(
+        ` Run ${import_picocolors9.default.bold("ablo login")} (or set ${import_picocolors9.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
+      )
+    );
+    process.exit(1);
+  }
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors9.default.dim("connect register")}  ${import_picocolors9.default.dim("register a direct DataSource")}
+`
+  );
+  console.log(`  ${import_picocolors9.default.bold("Replication role")}
+`);
+  const replication = await probeAndReport(dbUrl, "replication");
+  console.log(`
+  ${import_picocolors9.default.bold("Direct-write role")}
+`);
+  const write = await probeAndReport(writeDbUrl, "write");
+  const noDial = [
+    replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
+    write.kind === "no-dial" ? `write: ${write.reason}` : null
+  ].filter((reason) => reason !== null);
+  const failures = (replication.kind === "probed" ? replication.failures : 0) + (write.kind === "probed" ? write.failures : 0);
+  if (noDial.length > 0) {
+    console.log(
+      `  This machine can't reach one or both scoped connections (${import_picocolors9.default.dim(noDial.join("; "))}) \u2014 continuing anyway.
+  Ablo validates both credentials from the infrastructure that will use them and refuses
+  registration unless replication and direct DML are both ready.
+`
+    );
+  }
+  if (failures > 0) {
+    console.log(
+      `
+  ${import_picocolors9.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors9.default.dim("\u2014 direct registration requires both scoped roles. Fix the above, then re-run.")}
+`
+    );
+    process.exit(1);
+  }
+  const apiUrl2 = apiBaseUrl();
+  const registered = await registerDirectDataSource({
+    apiUrl: apiUrl2,
+    apiKey,
+    replicationUrl: dbUrl,
+    writeUrl: writeDbUrl,
+    route: args.route
+  });
+  process.exit(registered ? 0 : 1);
+}
+async function runScan() {
+  const dbUrl = requireScopedUrl("replication", "scan");
+  const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
+  } });
+  let artifacts;
+  try {
+    artifacts = await auditTenantSyncInfra(sql);
+  } catch (err) {
+    const pg = err ?? {};
+    console.error(import_picocolors9.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
+    await sql.end({ timeout: 2 });
+    process.exit(1);
+  }
+  await sql.end({ timeout: 2 });
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors9.default.dim("connect scan")}  ${import_picocolors9.default.dim("audit for leftover Ablo sync infrastructure")}
+`
+  );
+  const present = artifacts.filter((a) => a.present);
+  if (present.length === 0) {
+    console.log(`  ${import_picocolors9.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
+`);
+    process.exit(0);
+  }
+  for (const artifact of present) {
+    const label = artifact.kind === "type" ? "type" : "relation";
+    console.log(`  ${import_picocolors9.default.yellow("!")} ${label} ${import_picocolors9.default.bold(`public.${artifact.name}`)} exists`);
+  }
+  console.log(
+    `
+  ${import_picocolors9.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors9.default.dim(
+      "\u2014 do not drop automatically. Confirm the org/environment is log-authoritative, then follow "
+    ) + import_picocolors9.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors9.default.dim(".\n")
+  );
+  process.exit(1);
+}
+async function connect(argv) {
+  if (argv[0] === "deregister") {
+    const { disconnect: disconnect2 } = await Promise.resolve().then(() => (init_disconnect(), disconnect_exports));
+    await disconnect2(argv.slice(1));
+    return;
+  }
+  let args;
+  try {
+    args = parseConnectArgs(argv);
+  } catch (err) {
+    console.error(import_picocolors9.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+  if (args.apply || args.rotate) {
+    const { runConnectApply: runConnectApply2 } = await Promise.resolve().then(() => (init_connectApply(), connectApply_exports));
+    await runConnectApply2(args);
+    return;
+  }
+  if (args.check) {
+    await runCheck();
+    return;
+  }
+  if (args.register) {
+    await runRegister(args);
+    return;
+  }
+  if (args.scan) {
+    await runScan();
+    return;
+  }
+  printConnectRecipe(args);
+}
+var CONNECT_USAGE = `  ablo connect \u2014 direct writes, settled by logical replication
+
+  Ablo applies coordinated DML with a scoped writer role. WAL observes what committed,
+  orders it with external changes, and confirms it. Your Postgres remains authoritative.
+
+  Usage:
+    npx ablo connect                      Print the exact setup SQL instead of running it
+    npx ablo connect apply                Set it up end to end: create the roles, publish, register
+    npx ablo connect register             Register both scoped credentials as one direct DataSource (hand-run-SQL path)
+    npx ablo connect deregister           Remove this project's data source \u2014 Ablo stops reading/writing it
+    npx ablo connect check                Verify the connected database from Ablo's side (needs only ABLO_API_KEY)
+    npx ablo connect rotate               New passwords for both scoped roles, then re-register
+    npx ablo connect scan                 Read-only audit for leftover Ablo sync tables/types (never drops)
+
+  Modifiers:
+    --url <admin-conn>   Admin connection for apply/rotate (else DATABASE_URL)
+    --tables a,b,c       Publish only these tables (default: all tables)
+    --role <name>        Name the replication role (default: ablo_replicator)
+    --write-role <name>  Name the DML role (default: ablo_writer)
+    --route <route>      public-allowlist | privatelink | peering | vpn
+    --yes                Skip the apply confirmation (non-interactive)
+    --show-sql           Show the exact statements in the apply plan
+
+  apply registers with Ablo directly; the admin credential is used only on this
+  machine and never persisted. Your app holds only ABLO_API_KEY.`;
+
 // src/cli/index.ts
-init_connect();
 init_push();
 
 // src/cli/generate.ts
 init_cjs_shims();
 init_errors();
-var import_fs7 = require("fs");
-var import_path5 = require("path");
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_fs6 = require("fs");
+var import_path4 = require("path");
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 var import_schema4 = require("@abloatai/ablo/schema");
 init_push();
 var DEFAULT_SCHEMA_PATH3 = "ablo/schema.ts";
@@ -282623,7 +283080,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors8.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -282632,23 +283089,23 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema4.serializeSchema)(schema));
     source = (0, import_schema4.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors8.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  const abs = (0, import_path5.resolve)(process.cwd(), args.out);
-  (0, import_fs7.mkdirSync)((0, import_path5.dirname)(abs), { recursive: true });
-  (0, import_fs7.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors8.default.green("\u2713")} Generated types \u2192 ${import_picocolors8.default.bold(args.out)}`);
+  const abs = (0, import_path4.resolve)(process.cwd(), args.out);
+  (0, import_fs6.mkdirSync)((0, import_path4.dirname)(abs), { recursive: true });
+  (0, import_fs6.writeFileSync)(abs, source);
+  console.log(`  ${import_picocolors10.default.green("\u2713")} Generated types \u2192 ${import_picocolors10.default.bold(args.out)}`);
 }
 
 // src/cli/dev.ts
 init_cjs_shims();
 init_errors();
 init_credentialPolicy();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 init_dist2();
-var import_fs8 = require("fs");
-var import_path6 = require("path");
+var import_fs7 = require("fs");
+var import_path5 = require("path");
 var import_schema5 = require("@abloatai/ablo/schema");
 init_push();
 init_config();
@@ -282687,62 +283144,62 @@ function classifyKey(apiKey, activeMode) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors9.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors9.default.bold("ABLO_API_KEY")} (${import_picocolors9.default.bold("sk_test_")} = sandbox; ${import_picocolors9.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors9.default.dim(`Mode is currently '${activeMode}'.`)
+      reason: `No API key. Run ${import_picocolors11.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors11.default.bold("ABLO_API_KEY")} (${import_picocolors11.default.bold("sk_test_")} = sandbox; ${import_picocolors11.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors11.default.dim(`Mode is currently '${activeMode}'.`)
     };
   }
   if (apiKey.startsWith("sk_test_")) return { ok: true };
   if (apiKey.startsWith("sk_live_")) {
     return {
       ok: false,
-      reason: `Production schema deploys run one-shot: ${import_picocolors9.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors9.default.bold("ablo mode production")}). ${import_picocolors9.default.bold("--watch")} is sandbox-only.`
+      reason: `Production schema deploys run one-shot: ${import_picocolors11.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors11.default.bold("ablo mode production")}). ${import_picocolors11.default.bold("--watch")} is sandbox-only.`
     };
   }
   if (classifyCredentialKind(apiKey) === "restricted") {
     return {
       ok: false,
-      reason: `Restricted (${import_picocolors9.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors9.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors9.default.bold("sk_live_")} with ${import_picocolors9.default.bold("npx ablo push")} for a production deploy.`
+      reason: `Restricted (${import_picocolors11.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors11.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors11.default.bold("sk_live_")} with ${import_picocolors11.default.bold("npx ablo push")} for a production deploy.`
     };
   }
   return {
     ok: false,
-    reason: `${import_picocolors9.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors9.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors9.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors9.default.bold("npx ablo push")}).`
+    reason: `${import_picocolors11.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors11.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors11.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors11.default.bold("npx ablo push")}).`
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
-  const envPath = (0, import_path6.resolve)(cwd, ".env.local");
+  const envPath = (0, import_path5.resolve)(cwd, ".env.local");
   const line = `ABLO_API_KEY=${apiKey}`;
   let action;
-  if (!(0, import_fs8.existsSync)(envPath)) {
-    (0, import_fs8.writeFileSync)(envPath, `${line}
+  if (!(0, import_fs7.existsSync)(envPath)) {
+    (0, import_fs7.writeFileSync)(envPath, `${line}
 `, { mode: 384 });
-    action = `Created ${import_picocolors9.default.bold(".env.local")} with ${import_picocolors9.default.bold("ABLO_API_KEY")}`;
+    action = `Created ${import_picocolors11.default.bold(".env.local")} with ${import_picocolors11.default.bold("ABLO_API_KEY")}`;
   } else {
-    const content = (0, import_fs8.readFileSync)(envPath, "utf8");
+    const content = (0, import_fs7.readFileSync)(envPath, "utf8");
     const match = /^ABLO_API_KEY=(.*)$/m.exec(content);
     const existing = match?.[1] ?? "";
     if (!match) {
-      (0, import_fs8.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
+      (0, import_fs7.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
 `);
-      action = `Added ${import_picocolors9.default.bold("ABLO_API_KEY")} to ${import_picocolors9.default.bold(".env.local")}`;
+      action = `Added ${import_picocolors11.default.bold("ABLO_API_KEY")} to ${import_picocolors11.default.bold(".env.local")}`;
     } else if (existing === apiKey) {
-      action = `${import_picocolors9.default.bold(".env.local")} already has this key`;
+      action = `${import_picocolors11.default.bold(".env.local")} already has this key`;
     } else {
-      (0, import_fs8.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
-      action = `Updated ${import_picocolors9.default.bold("ABLO_API_KEY")} in ${import_picocolors9.default.bold(".env.local")} ${import_picocolors9.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
