@abloatai/ablo 0.33.0 → 0.34.1

package/dist/cli.cjs

@@ -787,8 +787,8 @@ ${import_picocolors2.default.gray(d2)}  ${t}
           if (i) process.stdout.write(`${I2}  ${l2}...`);
           else if (t === "timer") process.stdout.write(`${I2}  ${l2} ${O2(g2)}`);
           else {
-            const z8 = ".".repeat(Math.floor(w2)).slice(0, 3);
-            process.stdout.write(`${I2}  ${l2}${z8}`);
+            const z9 = ".".repeat(Math.floor(w2)).slice(0, 3);
+            process.stdout.write(`${I2}  ${l2}${z9}`);
           }
           h2 = h2 + 1 < n.length ? h2 + 1 : 0, w2 = w2 < n.length ? w2 + 0.125 : 0;
         }, r2);
@@ -909,7 +909,7 @@ var init_errorCodes = __esm({
       model_claimed: wire("claim", 409, false, "Another participant holds a claim on this row. Read `claim.state` to see who holds it, or queue behind them with a claim of your own."),
       model_claimed_timeout: wire("claim", 409, false, "Another participant held a claim on this row and did not release it in time. Retry, or read `claim.state` to see who holds it."),
       model_claim_not_configured: client("claim", "Claiming requires the collaboration runtime, which the standard Ablo({ schema, apiKey }) client wires up for every model automatically \u2014 there is no per-model claim configuration to add. This appears only when a model proxy is constructed directly without that runtime (an internal/advanced path)."),
-      model_watch_not_configured: client("claim", "watch() opens a presence/claim subscription and needs a live WebSocket, so it is unavailable on the HTTP transport and on model proxies built without a socket. Use the standard Ablo({ schema, apiKey }) client (default WebSocket transport)."),
+      model_join_not_configured: client("claim", "join() opens a presence/claim subscription and needs a live WebSocket, so it is unavailable on the HTTP transport and on model proxies built without a socket. Use the standard Ablo({ schema, apiKey }) client (default WebSocket transport)."),
       // ── stale context / idempotency (409) ──────────────────────────────
       // Not retryable at the transport: the rejected request carries its frozen
       // `readAt`, so resending the identical payload can never succeed. Recovery
@@ -1199,7 +1199,7 @@ var init_roles = __esm({
 });
 
 // src/coordination/schema.ts
-var import_zod3, targetRangeSchema, participantKindSchema, wireParticipantKindSchema, targetRefSchema, onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, claimStatusSchema, grantStampFields, wireClaimBaseSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, claimLostSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatFieldsSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, commitOperationTypeSchema, commitOperationSchema, presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema;
+var import_zod3, targetRangeSchema, participantKindSchema, wireParticipantKindSchema, targetRefSchema, onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, trackDependencySchema, claimStatusSchema, grantStampFields, wireClaimBaseSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, claimLostSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatFieldsSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, commitOperationTypeSchema, commitOperationSchema, presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema;
 var init_schema = __esm({
   "src/coordination/schema.ts"() {
     "use strict";
@@ -1284,6 +1284,17 @@ var init_schema = __esm({
         onStale: onStaleModeSchema.optional()
       })
     ]);
+    trackDependencySchema = import_zod3.z.union([
+      import_zod3.z.object({
+        model: import_zod3.z.string(),
+        id: import_zod3.z.string(),
+        readAt: import_zod3.z.number().optional()
+      }),
+      import_zod3.z.object({
+        group: import_zod3.z.string(),
+        readAt: import_zod3.z.number().optional()
+      })
+    ]);
     claimStatusSchema = import_zod3.z.enum([
       "active",
       "committed",
@@ -5594,7 +5605,8 @@ async function registerDirectDataSource(opts) {
     console.log(
       `
   ${import_picocolors6.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors6.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors6.default.dim(`(${body2.id})`)}` : ""} as a direct DataSource (${statusNote}).
-  Customer COMMIT is durable acceptance; correlated WAL promotes queued writes to confirmed.
+  Your database is connected. Reads follow its replication stream; writes go through Ablo
+  and land in your own tables. Check the connection anytime with ${import_picocolors6.default.cyan("ablo connect check")}.
 `
     );
     return true;
@@ -5829,12 +5841,130 @@ var init_disconnect = __esm({
   }
 });
 
+// src/cli/connectOwnership.ts
+function ownershipBlockers(rows) {
+  return rows.filter((row) => !row.can_manage && !row.is_superuser).map((row) => ({
+    relation: row.relation,
+    owner: row.owner,
+    canGrantInherit: row.can_grant_inherit
+  }));
+}
+function ownershipRemediation(blockers, admin) {
+  const grantableByOwner = /* @__PURE__ */ new Map();
+  for (const blocker of blockers) {
+    grantableByOwner.set(
+      blocker.owner,
+      (grantableByOwner.get(blocker.owner) ?? false) || blocker.canGrantInherit
+    );
+  }
+  const resolvedOwners = /* @__PURE__ */ new Set();
+  const inheritGrants = [];
+  for (const [owner, grantable] of grantableByOwner) {
+    if (grantable) {
+      inheritGrants.push(`GRANT ${quoteIdent(owner)} TO ${quoteIdent(admin)} WITH INHERIT TRUE;`);
+      resolvedOwners.add(owner);
+    }
+  }
+  const unresolved = blockers.filter((blocker) => !resolvedOwners.has(blocker.owner));
+  return { inheritGrants, unresolved };
+}
+async function publishedTableBlockers(sql, tables) {
+  const scoped = tables.length > 0;
+  const raw = await sql.unsafe(
+    `SELECT format('%I.%I', n.nspname, c.relname) AS relation, ${OWNERSHIP_COLUMNS}
+     ${OWNERSHIP_FROM}
+      WHERE c.relkind = 'r'
+        AND n.nspname = 'public'
+        AND c.relname <> 'ablo_idempotency'
+        ${scoped ? "AND c.relname = ANY($1)" : ""}`,
+    scoped ? [tables] : []
+  );
+  return ownershipBlockers(import_zod7.z.array(ownedRelationRowSchema).parse(raw));
+}
+async function ledgerBlocker(sql) {
+  const raw = await sql.unsafe(
+    `SELECT format('%I.%I', n.nspname, c.relname) AS relation, ${OWNERSHIP_COLUMNS}
+     ${OWNERSHIP_FROM}
+      WHERE c.relkind = 'r'
+        AND n.nspname = 'public'
+        AND c.relname = 'ablo_idempotency'`