+      (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
+      action = `Updated ${import_picocolors11.default.bold("ABLO_API_KEY")} in ${import_picocolors11.default.bold(".env.local")} ${import_picocolors11.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
   }
-  const gitignorePath = (0, import_path6.resolve)(cwd, ".gitignore");
-  const gitignore = (0, import_fs8.existsSync)(gitignorePath) ? (0, import_fs8.readFileSync)(gitignorePath, "utf8") : "";
+  const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
+  const gitignore = (0, import_fs7.existsSync)(gitignorePath) ? (0, import_fs7.readFileSync)(gitignorePath, "utf8") : "";
   const ignored = /^(\.env\.local|\.env\*|\.env\.\*|\.env.*)$/m.test(gitignore);
   let gitignoreNote = "";
   if (!ignored) {
-    (0, import_fs8.writeFileSync)(
+    (0, import_fs7.writeFileSync)(
       gitignorePath,
       `${gitignore.endsWith("\n") || gitignore.length === 0 ? gitignore : `${gitignore}
 `}.env.local
 `
     );
-    gitignoreNote = ` Added ${import_picocolors9.default.bold(".env.local")} to ${import_picocolors9.default.bold(".gitignore")} so the key can't be committed.`;
+    gitignoreNote = ` Added ${import_picocolors11.default.bold(".env.local")} to ${import_picocolors11.default.bold(".gitignore")} so the key can't be committed.`;
   }
   return `${action}.${gitignoreNote}`;
 }
@@ -282757,7 +283214,7 @@ async function runPush(schema, args) {
   if (ok) {
     return {
       ok: true,
-      message: body.unchanged ? `schema unchanged ${import_picocolors9.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors9.default.dim(`(v${body.version}, hash ${body.hash})`)}`
+      message: body.unchanged ? `schema unchanged ${import_picocolors11.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors11.default.dim(`(v${body.version}, hash ${body.hash})`)}`
     };
   }
   if (status2 === 409) {
@@ -282767,33 +283224,33 @@ async function runPush(schema, args) {
       (s) => s.shadowed != null
     );
     const lines = [
-      import_picocolors9.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
+      import_picocolors11.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
       "",
-      ...unexecutable.map((u2) => import_picocolors9.default.red(fmtSignal(u2))),
-      ...warnings.map((w2) => import_picocolors9.default.yellow(fmtSignal(w2))),
+      ...unexecutable.map((u2) => import_picocolors11.default.red(fmtSignal(u2))),
+      ...warnings.map((w2) => import_picocolors11.default.yellow(fmtSignal(w2))),
       "",
       ...hasShadowed ? [
-        import_picocolors9.default.dim(
+        import_picocolors11.default.dim(
           "  These models exist in the baseline above but not in your push. Sandbox readers"
         ),
-        import_picocolors9.default.dim(
+        import_picocolors11.default.dim(
           "  fall back to the production schema until you push your own, so applying this drops them."
         ),
         ""
       ] : [],
-      import_picocolors9.default.dim(
-        `  Fix: ${import_picocolors9.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors9.default.bold("--rename old:new")} if you renamed a model.`
+      import_picocolors11.default.dim(
+        `  Fix: ${import_picocolors11.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors11.default.bold("--rename old:new")} if you renamed a model.`
       )
     ];
     return { ok: false, message: lines.join("\n") };
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors9.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors9.default.bold("sandbox")} key with ${import_picocolors9.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors9.default.cyan("https://abloatai.com")}.`;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors11.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors11.default.bold("sandbox")} key with ${import_picocolors11.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors11.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
-` + import_picocolors9.default.dim(hint)
+` + import_picocolors11.default.dim(hint)
     };
   }
   return { ok: false, message: `Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}` };
@@ -282803,25 +283260,25 @@ async function dev(argv) {
   try {
     args = parseDevArgs(argv);
   } catch (err) {
-    console.error(import_picocolors9.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors11.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.apiKey) args.apiKey = resolveEffectiveApiKey("sandbox").key;
   const key = classifyKey(args.apiKey, getMode());
   if (!key.ok) {
-    console.error(import_picocolors9.default.red(`  ${key.reason}`));
+    console.error(import_picocolors11.default.red(`  ${key.reason}`));
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors9.default.dim("push")} ${import_picocolors9.default.dim("(sandbox)")}
+  ${brand("ablo")} ${import_picocolors11.default.dim("push")} ${import_picocolors11.default.dim("(sandbox)")}
 `);
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors9.default.dim("schema")}  ${import_picocolors9.default.bold(args.schemaPath)} ${import_picocolors9.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
+    `  ${import_picocolors11.default.dim("schema")}  ${import_picocolors11.default.bold(args.schemaPath)} ${import_picocolors11.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
   );
-  console.log(`  ${import_picocolors9.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
-  console.log(`  ${import_picocolors9.default.dim("api")}     ${args.url}
+  console.log(`  ${import_picocolors11.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
+  console.log(`  ${import_picocolors11.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
   s.start("Pushing schema definition (sandbox)");
@@ -282830,20 +283287,20 @@ async function dev(argv) {
   if (!first.ok) process.exit(1);
   if (process.env.ABLO_API_KEY) {
     console.log(`
-  ${import_picocolors9.default.green("\u2713")} ${import_picocolors9.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
+  ${import_picocolors11.default.green("\u2713")} ${import_picocolors11.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
   } else {
     console.log(`
-  ${import_picocolors9.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
-    console.log(`  ${import_picocolors9.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
+  ${import_picocolors11.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
+    console.log(`  ${import_picocolors11.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
   console.log(`  Your app is wired for the sandbox.`);
   if (!args.watch) return;
-  const abs = (0, import_path6.resolve)(process.cwd(), args.schemaPath);
-  console.log(`  ${import_picocolors9.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
+  const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
+  console.log(`  ${import_picocolors11.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
 `);
   let timer2 = null;
   let pushing = false;
-  const watcher = (0, import_fs8.watch)(abs, () => {
+  const watcher = (0, import_fs7.watch)(abs, () => {
     if (timer2) clearTimeout(timer2);
     timer2 = setTimeout(() => {
       void rePush();
@@ -282859,7 +283316,7 @@ async function dev(argv) {
       const r2 = await runPush(next, args);
       s2.stop(r2.message, r2.ok ? 0 : 1);
     } catch (err) {
-      s2.stop(import_picocolors9.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
+      s2.stop(import_picocolors11.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
     } finally {
       pushing = false;
     }
@@ -282867,7 +283324,7 @@ async function dev(argv) {
   const stop = () => {
     watcher.close();
     console.log(`
-  ${import_picocolors9.default.dim("stopped.")}`);
+  ${import_picocolors11.default.dim("stopped.")}`);
     process.exit(0);
   };
   process.on("SIGINT", stop);
@@ -282879,7 +283336,7 @@ async function dev(argv) {
 // src/cli/login.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 init_dist2();
 init_config();
 init_theme();
@@ -282940,9 +283397,9 @@ async function deviceLogin(argv, deps = {}) {
   const code = await codeRes.json();
   const approvePath = `/cli?user_code=${code.user_code}`;
   const url = account === "signup" ? `${DASHBOARD_URL}/signup?next=${encodeURIComponent(approvePath)}` : `${DASHBOARD_URL}${approvePath}`;
-  Me(`${import_picocolors10.default.bold(code.user_code)}
+  Me(`${import_picocolors12.default.bold(code.user_code)}
 
-${import_picocolors10.default.dim(url)}`, "Approve in your browser");
+${import_picocolors12.default.dim(url)}`, "Approve in your browser");
   openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -283009,7 +283466,7 @@ ${import_picocolors10.default.dim(url)}`, "Approve in your browser");
     if (reason) M2.error(reason);
     else if (provRes) M2.error(`Key provisioning returned ${provRes.status} from ${DASHBOARD_URL}/api/cli/provision-key.`);
     M2.error(
-      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors10.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors10.default.bold("ABLO_API_KEY")}.`
+      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors12.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors12.default.bold("ABLO_API_KEY")}.`
     );
     process.exit(1);
   }
@@ -283029,9 +283486,9 @@ ${import_picocolors10.default.dim(url)}`, "Approve in your browser");
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
   s.stop(`Saved keys to ${path}`);
-  const where = prov.project ? ` ${import_picocolors10.default.dim(`(project ${prov.project.slug})`)}` : "";
+  const where = prov.project ? ` ${import_picocolors12.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
-    `${import_picocolors10.default.green("\u2713")} Logged in ${import_picocolors10.default.dim("(sandbox)")}${where}. Run ${import_picocolors10.default.bold("npx ablo push")} to push your schema.`
+    `${import_picocolors12.default.green("\u2713")} Logged in ${import_picocolors12.default.dim("(sandbox)")}${where}. Run ${import_picocolors12.default.bold("npx ablo push")} to push your schema.`
   );
 }
 async function login(argv = [], deps = {}) {
@@ -283040,13 +283497,13 @@ async function login(argv = [], deps = {}) {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors10.default.green("\u2713")} Logged out ${import_picocolors10.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors12.default.green("\u2713")} Logged out ${import_picocolors12.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors10.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors12.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_API_KEY) {
     console.log(
-      import_picocolors10.default.dim(`  Note: ${import_picocolors10.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
+      import_picocolors12.default.dim(`  Note: ${import_picocolors12.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
     );
   }
 }
@@ -283056,7 +283513,7 @@ init_config();
 
 // src/cli/mode.ts
 init_cjs_shims();
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 init_dist2();
 init_config();
 var PREFIX = { sandbox: "sk_test_", production: "rk_live_" };
@@ -283068,10 +283525,10 @@ function hintFor(m2, current) {
 }
 function apply(m2) {
   setMode(m2);
-  console.log(`  ${import_picocolors11.default.green("\u2713")} now in ${import_picocolors11.default.bold(m2)}`);
+  console.log(`  ${import_picocolors13.default.green("\u2713")} now in ${import_picocolors13.default.bold(m2)}`);
   if (!getKeyEntry(m2)) {
     console.log(
-      import_picocolors11.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors11.default.bold("ablo login")} or ${import_picocolors11.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
+      import_picocolors13.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors13.default.bold("ablo login")} or ${import_picocolors13.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
     );
   }
 }
@@ -283084,14 +283541,14 @@ async function mode(argv) {
   }
   if (arg) {
     console.error(
-      import_picocolors11.default.red(`  unknown mode: ${arg}`) + import_picocolors11.default.dim(` (expected ${import_picocolors11.default.bold("sandbox")} or ${import_picocolors11.default.bold("production")})`)
+      import_picocolors13.default.red(`  unknown mode: ${arg}`) + import_picocolors13.default.dim(` (expected ${import_picocolors13.default.bold("sandbox")} or ${import_picocolors13.default.bold("production")})`)
     );
     process.exit(1);
   }
   const current = getMode();
   if (!process.stdin.isTTY || process.env.CI) {
     console.error(
-      import_picocolors11.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors11.default.bold("ablo mode sandbox") + import_picocolors11.default.dim(" | ") + import_picocolors11.default.bold("ablo mode production") + import_picocolors11.default.dim(`  (current: ${current})`)
+      import_picocolors13.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors13.default.bold("ablo mode sandbox") + import_picocolors13.default.dim(" | ") + import_picocolors13.default.bold("ablo mode production") + import_picocolors13.default.dim(`  (current: ${current})`)
     );
     process.exit(1);
   }
@@ -283115,7 +283572,7 @@ init_projects();
 
 // src/cli/status.ts
 init_cjs_shims();
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 init_config();
 init_target();
 init_theme();
@@ -283123,9 +283580,9 @@ init_push();
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
   if (Number.isNaN(ms)) return "";
-  if (ms <= 0) return import_picocolors12.default.red("expired");
+  if (ms <= 0) return import_picocolors14.default.red("expired");
   const days = Math.floor(ms / (24 * 60 * 60 * 1e3));
-  return import_picocolors12.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
+  return import_picocolors14.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
 }
 async function ping(apiUrl2) {
   const ctrl = new AbortController();
@@ -283209,31 +283666,31 @@ function formatConflict(conflict) {
 function printTargetLines(target, localProject) {
   const confirmed = target?.confirmed ?? null;
   if (confirmed?.organizationId) {
-    console.log(`  ${import_picocolors12.default.dim("org")}     ${import_picocolors12.default.dim(confirmed.organizationId)}`);
+    console.log(`  ${import_picocolors14.default.dim("org")}     ${import_picocolors14.default.dim(confirmed.organizationId)}`);
   }
   let projectLine;
   if (confirmed?.project) {
     const p2 = confirmed.project;
-    projectLine = p2.isDefault ? `${import_picocolors12.default.bold("default")} ${import_picocolors12.default.dim("(org-default)")}` : `${import_picocolors12.default.bold(p2.slug)} ${import_picocolors12.default.dim(`(${p2.id})`)}`;
+    projectLine = p2.isDefault ? `${import_picocolors14.default.bold("default")} ${import_picocolors14.default.dim("(org-default)")}` : `${import_picocolors14.default.bold(p2.slug)} ${import_picocolors14.default.dim(`(${p2.id})`)}`;
   } else if (confirmed) {
-    projectLine = `${import_picocolors12.default.bold("default")} ${import_picocolors12.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors14.default.bold("default")} ${import_picocolors14.default.dim("(org-default)")}`;
   } else if (localProject) {
-    projectLine = `${import_picocolors12.default.bold(localProject.slug)} ${import_picocolors12.default.dim(`(${localProject.id})`)} ${import_picocolors12.default.yellow("(unconfirmed)")}`;
+    projectLine = `${import_picocolors14.default.bold(localProject.slug)} ${import_picocolors14.default.dim(`(${localProject.id})`)} ${import_picocolors14.default.yellow("(unconfirmed)")}`;
   } else {
-    projectLine = `${import_picocolors12.default.bold("default")} ${target ? import_picocolors12.default.yellow("(unconfirmed)") : import_picocolors12.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors14.default.bold("default")} ${target ? import_picocolors14.default.yellow("(unconfirmed)") : import_picocolors14.default.dim("(org-default)")}`;
   }
-  console.log(`  ${import_picocolors12.default.dim("project")} ${projectLine}`);
+  console.log(`  ${import_picocolors14.default.dim("project")} ${projectLine}`);
   const env = confirmed?.environment ?? target?.keyEnv ?? null;
   if (env) {
-    const suffix = confirmed ? "" : ` ${import_picocolors12.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors12.default.dim("env")}     ${import_picocolors12.default.bold(env)}${suffix}`);
+    const suffix = confirmed ? "" : ` ${import_picocolors14.default.yellow("(unconfirmed)")}`;
+    console.log(`  ${import_picocolors14.default.dim("env")}     ${import_picocolors14.default.bold(env)}${suffix}`);
   }
   for (const m2 of target?.mismatches ?? []) {
-    console.log(`  ${import_picocolors12.default.yellow("\u26A0")} ${import_picocolors12.default.yellow(describeMismatch(m2))}`);
+    console.log(`  ${import_picocolors14.default.yellow("\u26A0")} ${import_picocolors14.default.yellow(describeMismatch(m2))}`);
   }
 }
 async function status(args = []) {
-  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const apiUrl2 = apiBaseUrl();
   const cfg = readConfig();
   const mode2 = getMode();
   const effective = resolveEffectiveApiKey();
@@ -283300,80 +283757,80 @@ async function status(args = []) {
     return;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors12.default.dim("status")}
+  ${brand("ablo")} ${import_picocolors14.default.dim("status")}
 `);
   if (effective.key && effective.source && effective.source !== "stored") {
     const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
     console.log(
-      `  ${import_picocolors12.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors12.default.dim(`(${label} \u2014 overrides stored)`)}`
+      `  ${import_picocolors14.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors14.default.dim(`(${label} \u2014 overrides stored)`)}`
     );
   } else if (!cfg) {
-    console.log(`  ${import_picocolors12.default.yellow("!")} Not logged in \u2014 run ${import_picocolors12.default.bold("ablo login")}.`);
+    console.log(`  ${import_picocolors14.default.yellow("!")} Not logged in \u2014 run ${import_picocolors14.default.bold("ablo login")}.`);
   }
-  console.log(`  ${import_picocolors12.default.dim("mode")}    ${import_picocolors12.default.bold(mode2)}`);
+  console.log(`  ${import_picocolors14.default.dim("mode")}    ${import_picocolors14.default.bold(mode2)}`);
   const activeEntry = getKeyEntry(mode2);
   const key = describeEffectiveKey(mode2, process.env.ABLO_API_KEY, activeEntry);
   if (key.keyMismatch) {
-    console.log(`  ${import_picocolors12.default.yellow("!")} ${import_picocolors12.default.yellow(key.keyMismatch.message)}`);
+    console.log(`  ${import_picocolors14.default.yellow("!")} ${import_picocolors14.default.yellow(key.keyMismatch.message)}`);
   }
   const activeProject = getActiveProject();
   printTargetLines(target, activeProject);
   for (const m2 of ["sandbox", "production"]) {
     const entry = getKeyEntry(m2);
-    const marker = m2 === mode2 ? import_picocolors12.default.green("\u25CF") : import_picocolors12.default.dim("\u25CB");
+    const marker = m2 === mode2 ? import_picocolors14.default.green("\u25CF") : import_picocolors14.default.dim("\u25CB");
     if (entry) {
       const exp = entry.expiresAt ? ` ${expiryLabel(entry.expiresAt)}` : "";
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors12.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors14.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
     } else {
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors12.default.dim("\u2014 no key")}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors14.default.dim("\u2014 no key")}`);
     }
   }
   const org = target?.confirmed?.organizationId ?? activeEntry?.organizationId;
   const plan = resolvePushPlan();
   console.log(
-    `  ${import_picocolors12.default.dim("push")}    ${plan.apiKey ? `${import_picocolors12.default.bold(plan.flow)} ${import_picocolors12.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors12.default.bold(plan.flow)} ${import_picocolors12.default.yellow("\u2014 no credential")} ${import_picocolors12.default.dim(`(run ${import_picocolors12.default.bold("ablo login")} or set ${import_picocolors12.default.bold("ABLO_API_KEY")})`)}`}`
+    `  ${import_picocolors14.default.dim("push")}    ${plan.apiKey ? `${import_picocolors14.default.bold(plan.flow)} ${import_picocolors14.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors14.default.bold(plan.flow)} ${import_picocolors14.default.yellow("\u2014 no credential")} ${import_picocolors14.default.dim(`(run ${import_picocolors14.default.bold("ablo login")} or set ${import_picocolors14.default.bold("ABLO_API_KEY")})`)}`}`
   );
-  process.stdout.write(`  ${import_picocolors12.default.dim("api")}     ${apiUrl2}  `);
+  process.stdout.write(`  ${import_picocolors14.default.dim("api")}     ${apiUrl2}  `);
   const reachable = await ping(apiUrl2);
-  console.log(reachable ? import_picocolors12.default.green("reachable") : import_picocolors12.default.red("unreachable"));
+  console.log(reachable ? import_picocolors14.default.green("reachable") : import_picocolors14.default.red("unreachable"));
   if (reachable) {
     const introspectKey = effective.key;
     const pushed = await fetchPushedSchema(apiUrl2, introspectKey);
     if (pushed?.active) {
-      const when = pushed.pushedAt ? ` ${import_picocolors12.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
-      const ver = pushed.version != null ? ` ${import_picocolors12.default.dim(`(rev ${pushed.version})`)}` : "";
-      const hashLabel = pushed.hash ? ` ${import_picocolors12.default.dim(`hash ${pushed.hash}`)}` : "";
-      console.log(`  ${import_picocolors12.default.dim("schema")}  ${import_picocolors12.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
+      const when = pushed.pushedAt ? ` ${import_picocolors14.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
+      const ver = pushed.version != null ? ` ${import_picocolors14.default.dim(`(rev ${pushed.version})`)}` : "";
+      const hashLabel = pushed.hash ? ` ${import_picocolors14.default.dim(`hash ${pushed.hash}`)}` : "";
+      console.log(`  ${import_picocolors14.default.dim("schema")}  ${import_picocolors14.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
       for (const m2 of pushed.models) {
-        const tn = m2.typename === m2.key ? import_picocolors12.default.dim(`typename=${m2.typename}`) : import_picocolors12.default.yellow(`typename=${m2.typename}`);
+        const tn = m2.typename === m2.key ? import_picocolors14.default.dim(`typename=${m2.typename}`) : import_picocolors14.default.yellow(`typename=${m2.typename}`);
         const conflict = formatConflict(m2.conflict);
-        const conflictStr2 = conflict ? `  ${import_picocolors12.default.dim(`conflict=${conflict}`)}` : "";
-        console.log(`          ${import_picocolors12.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
+        const conflictStr2 = conflict ? `  ${import_picocolors14.default.dim(`conflict=${conflict}`)}` : "";
+        console.log(`          ${import_picocolors14.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
       }
     } else if (pushed && !pushed.active) {
-      console.log(`  ${import_picocolors12.default.dim("schema")}  ${import_picocolors12.default.yellow("none pushed")} ${import_picocolors12.default.dim(`(run ${import_picocolors12.default.bold("ablo push")} or ${import_picocolors12.default.bold("ablo dev")})`)}`);
+      console.log(`  ${import_picocolors14.default.dim("schema")}  ${import_picocolors14.default.yellow("none pushed")} ${import_picocolors14.default.dim(`(run ${import_picocolors14.default.bold("ablo push")} or ${import_picocolors14.default.bold("ablo dev")})`)}`);
     }
     const firstPushedModel = pushed?.active ? pushed.models[0] : void 0;
     if (firstPushedModel !== void 0) {
       const probe = await probeDataPlane(apiUrl2, introspectKey, firstPushedModel.typename);
       if (probe.status === "no_database") {
-        console.log(`  ${import_picocolors12.default.dim("data")}    ${import_picocolors12.default.red("\u2717 no database registered")}${org ? import_picocolors12.default.dim(` for org ${org}`) : ""}`);
+        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.red("\u2717 no database registered")}${org ? import_picocolors14.default.dim(` for org ${org}`) : ""}`);