+  );
+  const rows = import_zod7.z.array(ownedRelationRowSchema).parse(raw);
+  const row = rows[0];
+  if (!row) return null;
+  return ownershipBlockers([row])[0] ?? null;
+}
+function formatUnresolvedOwnership(unresolved, admin, target) {
+  const list = unresolved.map((b4) => `${b4.relation} (owned by ${b4.owner})`).join("\n      ");
+  const owners = [...new Set(unresolved.map((b4) => b4.owner))];
+  const ownerNames = owners.map((o2) => import_picocolors8.default.bold(o2)).join(", ");
+  const grants = owners.map((o2) => `GRANT ${quoteIdent(o2)} TO ${quoteIdent(admin)} WITH INHERIT TRUE;`).join(" ");
+  const one = unresolved.length === 1;
+  const hasLedger = unresolved.some((b4) => b4.relation.endsWith(".ablo_idempotency"));
+  return import_picocolors8.default.red(
+    `
+  ${import_picocolors8.default.bold(String(unresolved.length))} relation${one ? "" : "s"} on ${target} ${one ? "is" : "are"} owned by a role ${import_picocolors8.default.bold(admin)} can't manage or take over:`
+  ) + `
+      ${list}
+
+  Apply grants your admin inheritance of an owning role for you when it may, but ${admin}
+  isn't a member with admin option of ${ownerNames}, so it can't here. Re-run ${import_picocolors8.default.bold("--url")} as a
+  role that owns ${one ? "it" : "them"}, or have a role with admin option on ${ownerNames} (or a
+  superuser) run:
+      ${import_picocolors8.default.cyan(grants)}
+` + (hasLedger ? `
+  For ${import_picocolors8.default.bold("ablo_idempotency")} you can instead drop it \u2014 it holds only idempotency replay
+  records, safe to drop when no commit is in flight \u2014 and Ablo recreates it under this admin:
+      ${import_picocolors8.default.cyan("DROP TABLE ablo_idempotency;")}
+` : "");
+}
+var import_zod7, import_picocolors8, ownedRelationRowSchema, OWNERSHIP_COLUMNS, OWNERSHIP_FROM;
+var init_connectOwnership = __esm({
+  "src/cli/connectOwnership.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod7 = require("zod");
+    import_picocolors8 = __toESM(require_picocolors(), 1);
+    init_connectSetup();
+    ownedRelationRowSchema = import_zod7.z.object({
+      /** Schema-qualified relation, e.g. `public.documents`. */
+      relation: import_zod7.z.string(),
+      owner: import_zod7.z.string(),
+      /**
+       * The admin can act as the owner for grants — it owns the relation OR is an
+       * INHERITing member of the owning role (`pg_has_role(current_user, owner,
+       * 'USAGE')`). A plain NOINHERIT membership is false: the plan doesn't
+       * `SET ROLE`, so the grant would fail.
+       */
+      can_manage: import_zod7.z.boolean(),
+      is_superuser: import_zod7.z.boolean(),
+      /**
+       * The admin is a member of the owning role WITH admin option, so it can run
+       * `GRANT <owner> TO <admin> WITH INHERIT TRUE` itself to gain the inheritance
+       * the grants need — the runnable fix reassigning ownership can't be.
+       */
+      can_grant_inherit: import_zod7.z.boolean()
+    });
+    OWNERSHIP_COLUMNS = `
+        pg_get_userbyid(c.relowner) AS owner,
+        pg_has_role(current_user, c.relowner, 'USAGE') AS can_manage,
+        r.rolsuper AS is_superuser,
+        EXISTS (
+          SELECT 1 FROM pg_auth_members m
+           WHERE m.member = r.oid AND m.roleid = c.relowner AND m.admin_option
+        ) AS can_grant_inherit`;
+    OWNERSHIP_FROM = `
+   FROM pg_class c
+   JOIN pg_namespace n ON n.oid = c.relnamespace
+   JOIN pg_roles r ON r.rolname = current_user`;
+  }
+});
+
 // src/cli/connectApply.ts
 var connectApply_exports = {};
 __export(connectApply_exports, {
   connectApplyPlan: () => connectApplyPlan,
   detectProvider: () => detectProvider,
-  ledgerBlockedBy: () => ledgerBlockedBy,
   logicalReplicationGuidance: () => logicalReplicationGuidance,
   passwordClause: () => passwordClause,
   postRegistrationOutcome: () => postRegistrationOutcome,
@@ -5890,7 +6020,16 @@ EXCEPTION WHEN duplicate_object THEN NULL;
 END $$;`
   ];
   const publicationDetail = reconcile2?.sql.length === 0 ? "already publishing exactly these tables \u2014 nothing to change" : tables.length > 0 ? `a read stream of the ${tables.length} table${tables.length === 1 ? "" : "s"} you chose` : "a read stream of your tables";
+  const ownStep = input.inheritGrants && input.inheritGrants.length > 0 ? [
+    {
+      key: "own",
+      title: "Let this admin manage tables owned by another role",
+      detail: "your admin inherits the owning role so the steps below apply \u2014 reversible, no ownership change",
+      sql: input.inheritGrants
+    }
+  ] : [];
   return [
+    ...ownStep,
     ...walStep,
     {
       key: "publication",
@@ -5932,15 +6071,15 @@ function printPlan2(steps, showSql) {
   console.log(`  This sets up your database for Ablo:
 `);
   for (const step of steps) {
-    console.log(`    ${import_picocolors8.default.green("\u2022")} ${step.title}`);
+    console.log(`    ${import_picocolors9.default.green("\u2022")} ${step.title}`);
     if (showSql) {
       for (const statement of step.sql) {
-        for (const line of statement.split("\n")) console.log(`        ${import_picocolors8.default.dim(line)}`);
+        for (const line of statement.split("\n")) console.log(`        ${import_picocolors9.default.dim(line)}`);
       }
     }
   }
   console.log(
-    import_picocolors8.default.dim(
+    import_picocolors9.default.dim(
       `
   Your admin password stays on this machine.${showSql ? "" : " (--show-sql for the exact statements)"}
 `
@@ -5953,24 +6092,6 @@ async function adminCanCreateRoles(sql) {
   );
   return rows[0] ?? null;
 }
-function ledgerBlockedBy(row) {
-  if (!row || row.is_owner || row.is_superuser) return null;
-  return row.owner;
-}
-async function unmanageableLedgerOwner(sql) {
-  const rows = await sql.unsafe(
-    `SELECT pg_get_userbyid(c.relowner) AS owner,
-            c.relowner = r.oid AS is_owner,
-            r.rolsuper AS is_superuser
-       FROM pg_class c
-       JOIN pg_namespace n ON n.oid = c.relnamespace
-       JOIN pg_roles r ON r.rolname = current_user
-      WHERE c.relkind = 'r'
-        AND c.relname = 'ablo_idempotency'
-        AND n.nspname = 'public'`
-  );
-  return ledgerBlockedBy(rows[0]);
-}
 function detectProvider(hostOrTarget) {
   const host = hostOrTarget.toLowerCase();
   if (host.includes("neon.tech")) return "neon";
@@ -6029,8 +6150,8 @@ async function runConnectApply(args) {
   const adminUrl = args.url ?? readProjectAdminDatabaseUrl();