         console.log(
-          `          ${import_picocolors12.default.dim(
-            `reads/writes will fail with ${import_picocolors12.default.bold("tenant_routing_failed")}. Connect one with ${import_picocolors12.default.bold("ablo connect")}, or point ${import_picocolors12.default.bold("ABLO_API_KEY")} at an org that has a database.`
+          `          ${import_picocolors14.default.dim(
+            `reads/writes will fail with ${import_picocolors14.default.bold("tenant_routing_failed")}. Connect one with ${import_picocolors14.default.bold("ablo connect")}, or point ${import_picocolors14.default.bold("ABLO_API_KEY")} at an org that has a database.`
           )}`
         );
       } else if (probe.status === "intermittent") {
-        console.log(`  ${import_picocolors12.default.dim("data")}    ${import_picocolors12.default.red(`\u2717 database routing is intermittent`)} ${import_picocolors12.default.dim(`(${probe.ok} ok / ${probe.failed} failed of ${probe.ok + probe.failed})`)}${org ? import_picocolors12.default.dim(` for org ${org}`) : ""}`);
+        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.red(`\u2717 database routing is intermittent`)} ${import_picocolors14.default.dim(`(${probe.ok} ok / ${probe.failed} failed of ${probe.ok + probe.failed})`)}${org ? import_picocolors14.default.dim(` for org ${org}`) : ""}`);
         console.log(
-          `          ${import_picocolors12.default.dim(
-            `some reads/writes fail with ${import_picocolors12.default.bold("tenant_routing_failed")} \u2014 the registration is unstable. Re-establish it with ${import_picocolors12.default.bold("ablo connect")} (or check for a recent server redeploy).`
+          `          ${import_picocolors14.default.dim(
+            `some reads/writes fail with ${import_picocolors14.default.bold("tenant_routing_failed")} \u2014 the registration is unstable. Re-establish it with ${import_picocolors14.default.bold("ablo connect")} (or check for a recent server redeploy).`
           )}`
         );
       } else if (probe.status === "forbidden") {
-        console.log(`  ${import_picocolors12.default.dim("data")}    ${import_picocolors12.default.yellow("? key not authorized to read")}${probe.detail ? import_picocolors12.default.dim(` (${probe.detail})`) : ""}`);
+        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.yellow("? key not authorized to read")}${probe.detail ? import_picocolors14.default.dim(` (${probe.detail})`) : ""}`);
       } else if (probe.status === "unknown") {
-        console.log(`  ${import_picocolors12.default.dim("data")}    ${import_picocolors12.default.yellow(`? data-plane check inconclusive (${probe.detail})`)}`);
+        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.yellow(`? data-plane check inconclusive (${probe.detail})`)}`);
       }
     }
   }
@@ -283383,7 +283840,7 @@ async function status(args = []) {
 // src/cli/logs.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 init_config();
 init_theme();
 init_push();
@@ -283450,10 +283907,10 @@ function resolveSince(since) {
 var sleep2 = (ms) => new Promise((r2) => setTimeout(r2, ms));
 function colorOp(op) {
   const label = op.padEnd(6);
-  if (op === "create") return import_picocolors13.default.green(label);
-  if (op === "update") return import_picocolors13.default.yellow(label);
-  if (op === "delete") return import_picocolors13.default.red(label);
-  return import_picocolors13.default.dim(label);
+  if (op === "create") return import_picocolors15.default.green(label);
+  if (op === "update") return import_picocolors15.default.yellow(label);
+  if (op === "delete") return import_picocolors15.default.red(label);
+  return import_picocolors15.default.dim(label);
 }
 function render(e2, json) {
   if (json) {
@@ -283462,25 +283919,25 @@ function render(e2, json) {
     return;
   }
   const t = new Date(e2.at).toLocaleTimeString();
-  const actor = e2.actor ? import_picocolors13.default.dim(`  ${e2.actor}`) : "";
-  console.log(`  ${import_picocolors13.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors13.default.bold(e2.model)} ${import_picocolors13.default.dim(e2.recordId)}${actor}`);
+  const actor = e2.actor ? import_picocolors15.default.dim(`  ${e2.actor}`) : "";
+  console.log(`  ${import_picocolors15.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors15.default.bold(e2.model)} ${import_picocolors15.default.dim(e2.recordId)}${actor}`);
 }
 async function logs(argv) {
   let args;
   try {
     args = parseLogsArgs(argv);
   } catch (err) {
-    console.error(import_picocolors13.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors15.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const apiKey = resolveApiKey(args.mode);
   if (!apiKey) {
     console.error(
-      import_picocolors13.default.red(`  No API key.`) + import_picocolors13.default.dim(` Run ${import_picocolors13.default.bold("ablo login")} or set ${import_picocolors13.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors15.default.red(`  No API key.`) + import_picocolors15.default.dim(` Run ${import_picocolors15.default.bold("ablo login")} or set ${import_picocolors15.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
-  const baseUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const baseUrl2 = apiBaseUrl();
   const since = resolveSince(args.since);
   async function fetchPage(params) {
     const qs = new URLSearchParams(params).toString();
@@ -283490,7 +283947,7 @@ async function logs(argv) {
     if (!res) return null;
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
-      console.error(import_picocolors13.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
+      console.error(import_picocolors15.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
       process.exit(1);
     }
     const json = await res.json();
@@ -283501,7 +283958,7 @@ async function logs(argv) {
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors13.default.dim("logs")} ${import_picocolors13.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors15.default.dim("logs")} ${import_picocolors15.default.dim(`(${args.mode ?? "active"} mode)`)}
 `);
   }
   const initial = await fetchPage({
@@ -283511,13 +283968,13 @@ async function logs(argv) {
     ...args.op ? { op: args.op } : {}
   });
   if (!initial) {
-    console.error(import_picocolors13.default.red(`  Couldn't reach ${baseUrl2}.`));
+    console.error(import_picocolors15.default.red(`  Couldn't reach ${baseUrl2}.`));
     process.exit(1);
   }
   for (const e2 of initial.events) render(e2, args.json);
   let cursor = initial.cursor;
   if (!args.follow) return;
-  if (!args.json) console.log(`  ${import_picocolors13.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
+  if (!args.json) console.log(`  ${import_picocolors15.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
 `);
   for (; ; ) {
     await sleep2(1500);
@@ -283534,8 +283991,8 @@ async function logs(argv) {
 
 // src/cli/webhooks.ts
 init_cjs_shims();
-var import_fs9 = require("fs");
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_fs8 = require("fs");
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 init_credentialPolicy();
 init_config();
 init_theme();
@@ -283568,17 +284025,17 @@ function requireKey2(mode2) {
   const apiKey = resolveApiKey(mode2);
   if (!apiKey) {
     console.error(
-      import_picocolors14.default.red("  No API key.") + import_picocolors14.default.dim(` Run ${import_picocolors14.default.bold("ablo login")} or set ${import_picocolors14.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors16.default.red("  No API key.") + import_picocolors16.default.dim(` Run ${import_picocolors16.default.bold("ablo login")} or set ${import_picocolors16.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
   if (classifyCredentialKind(apiKey) !== "secret") {
-    console.error(import_picocolors14.default.red("  Managing webhooks requires a secret key ") + import_picocolors14.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors16.default.red("  Managing webhooks requires a secret key ") + import_picocolors16.default.dim("(sk_test_ / sk_live_)."));
     process.exit(1);
   }
   return apiKey;
 }
-var baseUrl = () => (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+var baseUrl = () => apiBaseUrl();
 async function api(apiKey, method, path, body) {
   const res = await fetch(`${baseUrl()}/api/v1/webhook_endpoints${path}`, {
     method,
@@ -283589,22 +284046,22 @@ async function api(apiKey, method, path, body) {
     ...body ? { body: JSON.stringify(body) } : {}
   }).catch(() => null);
   if (!res) {
-    console.error(import_picocolors14.default.red(`  Couldn't reach ${baseUrl()}.`));
+    console.error(import_picocolors16.default.red(`  Couldn't reach ${baseUrl()}.`));
     process.exit(1);
   }
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    console.error(import_picocolors14.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
+    console.error(import_picocolors16.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
     process.exit(1);
   }
   return await res.json();
 }
 function writeSecretToEnv(secret) {
-  const file = (0, import_fs9.existsSync)(".env.local") ? ".env.local" : (0, import_fs9.existsSync)(".env") ? ".env" : ".env.local";
+  const file = (0, import_fs8.existsSync)(".env.local") ? ".env.local" : (0, import_fs8.existsSync)(".env") ? ".env" : ".env.local";
   const line = `${ENV_KEY}=${secret}`;
   let next;
-  if ((0, import_fs9.existsSync)(file)) {
-    const existing = (0, import_fs9.readFileSync)(file, "utf-8");
+  if ((0, import_fs8.existsSync)(file)) {
+    const existing = (0, import_fs8.readFileSync)(file, "utf-8");
     next = new RegExp(`^${ENV_KEY}=.*$`, "m").test(existing) ? existing.replace(new RegExp(`^${ENV_KEY}=.*$`, "m"), line) : `${existing.replace(/\n*$/, "")}
 ${line}
 `;
@@ -283612,15 +284069,15 @@ ${line}
     next = `${line}
 `;
   }
-  (0, import_fs9.writeFileSync)(file, next);
+  (0, import_fs8.writeFileSync)(file, next);
   return file;
 }
 function printEndpoint(e2) {
-  const dot = e2.status === "enabled" ? import_picocolors14.default.green("\u25CF") : import_picocolors14.default.red("\u25CF");
-  const health = e2.last_error ? import_picocolors14.default.red(` last error: ${e2.last_error}`) : "";
-  console.log(`  ${dot} ${import_picocolors14.default.bold(e2.id)}  ${e2.url}`);
+  const dot = e2.status === "enabled" ? import_picocolors16.default.green("\u25CF") : import_picocolors16.default.red("\u25CF");
+  const health = e2.last_error ? import_picocolors16.default.red(` last error: ${e2.last_error}`) : "";
+  console.log(`  ${dot} ${import_picocolors16.default.bold(e2.id)}  ${e2.url}`);
   console.log(
-    import_picocolors14.default.dim(
+    import_picocolors16.default.dim(
       `      ${e2.status} \xB7 ${e2.environment} \xB7 events ${e2.enabled_events.join(",")} \xB7 cursor ${e2.cursor ?? "\u2014"}${health}`
     )
   );
@@ -283632,7 +284089,7 @@ async function webhooks(argv) {
   if (sub === "create") {
     const url = positional(rest);
     if (!url) {
-      console.error(import_picocolors14.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
+      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
@@ -283644,8 +284101,8 @@ async function webhooks(argv) {
     });
     const file = writeSecretToEnv(created.secret);
     console.log(`
-  ${import_picocolors14.default.green("\u2713")} Registered ${import_picocolors14.default.bold(created.id)} \u2192 ${created.url}`);
-    console.log(`  ${import_picocolors14.default.green("\u2713")} Wrote ${import_picocolors14.default.bold(ENV_KEY)} to ${import_picocolors14.default.bold(file)} ${import_picocolors14.default.dim("(shown once)")}
+  ${import_picocolors16.default.green("\u2713")} Registered ${import_picocolors16.default.bold(created.id)} \u2192 ${created.url}`);
+    console.log(`  ${import_picocolors16.default.green("\u2713")} Wrote ${import_picocolors16.default.bold(ENV_KEY)} to ${import_picocolors16.default.bold(file)} ${import_picocolors16.default.dim("(shown once)")}
 `);
     return;
   }
@@ -283653,7 +284110,7 @@ async function webhooks(argv) {
     const apiKey = requireKey2(mode2);
     const { data } = await api(apiKey, "GET", "");
     if (data.length === 0) {
-      console.log(import_picocolors14.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
+      console.log(import_picocolors16.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
       return;
     }
     console.log();
@@ -283664,40 +284121,40 @@ async function webhooks(argv) {
   if (sub === "roll") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors14.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
+      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     const rolled = await api(apiKey, "POST", `/${id}/roll_secret`);
     const file = writeSecretToEnv(rolled.secret);
     console.log(`
-  ${import_picocolors14.default.green("\u2713")} Rolled secret for ${import_picocolors14.default.bold(id)} \u2192 ${import_picocolors14.default.bold(file)} ${import_picocolors14.default.dim("(old secret now invalid)")}
+  ${import_picocolors16.default.green("\u2713")} Rolled secret for ${import_picocolors16.default.bold(id)} \u2192 ${import_picocolors16.default.bold(file)} ${import_picocolors16.default.dim("(old secret now invalid)")}
 `);
     return;
   }
   if (sub === "enable") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors14.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
+      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     const e2 = await api(apiKey, "POST", `/${id}/enable`);
-    console.log(`  ${import_picocolors14.default.green("\u2713")} Re-enabled ${import_picocolors14.default.bold(e2.id)}`);
+    console.log(`  ${import_picocolors16.default.green("\u2713")} Re-enabled ${import_picocolors16.default.bold(e2.id)}`);
     return;
   }
   if (sub === "rm" || sub === "delete") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors14.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
+      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     await api(apiKey, "DELETE", `/${id}`);
-    console.log(`  ${import_picocolors14.default.green("\u2713")} Removed ${import_picocolors14.default.bold(id)}`);
+    console.log(`  ${import_picocolors16.default.green("\u2713")} Removed ${import_picocolors16.default.bold(id)}`);
     return;
   }
-  console.log(`  ${import_picocolors14.default.bold("Usage:")}`);
+  console.log(`  ${import_picocolors16.default.bold("Usage:")}`);
   console.log(`    ${brand("ablo webhooks create <url>")}   Register an endpoint; writes ${ENV_KEY}`);
   console.log(`    ${brand("ablo webhooks list")}           List endpoints + delivery health`);
   console.log(`    ${brand("ablo webhooks roll <id>")}       Mint a fresh signing secret`);
@@ -283709,7 +284166,7 @@ async function webhooks(argv) {
 // src/cli/check.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 init_src();
 var import_schema6 = require("@abloatai/ablo/schema");
 init_push();
@@ -283747,13 +284204,13 @@ async function check(argv) {
   try {
     args = parseCheckArgs(argv);
   } catch (err) {
-    console.error(import_picocolors15.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
     console.error(
-      import_picocolors15.default.red(`  No database.`) + import_picocolors15.default.dim(` Set ${import_picocolors15.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
+      import_picocolors17.default.red(`  No database.`) + import_picocolors17.default.dim(` Set ${import_picocolors17.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
     );
     process.exit(1);
   }
@@ -283768,7 +284225,7 @@ async function check(argv) {
       [args.appSchema]
     );
   } catch (err) {
-    console.error(import_picocolors15.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -283783,7 +284240,7 @@ async function check(argv) {
     set.add(r2.column_name);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors15.default.dim("check")}  ${import_picocolors15.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors17.default.dim("check")}  ${import_picocolors17.default.dim(`schema "${args.appSchema}"`)}
 `);
   const declaredTables = /* @__PURE__ */ new Set();
   let errors = 0;
@@ -283793,7 +284250,7 @@ async function check(argv) {
     declaredTables.add(table);
     const present = colsByTable.get(table);
     if (!present) {
-      console.log(`  ${import_picocolors15.default.red("\u2717")} ${import_picocolors15.default.bold(key)} ${import_picocolors15.default.dim("\u2192")} table ${import_picocolors15.default.bold(table)} ${import_picocolors15.default.red("not found")}`);
+      console.log(`  ${import_picocolors17.default.red("\u2717")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} table ${import_picocolors17.default.bold(table)} ${import_picocolors17.default.red("not found")}`);
       errors++;
       continue;
     }
@@ -283815,26 +284272,26 @@ async function check(argv) {
       if (!present.has(col)) problems.push(`missing column "${col}" (field ${fieldName})`);
     }
     if (problems.length > 0) {
-      console.log(`  ${import_picocolors15.default.red("\u2717")} ${import_picocolors15.default.bold(key)} ${import_picocolors15.default.dim("\u2192")} ${table}`);
-      for (const p2 of problems) console.log(`      ${import_picocolors15.default.red("\u2022")} ${p2}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors15.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors17.default.red("\u2717")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} ${table}`);
+      for (const p2 of problems) console.log(`      ${import_picocolors17.default.red("\u2022")} ${p2}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors17.default.yellow("\u2022")} ${w2}`);
       errors++;
     } else if (warns.length > 0) {
-      console.log(`  ${import_picocolors15.default.yellow("!")} ${import_picocolors15.default.bold(key)} ${import_picocolors15.default.dim("\u2192")} ${table}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors15.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors17.default.yellow("!")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} ${table}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors17.default.yellow("\u2022")} ${w2}`);
       warnings++;
     } else {
-      console.log(`  ${import_picocolors15.default.green("\u2713")} ${import_picocolors15.default.bold(key)} ${import_picocolors15.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
+      console.log(`  ${import_picocolors17.default.green("\u2713")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
     }
   }
   const modelCount = Object.keys(schemaJson.models).length;
   const ignored = [...colsByTable.keys()].filter((t) => !declaredTables.has(t)).length;
   console.log(
     `
-  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors15.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors15.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors15.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
+  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors17.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors17.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors17.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
   );
   if (ignored > 0) {
-    console.log(`  ${import_picocolors15.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
+    console.log(`  ${import_picocolors17.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
   }
   console.log();
   process.exit(errors > 0 ? 1 : 0);
@@ -283842,7 +284299,7 @@ async function check(argv) {
 
 // src/cli/upgrade.ts
 init_cjs_shims();
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -283920,7 +284377,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors16.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors18.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -283994,41 +284451,41 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors16.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors18.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors16.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors18.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors16.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors16.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors16.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors16.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors18.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors18.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors18.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors18.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors16.default.bold(import_picocolors16.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors18.default.bold(import_picocolors18.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors16.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors16.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors16.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors18.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors18.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors18.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors16.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors18.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors16.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors18.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/cli/pull.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 init_src();
-var import_fs10 = require("fs");
+var import_fs9 = require("fs");
 init_theme();
 var DEFAULT_OUT2 = "ablo/schema.ts";
 var DEFAULT_IMPORT = "@abloatai/ablo/schema";
@@ -284140,45 +284597,45 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors19.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
-    console.error(import_picocolors17.default.red(`  No database.`) + import_picocolors17.default.dim(` Set ${import_picocolors17.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
+    console.error(import_picocolors19.default.red(`  No database.`) + import_picocolors19.default.dim(` Set ${import_picocolors19.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
     process.exit(1);
   }
-  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs9.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors17.default.red(`  ${args.out} already exists.`) + import_picocolors17.default.dim(` Re-run with ${import_picocolors17.default.bold("--force")} to overwrite.`)
+      import_picocolors19.default.red(`  ${args.out} already exists.`) + import_picocolors19.default.dim(` Re-run with ${import_picocolors19.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors17.default.dim("pull")}  ${import_picocolors17.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors19.default.dim("pull")}  ${import_picocolors19.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors17.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors19.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors17.default.yellow(`  No adoptable tables found`) + import_picocolors17.default.dim(` (a model needs an ${import_picocolors17.default.bold("id")} + ${import_picocolors17.default.bold("organization_id")} column).`)
+      import_picocolors19.default.yellow(`  No adoptable tables found`) + import_picocolors19.default.dim(` (a model needs an ${import_picocolors19.default.bold("id")} + ${import_picocolors19.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
-  (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors17.default.green("\u2713")} wrote ${import_picocolors17.default.bold(args.out)} ${import_picocolors17.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors17.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs9.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors19.default.green("\u2713")} wrote ${import_picocolors19.default.bold(args.out)} ${import_picocolors19.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors19.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped > 0) {
-    console.log(`  ${import_picocolors17.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
+    console.log(`  ${import_picocolors19.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
   }
   console.log(
     `
-  ${import_picocolors17.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors17.default.bold("ablo check")}.