   if (!adminUrl) {
     console.error(
-      import_picocolors8.default.red("  No admin connection string.") + import_picocolors8.default.dim(
-        ` Pass ${import_picocolors8.default.bold("--url <admin-conn>")} (or set ${import_picocolors8.default.bold("DATABASE_URL")}) and re-run.`
+      import_picocolors9.default.red("  No admin connection string.") + import_picocolors9.default.dim(
+        ` Pass ${import_picocolors9.default.bold("--url <admin-conn>")} (or set ${import_picocolors9.default.bold("DATABASE_URL")}) and re-run.`
       )
     );
     process.exit(1);
@@ -6045,19 +6166,19 @@ async function runConnectApply(args) {
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(
-      import_picocolors8.default.red("  Not logged in.") + import_picocolors8.default.dim(
-        ` Run ${import_picocolors8.default.bold("ablo login")} (or set ${import_picocolors8.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
+      import_picocolors9.default.red("  Not logged in.") + import_picocolors9.default.dim(
+        ` Run ${import_picocolors9.default.bold("ablo login")} (or set ${import_picocolors9.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
       )
     );
     process.exit(1);
   }
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors8.default.dim(verb)}  ${import_picocolors8.default.dim(rotating ? "re-key the scoped roles" : "set up your database for Ablo")}
+  ${brand("ablo")} ${import_picocolors9.default.dim(verb)}  ${import_picocolors9.default.dim(rotating ? "re-key the scoped roles" : "set up your database for Ablo")}
 `
   );
   console.log(
-    `  ${import_picocolors8.default.dim("\u2192")} ${import_picocolors8.default.bold(target)}${adminSource === "DATABASE_URL" ? import_picocolors8.default.dim("  (admin via DATABASE_URL)") : ""}
+    `  ${import_picocolors9.default.dim("\u2192")} ${import_picocolors9.default.bold(target)}${adminSource === "DATABASE_URL" ? import_picocolors9.default.dim("  (admin via DATABASE_URL)") : ""}
 `
   );
   const admin = src_default(adminUrl, {
@@ -6073,31 +6194,25 @@ async function runConnectApply(args) {
   } catch (err) {
     await admin.end({ timeout: 2 }).catch(() => void 0);
     const pg = err ?? {};
-    console.error(import_picocolors8.default.red(`  Couldn't connect: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors9.default.red(`  Couldn't connect: ${pg.message ?? String(err)}`));
     process.exit(1);
   }
   if (!capability || !(capability.rolsuper || capability.rolcreaterole)) {
     await admin.end({ timeout: 2 });
     console.error(
-      import_picocolors8.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors8.default.dim(` Point ${import_picocolors8.default.bold("--url")} at your owner/admin connection and re-run.`)
+      import_picocolors9.default.red(`  ${capability?.rolname ?? "This role"} can't create roles.`) + import_picocolors9.default.dim(` Point ${import_picocolors9.default.bold("--url")} at your owner/admin connection and re-run.`)
     );
     process.exit(1);
   }
-  const blockingOwner = await unmanageableLedgerOwner(admin).catch(() => null);
-  if (blockingOwner) {
+  const ledger = await ledgerBlocker(admin).catch(() => null);
+  const foreignTables = await publishedTableBlockers(admin, args.tables).catch(() => []);
+  const { inheritGrants, unresolved } = ownershipRemediation(
+    [...ledger ? [ledger] : [], ...foreignTables],
+    capability.rolname
+  );
+  if (unresolved.length > 0) {
     await admin.end({ timeout: 2 });
-    console.error(
-      import_picocolors8.default.red(
-        `
-  ${import_picocolors8.default.bold("ablo_idempotency")} already exists on ${target}, owned by ${import_picocolors8.default.bold(blockingOwner)}, but you connected as ${import_picocolors8.default.bold(capability.rolname)}.`
-      ) + `
-  Ablo's setup grants the writer role access to this ledger, and Postgres reserves that
-  for the table's owner. Either re-run pointing ${import_picocolors8.default.bold("--url")} at ${import_picocolors8.default.bold(blockingOwner)}'s connection,
-  or drop the existing ledger so Ablo recreates it under this admin \u2014 it holds only
-  idempotency replay records, safe to drop when no commit is in flight:
-      ${import_picocolors8.default.cyan("DROP TABLE ablo_idempotency;")}
-`
-    );
+    console.error(formatUnresolvedOwnership(unresolved, capability.rolname, target));
     process.exit(1);
   }
   const provider = detectProvider(target);
@@ -6118,18 +6233,19 @@ async function runConnectApply(args) {
     },
     walAlreadyLogical: walReady,
     provider,
-    existingPublication
+    existingPublication,
+    inheritGrants
   });
   const steps = buildPlan("scram-verifier");
   if (pubReconcile.removed.length > 0 || pubReconcile.recreated) {
     console.log(
-      `  ${import_picocolors8.default.yellow("!")} ${import_picocolors8.default.bold(ABLO_PUBLICATION)} already publishes a different set; reconciling to your ${import_picocolors8.default.bold("--tables")}:`
+      `  ${import_picocolors9.default.yellow("!")} ${import_picocolors9.default.bold(ABLO_PUBLICATION)} already publishes a different set; reconciling to your ${import_picocolors9.default.bold("--tables")}:`
     );
-    for (const t of pubReconcile.added) console.log(`      ${import_picocolors8.default.green("+")} ${t}`);
+    for (const t of pubReconcile.added) console.log(`      ${import_picocolors9.default.green("+")} ${t}`);
     for (const t of pubReconcile.removed)
-      console.log(`      ${import_picocolors8.default.red("-")} ${t} ${import_picocolors8.default.dim("(stops replicating to Ablo)")}`);
+      console.log(`      ${import_picocolors9.default.red("-")} ${t} ${import_picocolors9.default.dim("(stops replicating to Ablo)")}`);
     if (pubReconcile.recreated && existingPublication.allTables)
-      console.log(`      ${import_picocolors8.default.red("-")} ${import_picocolors8.default.dim("every other table (was FOR ALL TABLES)")}`);
+      console.log(`      ${import_picocolors9.default.red("-")} ${import_picocolors9.default.dim("every other table (was FOR ALL TABLES)")}`);
     console.log();
   }
   printPlan2(steps, args.showSql);
@@ -6137,7 +6253,7 @@ async function runConnectApply(args) {
     if (!process.stdout.isTTY) {
       await admin.end({ timeout: 2 });
       console.error(
-        import_picocolors8.default.dim(`  Re-run with ${import_picocolors8.default.bold("--yes")} to apply this in a non-interactive session.
+        import_picocolors9.default.dim(`  Re-run with ${import_picocolors9.default.bold("--yes")} to apply this in a non-interactive session.
 `)
       );
       process.exit(1);
@@ -6149,7 +6265,7 @@ async function runConnectApply(args) {
     if (pD(proceed) || !proceed) {
       await admin.end({ timeout: 2 });
       console.log(
-        import_picocolors8.default.dim(`  Nothing applied. Run ${import_picocolors8.default.bold("ablo connect")} to see the manual recipe.
+        import_picocolors9.default.dim(`  Nothing applied. Run ${import_picocolors9.default.bold("ablo connect")} to see the manual recipe.
 `)
       );
       process.exit(0);
@@ -6161,8 +6277,8 @@ async function runConnectApply(args) {
     await admin.end({ timeout: 2 }).catch(() => void 0);
     const pg = err ?? {};
     console.error(
-      import_picocolors8.default.red(`
-  Setup stopped: ${pg.message ?? String(err)}`) + import_picocolors8.default.dim(`  Every step is safe to re-run.
+      import_picocolors9.default.red(`
+  Setup stopped: ${pg.message ?? String(err)}`) + import_picocolors9.default.dim(`  Every step is safe to re-run.
 `)
     );
     process.exit(1);
@@ -6173,14 +6289,14 @@ async function runConnectApply(args) {
   const replicationUrl = rewriteDatabaseUrl(adminUrl, role, replicationPassword);
   const writeUrl = rewriteDatabaseUrl(adminUrl, writeRole, writePassword);
   console.log(`
-  ${import_picocolors8.default.green("\u2713")} Roles ${rotating ? "re-keyed" : "created"}.
+  ${import_picocolors9.default.green("\u2713")} Roles ${rotating ? "re-keyed" : "created"}.
 `);
   if (!walReady) {
     console.error(
-      `  ${import_picocolors8.default.yellow("!")} One step left \u2014 logical replication isn't on yet.
+      `  ${import_picocolors9.default.yellow("!")} One step left \u2014 logical replication isn't on yet.
     ${logicalReplicationGuidance(provider)}.
 
-  Then re-run:  ${import_picocolors8.default.cyan(`npx ablo ${verb}`)}
+  Then re-run:  ${import_picocolors9.default.cyan(`npx ablo ${verb}`)}
 `
     );
     process.exit(1);
@@ -6197,15 +6313,15 @@ async function runConnectApply(args) {
     items = await probeReadiness(verifier);
   } catch {
     items = null;
-    console.log(import_picocolors8.default.dim(`  Couldn't verify from here; Ablo will validate from its own network.
+    console.log(import_picocolors9.default.dim(`  Couldn't verify from here; Ablo will validate from its own network.
 `));
   }
   await verifier.end({ timeout: 2 }).catch(() => void 0);
   const failed = items?.filter((i) => !i.ok) ?? [];
   if (failed.length > 0) {
-    for (const item of failed) console.log(`  ${import_picocolors8.default.yellow("!")} ${item.label}`);
+    for (const item of failed) console.log(`  ${import_picocolors9.default.yellow("!")} ${item.label}`);
     console.log(`
-  ${import_picocolors8.default.dim("Resolve, then re-run")}  ${import_picocolors8.default.cyan(`npx ablo ${verb}`)}
+  ${import_picocolors9.default.dim("Resolve, then re-run")}  ${import_picocolors9.default.cyan(`npx ablo ${verb}`)}
 `);
     process.exit(1);
   }
@@ -6220,20 +6336,21 @@ async function runConnectApply(args) {
   const outcome = postRegistrationOutcome({ rotating, registered });
   if (outcome.notice) {
     console.error(`
-  ${import_picocolors8.default.red(outcome.notice.split("\n").join("\n  "))}
+  ${import_picocolors9.default.red(outcome.notice.split("\n").join("\n  "))}
 `);
   }
   process.exit(outcome.exitCode);
 }
-var import_picocolors8;
+var import_picocolors9;
 var init_connectApply = __esm({
   "src/cli/connectApply.ts"() {
     "use strict";
     init_cjs_shims();
-    import_picocolors8 = __toESM(require_picocolors(), 1);
+    import_picocolors9 = __toESM(require_picocolors(), 1);
     init_src();
     init_dist2();
     init_connectSetup();
+    init_connectOwnership();
     init_dbRole();
     init_config();
     init_push();
@@ -218258,11 +218375,11 @@ var require_commonjs2 = __commonJS({
               if (pad) {
                 const need = width - c.length;
                 if (need > 0) {
-                  const z8 = new Array(need + 1).join("0");
+                  const z9 = new Array(need + 1).join("0");
                   if (i < 0) {
-                    c = "-" + z8 + c.slice(1);
+                    c = "-" + z9 + c.slice(1);
                   } else {
-                    c = z8 + c;
+                    c = z9 + c;
                   }
                 }
               }
@@ -282191,7 +282308,7 @@ Node text: ${this.#forgottenText}`;
 // src/cli/index.ts
 init_cjs_shims();
 init_dist2();
-var import_picocolors23 = __toESM(require_picocolors(), 1);
+var import_picocolors24 = __toESM(require_picocolors(), 1);
 var import_fs12 = require("fs");
 var import_path7 = require("path");
 var import_child_process3 = require("child_process");
@@ -282382,7 +282499,7 @@ async function migrate(argv) {
 // src/cli/connect.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 init_src();
 init_dbRole();
 init_config();
@@ -282614,7 +282731,7 @@ function printConnectRecipe(args) {
   });
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors9.default.dim("connect")}  ${import_picocolors9.default.dim("direct writes + WAL-settled sync")}
+  ${brand("ablo")} ${import_picocolors10.default.dim("connect")}  ${import_picocolors10.default.dim("direct writes + WAL-settled sync")}
 `
   );
   console.log(
@@ -282622,29 +282739,29 @@ function printConnectRecipe(args) {
   observes what committed, orders it with external writes, and confirms it in the sync log.