+  ${import_picocolors19.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors19.default.bold("ablo check")}.
 `
   );
 }
@@ -284186,8 +284643,8 @@ async function pull(argv) {
 // src/cli/prismaPull.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
-var import_fs11 = require("fs");
+var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_fs10 = require("fs");
 init_theme();
 
 // src/cli/schemaIr.ts
@@ -284471,58 +284928,58 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors18.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  if (!(0, import_fs11.existsSync)(args.schema)) {
+  if (!(0, import_fs10.existsSync)(args.schema)) {
     console.error(
-      import_picocolors18.default.red(`  No Prisma schema at ${import_picocolors18.default.bold(args.schema)}.`) + import_picocolors18.default.dim(` Pass a path: ${import_picocolors18.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors20.default.red(`  No Prisma schema at ${import_picocolors20.default.bold(args.schema)}.`) + import_picocolors20.default.dim(` Pass a path: ${import_picocolors20.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
-  if ((0, import_fs11.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors18.default.red(`  ${args.out} already exists.`) + import_picocolors18.default.dim(` Re-run with ${import_picocolors18.default.bold("--force")} to overwrite.`)
+      import_picocolors20.default.red(`  ${args.out} already exists.`) + import_picocolors20.default.dim(` Re-run with ${import_picocolors20.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors18.default.dim("pull prisma")}  ${import_picocolors18.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors20.default.dim("pull prisma")}  ${import_picocolors20.default.dim(args.schema)}
 `);
   let result;
   try {
-    const src = (0, import_fs11.readFileSync)(args.schema, "utf8");
+    const src = (0, import_fs10.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors18.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors20.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors18.default.yellow(`  No adoptable models found`) + import_picocolors18.default.dim(` (a model needs an ${import_picocolors18.default.bold("id")} + ${import_picocolors18.default.bold("organizationId")} / ${import_picocolors18.default.bold("organization_id")}).`)
+      import_picocolors20.default.yellow(`  No adoptable models found`) + import_picocolors20.default.dim(` (a model needs an ${import_picocolors20.default.bold("id")} + ${import_picocolors20.default.bold("organizationId")} / ${import_picocolors20.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
-  (0, import_fs11.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors18.default.green("\u2713")} wrote ${import_picocolors18.default.bold(args.out)} ${import_picocolors18.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors18.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs10.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors20.default.green("\u2713")} wrote ${import_picocolors20.default.bold(args.out)} ${import_picocolors20.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors20.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors18.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors18.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors20.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors20.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors18.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors18.default.bold("ablo check")}.
+  ${import_picocolors20.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors20.default.bold("ablo check")}.
 `
   );
 }
 
 // src/cli/drizzlePull.ts
 init_cjs_shims();
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 init_errors();
-var import_fs12 = require("fs");
-var import_path7 = require("path");
+var import_fs11 = require("fs");
+var import_path6 = require("path");
 init_theme();
 var DEFAULT_OUT4 = "ablo/schema.ts";
 var DEFAULT_IMPORT3 = "@abloatai/ablo/schema";
@@ -284650,7 +285107,7 @@ function parseDrizzlePullArgs(argv) {
 async function loadModule(path) {
   const { createJiti } = await import("jiti");
   const jiti = createJiti(process.cwd());
-  const mod = await jiti.import((0, import_path7.resolve)(path));
+  const mod = await jiti.import((0, import_path6.resolve)(path));
   return mod;
 }
 async function drizzlePull(argv) {
@@ -284658,27 +285115,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors19.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors19.default.red(`  No Drizzle schema given.`) + import_picocolors19.default.dim(` Pass the module: ${import_picocolors19.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors21.default.red(`  No Drizzle schema given.`) + import_picocolors21.default.dim(` Pass the module: ${import_picocolors21.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
-  if (!(0, import_fs12.existsSync)(args.schema)) {
-    console.error(import_picocolors19.default.red(`  No file at ${import_picocolors19.default.bold(args.schema)}.`));
+  if (!(0, import_fs11.existsSync)(args.schema)) {
+    console.error(import_picocolors21.default.red(`  No file at ${import_picocolors21.default.bold(args.schema)}.`));
     process.exit(1);
   }
-  if ((0, import_fs12.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors19.default.red(`  ${args.out} already exists.`) + import_picocolors19.default.dim(` Re-run with ${import_picocolors19.default.bold("--force")} to overwrite.`)
+      import_picocolors21.default.red(`  ${args.out} already exists.`) + import_picocolors21.default.dim(` Re-run with ${import_picocolors21.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors19.default.dim("pull drizzle")}  ${import_picocolors19.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors21.default.dim("pull drizzle")}  ${import_picocolors21.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -284686,26 +285143,26 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors19.default.dim(` (install ${import_picocolors19.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors19.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors21.default.dim(` (install ${import_picocolors21.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors21.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors19.default.yellow(`  No adoptable tables found`) + import_picocolors19.default.dim(` (a table needs an ${import_picocolors19.default.bold("id")} + ${import_picocolors19.default.bold("organization_id")} column).`)
+      import_picocolors21.default.yellow(`  No adoptable tables found`) + import_picocolors21.default.dim(` (a table needs an ${import_picocolors21.default.bold("id")} + ${import_picocolors21.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
-  (0, import_fs12.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors19.default.green("\u2713")} wrote ${import_picocolors19.default.bold(args.out)} ${import_picocolors19.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors19.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs11.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors21.default.green("\u2713")} wrote ${import_picocolors21.default.bold(args.out)} ${import_picocolors21.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors21.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors19.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors19.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors21.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors21.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors19.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors19.default.bold("ablo check")}.
+  ${import_picocolors21.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors21.default.bold("ablo check")}.