   Your database stays authoritative; Ablo never owns or migrates your application tables.
 
-  ${import_picocolors9.default.bold("ablo connect apply")} runs every step below for you from a one-time admin
-  connection and leaves your app holding only ${import_picocolors9.default.bold("ABLO_API_KEY")}. To do it by hand,
-  run this once against your Postgres ${import_picocolors9.default.dim("(as a superuser / DB owner)")}:
+  ${import_picocolors10.default.bold("ablo connect apply")} runs every step below for you from a one-time admin
+  connection and leaves your app holding only ${import_picocolors10.default.bold("ABLO_API_KEY")}. To do it by hand,
+  run this once against your Postgres ${import_picocolors10.default.dim("(as a superuser / DB owner)")}:
 `
   );
   console.log(
-    `  ${import_picocolors9.default.bold("1.")} Enable logical decoding ${import_picocolors9.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`
+    `  ${import_picocolors10.default.bold("1.")} Enable logical decoding ${import_picocolors10.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`
   );
-  console.log(`       ${import_picocolors9.default.cyan(sql[0])}`);
+  console.log(`       ${import_picocolors10.default.cyan(sql[0])}`);
   console.log(
-    import_picocolors9.default.dim(
-      `       Managed hosts don't take ALTER SYSTEM: on Amazon RDS / Aurora set ${import_picocolors9.default.bold("rds.logical_replication = 1")}
+    import_picocolors10.default.dim(
+      `       Managed hosts don't take ALTER SYSTEM: on Amazon RDS / Aurora set ${import_picocolors10.default.bold("rds.logical_replication = 1")}
        in the parameter group and reboot; on Neon or Supabase enable logical replication in the
-       project settings. ${import_picocolors9.default.bold("ablo connect apply")} detects the host and does the right thing.`
+       project settings. ${import_picocolors10.default.bold("ablo connect apply")} detects the host and does the right thing.`
     )
   );
   console.log(`
-  ${import_picocolors9.default.bold("2.")} Publish the tables Ablo should read`);
-  console.log(`       ${import_picocolors9.default.cyan(sql[1])}`);
+  ${import_picocolors10.default.bold("2.")} Publish the tables Ablo should read`);
+  console.log(`       ${import_picocolors10.default.cyan(sql[1])}`);
   if (args.tables.length === 0) {
     console.log(
-      import_picocolors9.default.dim(
-        `       (Scope it with ${import_picocolors9.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`
+      import_picocolors10.default.dim(
+        `       (Scope it with ${import_picocolors10.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`
       )
     );
   }
@@ -282653,52 +282770,52 @@ function printConnectRecipe(args) {
   const writerStatements = sql.slice(writerStart);
   console.log(
     `
-  ${import_picocolors9.default.bold("3.")} Create the scoped replication role ${import_picocolors9.default.dim("(pick your own replication password)")}`
+  ${import_picocolors10.default.bold("3.")} Create the scoped replication role ${import_picocolors10.default.dim("(pick your own replication password)")}`
   );
   for (const statement of replicationStatements) {
-    for (const line of statement.split("\n")) console.log(`       ${import_picocolors9.default.cyan(line)}`);
+    for (const line of statement.split("\n")) console.log(`       ${import_picocolors10.default.cyan(line)}`);
   }
   console.log(
-    import_picocolors9.default.dim(
+    import_picocolors10.default.dim(
       `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
-       ${import_picocolors9.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
+       ${import_picocolors10.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
     )
   );
   console.log(
     `
-  ${import_picocolors9.default.bold("4.")} Create the separate DML role and the idempotency ledger ` + import_picocolors9.default.dim("(pick your own write password)")
+  ${import_picocolors10.default.bold("4.")} Create the separate DML role and the idempotency ledger ` + import_picocolors10.default.dim("(pick your own write password)")
   );
   for (const statement of writerStatements) {
-    for (const line of statement.split("\n")) console.log(`       ${import_picocolors9.default.cyan(line)}`);
+    for (const line of statement.split("\n")) console.log(`       ${import_picocolors10.default.cyan(line)}`);
   }
   console.log(
-    import_picocolors9.default.dim(
+    import_picocolors10.default.dim(
       `       The writer gets row DML + ledger access only. It has no REPLICATION, schema CREATE,
        role administration, database creation, ownership, or customer-table DDL. Direct uses
-       ${import_picocolors9.default.bold("ablo_idempotency")} but no outbox; WAL carries the committed row changes.
-       Each ledger row carries an ${import_picocolors9.default.bold("expires_at")}; the writer can't DELETE (tamper-
+       ${import_picocolors10.default.bold("ablo_idempotency")} but no outbox; WAL carries the committed row changes.