 `
   );
 }
@@ -284715,7 +285172,7 @@ init_theme();
 
 // src/cli/renderError.ts
 init_cjs_shims();
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 init_errors();
 init_theme();
 var RECOVERY_HINT = {
@@ -284737,15 +285194,15 @@ function isStringArray(v2) {
 function renderKnownDetails(details, line) {
   if (!details) return;
   const { retryAfterSeconds, missingIds, requiredCapability, unexecutable, errors } = details;
-  if (typeof retryAfterSeconds === "number") line(`    ${import_picocolors20.default.dim("retry")}  after ${retryAfterSeconds}s`);
+  if (typeof retryAfterSeconds === "number") line(`    ${import_picocolors22.default.dim("retry")}  after ${retryAfterSeconds}s`);
   if (isStringArray(missingIds) && missingIds.length > 0) {
     const shown = missingIds.slice(0, 5).join(", ");
     const more = missingIds.length > 5 ? ` (+${missingIds.length - 5} more)` : "";
-    line(`    ${import_picocolors20.default.dim("missing")} ${shown}${more}`);
+    line(`    ${import_picocolors22.default.dim("missing")} ${shown}${more}`);
   }
-  if (typeof requiredCapability === "string") line(`    ${import_picocolors20.default.dim("needs")}  ${requiredCapability}`);
+  if (typeof requiredCapability === "string") line(`    ${import_picocolors22.default.dim("needs")}  ${requiredCapability}`);
   if (Array.isArray(unexecutable) && unexecutable.length > 0) {
-    line(`    ${import_picocolors20.default.dim("blocked")} ${unexecutable.length} change(s) can't be applied \u2014 see \`unexecutable\` (--verbose)`);
+    line(`    ${import_picocolors22.default.dim("blocked")} ${unexecutable.length} change(s) can't be applied \u2014 see \`unexecutable\` (--verbose)`);
   }
   if (Array.isArray(errors)) {
     for (const e2 of errors.slice(0, 8)) {
@@ -284753,7 +285210,7 @@ function renderKnownDetails(details, line) {
         const rec = e2;
         const where = typeof rec.param === "string" ? `${rec.param}: ` : "";
         const msg = typeof rec.message === "string" ? rec.message : "";
-        if (msg) line(`    ${import_picocolors20.default.dim("\xB7")} ${where}${msg}`);
+        if (msg) line(`    ${import_picocolors22.default.dim("\xB7")} ${where}${msg}`);
       }
     }
   }
@@ -284764,22 +285221,22 @@ function renderCliError(err, opts = {}) {
   });
   const verbose = opts.verbose ?? (process.argv.includes("--verbose") || process.env.ABLO_VERBOSE === "1");
   if (err instanceof AbloError) {
-    const codeTag = err.code ? `  ${import_picocolors20.default.dim(`[${err.code}]`)}` : "";
+    const codeTag = err.code ? `  ${import_picocolors22.default.dim(`[${err.code}]`)}` : "";
     line("");
-    line(`  ${brand("ablo")} ${import_picocolors20.default.red("\u2717")} ${import_picocolors20.default.bold(titleForType(err.type))}${codeTag}`);
+    line(`  ${brand("ablo")} ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(titleForType(err.type))}${codeTag}`);
     line("");
     line(`    ${err.message}`);
-    if (err.param) line(`    ${import_picocolors20.default.dim("field")}  ${err.param}`);
+    if (err.param) line(`    ${import_picocolors22.default.dim("field")}  ${err.param}`);
     renderKnownDetails(err.details, line);
     const hint = err.code ? RECOVERY_HINT[classifyRecovery(err.code)] : void 0;
-    if (hint) line(`    ${import_picocolors20.default.dim(hint)}`);
-    if (err.docUrl) line(`    ${import_picocolors20.default.dim("docs")}   ${err.docUrl}`);
-    if (err.requestId) line(`    ${import_picocolors20.default.dim("ref")}    ${err.requestId}`);
+    if (hint) line(`    ${import_picocolors22.default.dim(hint)}`);
+    if (err.docUrl) line(`    ${import_picocolors22.default.dim("docs")}   ${err.docUrl}`);
+    if (err.requestId) line(`    ${import_picocolors22.default.dim("ref")}    ${err.requestId}`);
     if (verbose) {
       if (err.details && Object.keys(err.details).length > 0) {
-        line(`    ${import_picocolors20.default.dim("details")} ${JSON.stringify(err.details)}`);
+        line(`    ${import_picocolors22.default.dim("details")} ${JSON.stringify(err.details)}`);
       }
-      if (err.stack) line(import_picocolors20.default.dim(err.stack));
+      if (err.stack) line(import_picocolors22.default.dim(err.stack));
     }
     line("");
     process.exitCode = 1;
@@ -284787,16 +285244,16 @@ function renderCliError(err, opts = {}) {
   }
   const message = err instanceof Error ? err.message : String(err);
   line("");
-  line(`  ${brand("ablo")} ${import_picocolors20.default.red("\u2717")} ${message}`);
-  if (verbose && err instanceof Error && err.stack) line(import_picocolors20.default.dim(err.stack));
-  else line(`    ${import_picocolors20.default.dim("Run with --verbose for the full error.")}`);
+  line(`  ${brand("ablo")} ${import_picocolors22.default.red("\u2717")} ${message}`);
+  if (verbose && err instanceof Error && err.stack) line(import_picocolors22.default.dim(err.stack));
+  else line(`    ${import_picocolors22.default.dim("Run with --verbose for the full error.")}`);
   line("");
   process.exitCode = 1;
 }
 
 // src/cli/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors21.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors23.default.dim("sync engine")}
 `;
 var SUBCOMMAND_USAGE = {
   connect: CONNECT_USAGE,
@@ -284831,7 +285288,7 @@ async function main() {
     const devArgs = process.argv.slice(3);
     const oneShot = devArgs.includes("--no-watch");
     console.log(
-      import_picocolors21.default.dim(
+      import_picocolors23.default.dim(
         oneShot ? "  `ablo dev --no-watch` is `ablo push` (push once, no watcher) \u2014 running that." : "  `ablo dev` is now `ablo push --watch` \u2014 running that."
       )
     );
@@ -284860,14 +285317,14 @@ async function main() {
     const guard = guardActiveProjectKey();
     if (!guard.ok && guard.available.length > 0 && !rest.includes("--url")) {
       console.error(
-        `  ${import_picocolors21.default.yellow("\u26A0")} active project ${import_picocolors21.default.bold(guard.activeProfile)} has no stored key ${import_picocolors21.default.dim(
+        `  ${import_picocolors23.default.yellow("\u26A0")} active project ${import_picocolors23.default.bold(guard.activeProfile)} has no stored key ${import_picocolors23.default.dim(
           `(you have keys for: ${guard.available.join(", ")})`
         )}`
       );
       const loginCmd = guard.activeProfile === "default" ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
       console.error(
-        import_picocolors21.default.dim(
-          `    Mint one with ${import_picocolors21.default.bold(loginCmd)}, or switch with ${import_picocolors21.default.bold("ablo projects use <slug>")}.`
+        import_picocolors23.default.dim(
+          `    Mint one with ${import_picocolors23.default.bold(loginCmd)}, or switch with ${import_picocolors23.default.bold("ablo projects use <slug>")}.`
         )
       );
       process.exitCode = 1;
@@ -284885,13 +285342,13 @@ async function main() {
     await generate(process.argv.slice(3));
   } else if (command === "schema") {
     console.error(
-      `  ${import_picocolors21.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
+      `  ${import_picocolors23.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
     );
     console.error(`    Run \`ablo push${process.argv.slice(4).join(" ") ? " " + process.argv.slice(4).join(" ") : ""}\` instead.`);
     process.exitCode = 1;
   } else {
     console.log(LOGO);
-    console.log(`  ${import_picocolors21.default.bold("Usage:")}`);
+    console.log(`  ${import_picocolors23.default.bold("Usage:")}`);
     console.log(`    npx ablo init                          Scaffold ablo/ directory + starter schema`);
     console.log(`    npx ablo init --yes [--framework nextjs] Non-interactive (agents/CI): no prompts, flag-driven`);
     console.log(`                  [--auth apikey] [--storage replication|endpoint] [--project <slug>] [--no-project]`);
@@ -284915,8 +285372,9 @@ async function main() {
     console.log(`    npx ablo pull drizzle <module>         Generate schema.ts from a Drizzle schema (keeps enums + relations)`);
     console.log(`    npx ablo check                         Check your existing database fits the schema (read-only, creates no tables)`);
     console.log(`    npx ablo connect                       Connect a real database \u2014 prints the logical-replication setup SQL (the one way)`);
-    console.log(`    npx ablo connect --check               Validate DATABASE_URL is replication-ready (wal_level, publication, role, replica identity)`);
-    console.log(`    npx ablo connect --audit-infra         Read-only audit for deprecated Ablo sync infra in a customer DB`);
+    console.log(`    npx ablo connect check                 Validate DATABASE_URL is replication-ready (wal_level, publication, role, replica identity)`);
+    console.log(`    npx ablo connect scan                  Read-only audit for leftover Ablo sync infra in a customer DB`);
+    console.log(`    npx ablo connect deregister            Remove this project's data source \u2014 Ablo stops reading/writing it`);
     console.log(`    npx ablo migrate                       Provision your synced-model tables in your own Postgres (optional escape hatch \u2014 \`connect\` is the way)`);
     console.log(`    npx ablo migrate --dry-run             Print the SQL without executing (preview)`);
     console.log(`    npx ablo push                          Upload your schema definition to Ablo (metadata only \u2014 rows stay in your DB)`);
@@ -284927,10 +285385,10 @@ async function main() {
     console.log(`    npx ablo generate                      Emit TypeScript types from your schema`);
     console.log(`    npx ablo generate --out path.ts        Write generated types to a path`);
     console.log();
-    console.log(`  ${import_picocolors21.default.bold("Schema workflow:")}`);
+    console.log(`  ${import_picocolors23.default.bold("Schema workflow:")}`);
     console.log(`    The server holds its own copy of your schema \u2014 edit ${brand("ablo/schema.ts")}, then`);
     console.log(`    run ${brand("ablo push")} (or keep ${brand("ablo dev")} running) before the server will accept`);
-    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors21.default.yellow("server_execute_unknown_model")}.`);
+    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors23.default.yellow("server_execute_unknown_model")}.`);
     console.log();
   }
 }
@@ -284971,7 +285429,7 @@ async function ensureInitProject(opts) {
   const slug = opts.project ?? projectSlugFromPackageName(
     (() => {
       try {
-        return JSON.parse((0, import_fs13.readFileSync)("package.json", "utf-8")).name;
+        return JSON.parse((0, import_fs12.readFileSync)("package.json", "utf-8")).name;
       } catch {
         return void 0;
       }
@@ -284981,14 +285439,14 @@ async function ensureInitProject(opts) {
   const ensured = await ensureProject(slug);
   if (ensured) {
     console.log(
-      `  ${import_picocolors21.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors21.default.bold(ensured.slug)} ${import_picocolors21.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
+      `  ${import_picocolors23.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors23.default.bold(ensured.slug)} ${import_picocolors23.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
     );
   }
 }
 function detectOrm(override) {
   if (override === "prisma" || override === "drizzle" || override === "none") return override;
   try {
-    const pkg = JSON.parse((0, import_fs13.readFileSync)("package.json", "utf-8"));
+    const pkg = JSON.parse((0, import_fs12.readFileSync)("package.json", "utf-8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (deps["@prisma/client"] || deps.prisma) return "prisma";
     if (deps["drizzle-orm"]) return "drizzle";
@@ -284997,8 +285455,8 @@ function detectOrm(override) {
   return "none";
 }
 function detectNextLayout() {
-  const useSrc = (0, import_fs13.existsSync)((0, import_path8.join)("src", "app")) || !(0, import_fs13.existsSync)("app") && (0, import_fs13.existsSync)("src");
-  return useSrc ? { appBase: (0, import_path8.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