+       Each ledger row carries an ${import_picocolors10.default.bold("expires_at")}; the writer can't DELETE (tamper-
        resistance), so prune it from your own admin/cron when convenient:
-       ${import_picocolors9.default.bold("DELETE FROM ablo_idempotency WHERE expires_at < now();")}`
+       ${import_picocolors10.default.bold("DELETE FROM ablo_idempotency WHERE expires_at < now();")}`
     )
   );
   console.log(
     `
-  ${import_picocolors9.default.bold("5.")} Register the two roles with Ablo. Set them just long enough to register \u2014
-     Ablo holds them from here, so your app keeps only ${import_picocolors9.default.bold("ABLO_API_KEY")}:
-       ${import_picocolors9.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors9.default.dim(`\u2192 ${args.role} (replication only)`)}
-       ${import_picocolors9.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors9.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
-       ${import_picocolors9.default.cyan("npx ablo connect register")}
+  ${import_picocolors10.default.bold("5.")} Register the two roles with Ablo. Set them just long enough to register \u2014
+     Ablo holds them from here, so your app keeps only ${import_picocolors10.default.bold("ABLO_API_KEY")}:
+       ${import_picocolors10.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors10.default.dim(`\u2192 ${args.role} (replication only)`)}
+       ${import_picocolors10.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors10.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
+       ${import_picocolors10.default.cyan("npx ablo connect register")}
 `
   );
   console.log(
-    `  ${import_picocolors9.default.bold("6.")} Verify readiness ${import_picocolors9.default.dim("(checked from Ablo\u2019s side \u2014 needs only ABLO_API_KEY):")}
-       ${import_picocolors9.default.cyan("npx ablo connect check")}
+    `  ${import_picocolors10.default.bold("6.")} Verify readiness ${import_picocolors10.default.dim("(checked from Ablo\u2019s side \u2014 needs only ABLO_API_KEY):")}
+       ${import_picocolors10.default.cyan("npx ablo connect check")}
 `
   );
   console.log(
-    import_picocolors9.default.dim(
+    import_picocolors10.default.dim(
       `  Reachable databases use this direct path. If no inbound route can be established, use the
-  signed ${import_picocolors9.default.bold("dataSource()")} endpoint fallback; its correlated events confirm writes
+  signed ${import_picocolors10.default.bold("dataSource()")} endpoint fallback; its correlated events confirm writes
   without an Ablo-side customer database socket.`
     )
   );
@@ -282713,11 +282830,11 @@ var SYNC_INFRA_RELATIONS = [
 var SYNC_INFRA_TYPES = ["participant_kind", "backfill_provenance", "confirmation_state"];
 function printCheckItem(item) {
   if (item.ok) {
-    console.log(`  ${import_picocolors9.default.green("\u2713")} ${item.label}`);
+    console.log(`  ${import_picocolors10.default.green("\u2713")} ${item.label}`);
   } else {
-    console.log(`  ${import_picocolors9.default.red("\u2717")} ${item.label}`);
+    console.log(`  ${import_picocolors10.default.red("\u2717")} ${item.label}`);
     if (item.fix) {
-      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors9.default.red("\u2022")} ${line}`);
+      for (const line of item.fix.split("\n")) console.log(`      ${import_picocolors10.default.red("\u2022")} ${line}`);
     }
   }
 }
@@ -282738,7 +282855,7 @@ async function probeDirectWriteReadiness(sql, opts = {}) {
       ok: false,
       label: `ABLO_WRITE_DATABASE_URL is not a scoped DML role`,
       fix: `Use ${ABLO_WRITE_ROLE} from the setup recipe: NOSUPERUSER, NOBYPASSRLS, NOCREATEDB, NOCREATEROLE, NOREPLICATION.`
-    } : { ok: true, label: `write role ${import_picocolors9.default.bold(role?.rolname ?? ABLO_WRITE_ROLE)} is DML-only` }
+    } : { ok: true, label: `write role ${import_picocolors10.default.bold(role?.rolname ?? ABLO_WRITE_ROLE)} is DML-only` }
   );
   const schemaRows = await sql.unsafe(
     `SELECT
@@ -282765,10 +282882,10 @@ async function probeDirectWriteReadiness(sql, opts = {}) {
   );
   const ledger = ledgerRows[0];
   items.push(
-    ledger?.present && ledger.writes && !ledger.deletes ? { ok: true, label: `${import_picocolors9.default.bold("ablo_idempotency")} is durable and protected from DELETE` } : {
+    ledger?.present && ledger.writes && !ledger.deletes ? { ok: true, label: `${import_picocolors10.default.bold("ablo_idempotency")} is durable and protected from DELETE` } : {
       ok: false,
-      label: `${import_picocolors9.default.bold("ablo_idempotency")} is missing or has unsafe grants`,
-      fix: `Apply the DML-role and idempotency-ledger statements printed by ${import_picocolors9.default.bold("ablo connect")}.`
+      label: `${import_picocolors10.default.bold("ablo_idempotency")} is missing or has unsafe grants`,
+      fix: `Apply the DML-role and idempotency-ledger statements printed by ${import_picocolors10.default.bold("ablo connect")}.`
     }
   );
   const tableRows = await sql.unsafe(
@@ -282857,8 +282974,8 @@ function requireScopedUrl(kind, verb) {
     const resolved = readProjectReplicationUrlWithSource();
     if (resolved) return resolved.url;
     console.error(
-      import_picocolors9.default.red("  No replication connection found (checked process env, .env.local, .env).") + import_picocolors9.default.dim(
-        ` Set ${import_picocolors9.default.bold("ABLO_REPLICATION_DATABASE_URL")} to the ${ABLO_REPLICATION_ROLE} connection printed by ${import_picocolors9.default.bold("ablo connect")}, then re-run ${import_picocolors9.default.bold(`ablo connect ${verb}`)}.`
+      import_picocolors10.default.red("  No replication connection found (checked process env, .env.local, .env).") + import_picocolors10.default.dim(
+        ` Set ${import_picocolors10.default.bold("ABLO_REPLICATION_DATABASE_URL")} to the ${ABLO_REPLICATION_ROLE} connection printed by ${import_picocolors10.default.bold("ablo connect")}, then re-run ${import_picocolors10.default.bold(`ablo connect ${verb}`)}.`
       )
     );
     process.exit(1);
@@ -282866,8 +282983,8 @@ function requireScopedUrl(kind, verb) {
   const dbUrl = readProjectWriteDatabaseUrl();
   if (dbUrl) return dbUrl;
   console.error(
-    import_picocolors9.default.red("  No ABLO_WRITE_DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors9.default.dim(
-      ` Set it to the ${ABLO_WRITE_ROLE} connection printed by ${import_picocolors9.default.bold("ablo connect")}, then re-run ${import_picocolors9.default.bold(`ablo connect ${verb}`)}. The replication credential is never reused for DML.`
+    import_picocolors10.default.red("  No ABLO_WRITE_DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors10.default.dim(
+      ` Set it to the ${ABLO_WRITE_ROLE} connection printed by ${import_picocolors10.default.bold("ablo connect")}, then re-run ${import_picocolors10.default.bold(`ablo connect ${verb}`)}. The replication credential is never reused for DML.`
     )
   );
   process.exit(1);
@@ -282883,7 +283000,7 @@ async function probeAndReport(dbUrl, kind = "replication") {
     const dial = dialFailureReason(err);
     if (dial) return { kind: "no-dial", reason: dial };
     const pg = err ?? {};
-    console.error(import_picocolors9.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors10.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
     process.exit(1);
   }
   await sql.end({ timeout: 2 });
@@ -282893,14 +283010,14 @@ async function probeAndReport(dbUrl, kind = "replication") {
 async function runCheck() {
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors9.default.dim("connect check")}  ${import_picocolors9.default.dim("direct-write + WAL readiness")}
+  ${brand("ablo")} ${import_picocolors10.default.dim("connect check")}  ${import_picocolors10.default.dim("direct-write + WAL readiness")}
 `
   );
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(
-      import_picocolors9.default.red("  No API key found.") + import_picocolors9.default.dim(
-        ` Run ${import_picocolors9.default.bold("ablo login")} (or set ${import_picocolors9.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors9.default.bold("ablo connect check")}.`
+      import_picocolors10.default.red("  No API key found.") + import_picocolors10.default.dim(
+        ` Run ${import_picocolors10.default.bold("ablo login")} (or set ${import_picocolors10.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors10.default.bold("ablo connect check")}.`
       )
     );
     process.exit(1);
@@ -282910,19 +283027,19 @@ async function runCheck() {
   if (!result.ok) {
     if (result.code === "no_data_source_registered") {
       console.error(
-        `  ${import_picocolors9.default.yellow("\u2014")} No database is connected to this plane yet, so there's nothing to check.
-` + import_picocolors9.default.dim(
-          `  Connect one with ${import_picocolors9.default.bold("ablo connect apply")}, then re-run ${import_picocolors9.default.bold("ablo connect check")}.
+        `  ${import_picocolors10.default.yellow("\u2014")} No database is connected to this plane yet, so there's nothing to check.
+` + import_picocolors10.default.dim(
+          `  Connect one with ${import_picocolors10.default.bold("ablo connect apply")}, then re-run ${import_picocolors10.default.bold("ablo connect check")}.
 `
         )
       );
       process.exit(1);
     }
-    console.error(import_picocolors9.default.red(`  The check failed: ${result.message}`));
+    console.error(import_picocolors10.default.red(`  The check failed: ${result.message}`));
     if (result.code === "forbidden") {
       console.error(
-        import_picocolors9.default.dim(
-          `  Checking a connected database needs a ${import_picocolors9.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors9.default.bold("ablo login")} for one.`
+        import_picocolors10.default.dim(
+          `  Checking a connected database needs a ${import_picocolors10.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors10.default.bold("ablo login")} for one.`
         )
       );
     }
@@ -282931,12 +283048,12 @@ async function runCheck() {
   }
   if (!result.reachable) {
     console.error(
-      `  ${import_picocolors9.default.red("\u2717")} Ablo's infrastructure can't reach your database${result.reason ? ` ${import_picocolors9.default.dim(`(${result.reason})`)}` : ""}.`
+      `  ${import_picocolors10.default.red("\u2717")} Ablo's infrastructure can't reach your database${result.reason ? ` ${import_picocolors10.default.dim(`(${result.reason})`)}` : ""}.`
     );
     console.error(
-      import_picocolors9.default.dim(
+      import_picocolors10.default.dim(
         `  Direct needs a route Ablo's servers can dial \u2014 public allowlist, PrivateLink, peering,
-  or VPN. Only when no inbound route can exist, use the signed ${import_picocolors9.default.bold("dataSource()")} endpoint fallback.
+  or VPN. Only when no inbound route can exist, use the signed ${import_picocolors10.default.bold("dataSource()")} endpoint fallback.
 `
       )
     );
@@ -282949,14 +283066,14 @@ async function runCheck() {
   console.log();
   if (result.ready) {
     console.log(
-      `  ${import_picocolors9.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Ablo can apply scoped DML and settle it from WAL.
+      `  ${import_picocolors10.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Ablo can apply scoped DML and settle it from WAL.
 `
     );
     process.exit(0);
   }
   const count = result.failures.length;
   console.log(
-    `  ${import_picocolors9.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors9.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors9.default.bold("ablo connect check")}.`)}
+    `  ${import_picocolors10.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors10.default.dim(`\u2014 apply the fixes above, then re-run ${import_picocolors10.default.bold("ablo connect check")}.`)}
 `
   );
   process.exit(1);
@@ -282967,22 +283084,22 @@ async function runRegister(args) {
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(
-      import_picocolors9.default.red("  Not logged in.") + import_picocolors9.default.dim(
-        ` Run ${import_picocolors9.default.bold("ablo login")} (or set ${import_picocolors9.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
+      import_picocolors10.default.red("  Not logged in.") + import_picocolors10.default.dim(
+        ` Run ${import_picocolors10.default.bold("ablo login")} (or set ${import_picocolors10.default.bold("ABLO_API_KEY")}) so Ablo knows which project to register this database for.`
       )
     );
     process.exit(1);
   }
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors9.default.dim("connect register")}  ${import_picocolors9.default.dim("register a direct DataSource")}
+  ${brand("ablo")} ${import_picocolors10.default.dim("connect register")}  ${import_picocolors10.default.dim("register a direct DataSource")}
 `
   );
-  console.log(`  ${import_picocolors9.default.bold("Replication role")}
+  console.log(`  ${import_picocolors10.default.bold("Replication role")}
 `);
   const replication = await probeAndReport(dbUrl, "replication");
   console.log(`
-  ${import_picocolors9.default.bold("Direct-write role")}
+  ${import_picocolors10.default.bold("Direct-write role")}
 `);
   const write = await probeAndReport(writeDbUrl, "write");
   const noDial = [
@@ -282992,7 +283109,7 @@ async function runRegister(args) {
   const failures = (replication.kind === "probed" ? replication.failures : 0) + (write.kind === "probed" ? write.failures : 0);
   if (noDial.length > 0) {
     console.log(
-      `  This machine can't reach one or both scoped connections (${import_picocolors9.default.dim(noDial.join("; "))}) \u2014 continuing anyway.
+      `  This machine can't reach one or both scoped connections (${import_picocolors10.default.dim(noDial.join("; "))}) \u2014 continuing anyway.
   Ablo validates both credentials from the infrastructure that will use them and refuses
   registration unless replication and direct DML are both ready.
 `
@@ -283001,7 +283118,7 @@ async function runRegister(args) {
   if (failures > 0) {
     console.log(
       `
-  ${import_picocolors9.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors9.default.dim("\u2014 direct registration requires both scoped roles. Fix the above, then re-run.")}
+  ${import_picocolors10.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors10.default.dim("\u2014 direct registration requires both scoped roles. Fix the above, then re-run.")}
 `
     );
     process.exit(1);
@@ -283025,31 +283142,31 @@ async function runScan() {
     artifacts = await auditTenantSyncInfra(sql);
   } catch (err) {
     const pg = err ?? {};
-    console.error(import_picocolors9.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
+    console.error(import_picocolors10.default.red(`  Couldn't audit the database: ${pg.message ?? String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
   await sql.end({ timeout: 2 });
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors9.default.dim("connect scan")}  ${import_picocolors9.default.dim("audit for leftover Ablo sync infrastructure")}
+  ${brand("ablo")} ${import_picocolors10.default.dim("connect scan")}  ${import_picocolors10.default.dim("audit for leftover Ablo sync infrastructure")}
 `
   );
   const present = artifacts.filter((a) => a.present);
   if (present.length === 0) {
-    console.log(`  ${import_picocolors9.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
+    console.log(`  ${import_picocolors10.default.green("\u2713")} No deprecated Ablo sync infrastructure found in public.