+  const useSrc = (0, import_fs12.existsSync)((0, import_path7.join)("src", "app")) || !(0, import_fs12.existsSync)("app") && (0, import_fs12.existsSync)("src");
+  return useSrc ? { appBase: (0, import_path7.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
 }
 async function chooseOption(name, flagValue, fallback, allowed, interactive, prompt) {
   if (flagValue !== void 0) {
@@ -285023,8 +285481,8 @@ async function chooseBool(flagValue, fallback, interactive, prompt) {
 async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors21.default.dim("sync engine")}`);
-  if (!(0, import_fs13.existsSync)("package.json")) {
+  Ie(`${brand("ablo")} ${import_picocolors23.default.dim("sync engine")}`);
+  if (!(0, import_fs12.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
   }
@@ -285093,15 +285551,15 @@ async function init(args = []) {
     );
   }
   const layout = framework === "nextjs" ? detectNextLayout() : { appBase: "app", aliasBase: "." };
-  const abloDir = (0, import_path8.join)(layout.aliasBase, "ablo");
-  (0, import_fs13.mkdirSync)(abloDir, { recursive: true });
+  const abloDir = (0, import_path7.join)(layout.aliasBase, "ablo");
+  (0, import_fs12.mkdirSync)(abloDir, { recursive: true });
   const created = [];
   let schemaSource = generateSchema();
   let schemaNote = "";
   if (pullExisting) {
     const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
     if (!dbUrl) {
-      schemaNote = import_picocolors21.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
+      schemaNote = import_picocolors23.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -285111,70 +285569,70 @@ async function init(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors21.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors23.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors21.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors23.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors21.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors23.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "schema.ts"), schemaSource);
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "schema.ts"), schemaSource);
   created.push(`${abloDir}/schema.ts${schemaNote}`);
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "index.ts"), generateSyncConfig(auth));
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth));
   created.push(`${abloDir}/index.ts`);
-  (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "register.ts"), generateRegister());
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "register.ts"), generateRegister());
   created.push(`${abloDir}/register.ts`);
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "data-source.ts"), generateDataSource(orm));
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "data-source.ts"), generateDataSource(orm));
     created.push(`${abloDir}/data-source.ts${orm === "drizzle" ? " (Drizzle)" : " (Prisma)"}`);
   }
   const envFile = framework === "nextjs" ? ".env.local" : ".env";
   const resolvedKey = process.env.ABLO_API_KEY ? void 0 : resolveApiKey("sandbox");
   const wireRealKey = envFile === ".env.local" && Boolean(resolvedKey);
   const envBody = generateEnv(storage, { includeApiKey: !wireRealKey });
-  if (!(0, import_fs13.existsSync)(envFile)) {
-    (0, import_fs13.writeFileSync)(envFile, envBody);
+  if (!(0, import_fs12.existsSync)(envFile)) {
+    (0, import_fs12.writeFileSync)(envFile, envBody);
     created.push(envFile);
   } else {
-    const existing = (0, import_fs13.readFileSync)(envFile, "utf-8");
+    const existing = (0, import_fs12.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
-      (0, import_fs13.writeFileSync)(envFile, existing + "\n" + envBody);
-      created.push(`${envFile} ${import_picocolors21.default.dim("(appended)")}`);
+      (0, import_fs12.writeFileSync)(envFile, existing + "\n" + envBody);
+      created.push(`${envFile} ${import_picocolors23.default.dim("(appended)")}`);
     } else {
-      created.push(`${envFile} ${import_picocolors21.default.dim("(already configured)")}`);
+      created.push(`${envFile} ${import_picocolors23.default.dim("(already configured)")}`);
     }
   }
   if (wireRealKey && resolvedKey) {
     wireEnvLocal(resolvedKey);
-    created.push(`.env.local ${import_picocolors21.default.dim("(ABLO_API_KEY set from your login)")}`);
+    created.push(`.env.local ${import_picocolors23.default.dim("(ABLO_API_KEY set from your login)")}`);
   }
   if (agent) {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "agent.ts"), generateAgent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "agent.ts"), generateAgent());
     created.push(`${abloDir}/agent.ts`);
   }
   if (framework === "nextjs") {
     if (storage === "endpoint") {
-      const webhookDir = (0, import_path8.join)(layout.appBase, "api", "ablo", "webhooks");
-      (0, import_fs13.mkdirSync)(webhookDir, { recursive: true });
-      (0, import_fs13.writeFileSync)((0, import_path8.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
+      const webhookDir = (0, import_path7.join)(layout.appBase, "api", "ablo", "webhooks");
+      (0, import_fs12.mkdirSync)(webhookDir, { recursive: true });
+      (0, import_fs12.writeFileSync)((0, import_path7.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
       created.push(`${webhookDir}/route.ts${orm === "prisma" ? " (Prisma mirror)" : " (add your database write)"}`);
     }
-    const providersPath = (0, import_path8.join)(layout.appBase, "providers.tsx");
-    (0, import_fs13.writeFileSync)(providersPath, generateProviders());
-    created.push(`${providersPath} ${import_picocolors21.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
-    const sessionDir = (0, import_path8.join)(layout.appBase, "api", "ablo-session");
-    (0, import_fs13.mkdirSync)(sessionDir, { recursive: true });
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors21.default.dim("(wire your auth)")}`);
+    const providersPath = (0, import_path7.join)(layout.appBase, "providers.tsx");
+    (0, import_fs12.writeFileSync)(providersPath, generateProviders());
+    created.push(`${providersPath} ${import_picocolors23.default.dim(`(wrap ${(0, import_path7.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    const sessionDir = (0, import_path7.join)(layout.appBase, "api", "ablo-session");
+    (0, import_fs12.mkdirSync)(sessionDir, { recursive: true });
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(sessionDir, "route.ts"), generateSessionRoute());
+    created.push(`${(0, import_path7.join)(sessionDir, "route.ts")} ${import_picocolors23.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
-    (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "TaskList.tsx"), generateComponent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
-  Me(created.map((f) => `${import_picocolors21.default.green("\u2713")} ${f}`).join("\n"), "Created");
+  Me(created.map((f) => `${import_picocolors23.default.green("\u2713")} ${f}`).join("\n"), "Created");
   const pm = detectPackageManager();
   if (opts.install) {
     const s = Y2();
@@ -285183,47 +285641,47 @@ async function init(args = []) {
       (0, import_child_process3.execSync)(`${pm} add @abloatai/ablo`, { stdio: "ignore" });
       s.stop("Installed @abloatai/ablo");
     } catch {
-      s.stop(`${import_picocolors21.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors21.default.bold(`${pm} install @abloatai/ablo`)}`);
+      s.stop(`${import_picocolors23.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors23.default.bold(`${pm} install @abloatai/ablo`)}`);
     }
   }
   const steps = [
-    `Get a ${import_picocolors21.default.bold("sk_test_")} key at ${import_picocolors21.default.cyan("https://abloatai.com")}`,
-    `Run ${import_picocolors21.default.bold("npx ablo login")} (or add ${import_picocolors21.default.bold("ABLO_API_KEY")} to ${import_picocolors21.default.bold(envFile)})`,
-    `Set ${import_picocolors21.default.bold("DATABASE_URL")} in ${import_picocolors21.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors21.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Get a ${import_picocolors23.default.bold("sk_test_")} key at ${import_picocolors23.default.cyan("https://abloatai.com")}`,
+    `Run ${import_picocolors23.default.bold("npx ablo login")} (or add ${import_picocolors23.default.bold("ABLO_API_KEY")} to ${import_picocolors23.default.bold(envFile)})`,
+    `Set ${import_picocolors23.default.bold("DATABASE_URL")} in ${import_picocolors23.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors23.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "replication" ? [
-      `Connect your database \u2014 ${import_picocolors21.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
-      `Verify it \u2014 ${import_picocolors21.default.bold("npx ablo connect --check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
-      `Register it \u2014 ${import_picocolors21.default.bold("npx ablo connect --register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
+      `Connect your database \u2014 ${import_picocolors23.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
+      `Verify it \u2014 ${import_picocolors23.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
+      `Register it \u2014 ${import_picocolors23.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
     ] : [
-      `Provision your DB: ${import_picocolors21.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors21.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors21.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors23.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors23.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors23.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors21.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors21.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors21.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors23.default.bold((0, import_path7.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors23.default.bold("<Providers>")} (${(0, import_path7.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors23.default.bold((0, import_path7.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
-    `Run ${import_picocolors21.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors23.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors21.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
-      `Run ${import_picocolors21.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors23.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
+      `Run ${import_picocolors23.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
   const existingKey = resolveApiKey("sandbox");
   if (existingKey) {
     await ensureInitProject(opts);
-    Se(`Already authorized ${import_picocolors21.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)} \u2014 run ${import_picocolors21.default.bold("npx ablo push")} next. ${import_picocolors21.default.dim("Docs:")} https://abloatai.com/docs`);
+    Se(`Already authorized ${import_picocolors23.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)} \u2014 run ${import_picocolors23.default.bold("npx ablo push")} next. ${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
     return;
   }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors21.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       await ensureInitProject(opts);
       return;
     }
   }
-  Se(`Run ${import_picocolors21.default.bold("npx ablo login")} when ready. ${import_picocolors21.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors23.default.bold("npx ablo login")} when ready. ${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
 }
 function generateSchema() {
   return `import { defineSchema, model, relation, z } from '@abloatai/ablo/schema';
@@ -285607,9 +286065,9 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
 `;
 }
 function detectPackageManager() {
-  if ((0, import_fs13.existsSync)("pnpm-lock.yaml")) return "pnpm";
-  if ((0, import_fs13.existsSync)("yarn.lock")) return "yarn";
-  if ((0, import_fs13.existsSync)("bun.lockb")) return "bun";
+  if ((0, import_fs12.existsSync)("pnpm-lock.yaml")) return "pnpm";
+  if ((0, import_fs12.existsSync)("yarn.lock")) return "yarn";
+  if ((0, import_fs12.existsSync)("bun.lockb")) return "bun";
   return "npm";
 }
 main().catch((err) => {