 `);
     process.exit(0);
   }
   for (const artifact of present) {
     const label = artifact.kind === "type" ? "type" : "relation";
-    console.log(`  ${import_picocolors9.default.yellow("!")} ${label} ${import_picocolors9.default.bold(`public.${artifact.name}`)} exists`);
+    console.log(`  ${import_picocolors10.default.yellow("!")} ${label} ${import_picocolors10.default.bold(`public.${artifact.name}`)} exists`);
   }
   console.log(
     `
-  ${import_picocolors9.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors9.default.dim(
+  ${import_picocolors10.default.yellow(`${present.length} artifact${present.length === 1 ? "" : "s"} found`)} ` + import_picocolors10.default.dim(
       "\u2014 do not drop automatically. Confirm the org/environment is log-authoritative, then follow "
-    ) + import_picocolors9.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors9.default.dim(".\n")
+    ) + import_picocolors10.default.bold("docs/runbooks/wal-stage5-customer-db-infra-cleanup.md") + import_picocolors10.default.dim(".\n")
   );
   process.exit(1);
 }
@@ -283063,7 +283180,7 @@ async function connect(argv) {
   try {
     args = parseConnectArgs(argv);
   } catch (err) {
-    console.error(import_picocolors9.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (args.apply || args.rotate) {
@@ -283119,7 +283236,7 @@ init_cjs_shims();
 init_errors();
 var import_fs6 = require("fs");
 var import_path4 = require("path");
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 var import_schema4 = require("@abloatai/ablo/schema");
 init_push();
 var DEFAULT_SCHEMA_PATH3 = "ablo/schema.ts";
@@ -283152,7 +283269,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors11.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -283161,20 +283278,20 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema4.serializeSchema)(schema));
     source = (0, import_schema4.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors11.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const abs = (0, import_path4.resolve)(process.cwd(), args.out);
   (0, import_fs6.mkdirSync)((0, import_path4.dirname)(abs), { recursive: true });
   (0, import_fs6.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors10.default.green("\u2713")} Generated types \u2192 ${import_picocolors10.default.bold(args.out)}`);
+  console.log(`  ${import_picocolors11.default.green("\u2713")} Generated types \u2192 ${import_picocolors11.default.bold(args.out)}`);
 }
 
 // src/cli/dev.ts
 init_cjs_shims();
 init_errors();
 init_credentialPolicy();
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 init_dist2();
 var import_fs7 = require("fs");
 var import_path5 = require("path");
@@ -283216,25 +283333,25 @@ function classifyKey(apiKey, activeMode) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors11.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors11.default.bold("ABLO_API_KEY")} (${import_picocolors11.default.bold("sk_test_")} = sandbox; ${import_picocolors11.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors11.default.dim(`Mode is currently '${activeMode}'.`)
+      reason: `No API key. Run ${import_picocolors12.default.bold("npx ablo login")} for the sandbox dev loop \u2014 or set ${import_picocolors12.default.bold("ABLO_API_KEY")} (${import_picocolors12.default.bold("sk_test_")} = sandbox; ${import_picocolors12.default.bold("sk_live_")} = deliberate production deploy). ` + import_picocolors12.default.dim(`Mode is currently '${activeMode}'.`)
     };
   }
   if (apiKey.startsWith("sk_test_")) return { ok: true };
   if (apiKey.startsWith("sk_live_")) {
     return {
       ok: false,
-      reason: `Production schema deploys run one-shot: ${import_picocolors11.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors11.default.bold("ablo mode production")}). ${import_picocolors11.default.bold("--watch")} is sandbox-only.`
+      reason: `Production schema deploys run one-shot: ${import_picocolors12.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")} (or ${import_picocolors12.default.bold("ablo mode production")}). ${import_picocolors12.default.bold("--watch")} is sandbox-only.`
     };
   }
   if (classifyCredentialKind(apiKey) === "restricted") {
     return {
       ok: false,
-      reason: `Restricted (${import_picocolors11.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors11.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors11.default.bold("sk_live_")} with ${import_picocolors11.default.bold("npx ablo push")} for a production deploy.`
+      reason: `Restricted (${import_picocolors12.default.bold("rk_")}) keys can't push schema. Use a secret key: ${import_picocolors12.default.bold("sk_test_")} for the sandbox dev loop, or ${import_picocolors12.default.bold("sk_live_")} with ${import_picocolors12.default.bold("npx ablo push")} for a production deploy.`
     };
   }
   return {
     ok: false,
-    reason: `${import_picocolors11.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors11.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors11.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors11.default.bold("npx ablo push")}).`
+    reason: `${import_picocolors12.default.bold("ABLO_API_KEY")} is not an Ablo key \u2014 expected ${import_picocolors12.default.bold("sk_test_\u2026")} (sandbox) or ${import_picocolors12.default.bold("sk_live_\u2026")} (production deploy via ${import_picocolors12.default.bold("npx ablo push")}).`
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
@@ -283244,7 +283361,7 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
   if (!(0, import_fs7.existsSync)(envPath)) {
     (0, import_fs7.writeFileSync)(envPath, `${line}
 `, { mode: 384 });
-    action = `Created ${import_picocolors11.default.bold(".env.local")} with ${import_picocolors11.default.bold("ABLO_API_KEY")}`;
+    action = `Created ${import_picocolors12.default.bold(".env.local")} with ${import_picocolors12.default.bold("ABLO_API_KEY")}`;
   } else {
     const content = (0, import_fs7.readFileSync)(envPath, "utf8");
     const match = /^ABLO_API_KEY=(.*)$/m.exec(content);
@@ -283252,12 +283369,12 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
     if (!match) {
       (0, import_fs7.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
 `);
-      action = `Added ${import_picocolors11.default.bold("ABLO_API_KEY")} to ${import_picocolors11.default.bold(".env.local")}`;
+      action = `Added ${import_picocolors12.default.bold("ABLO_API_KEY")} to ${import_picocolors12.default.bold(".env.local")}`;
     } else if (existing === apiKey) {
-      action = `${import_picocolors11.default.bold(".env.local")} already has this key`;
+      action = `${import_picocolors12.default.bold(".env.local")} already has this key`;
     } else {
       (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
-      action = `Updated ${import_picocolors11.default.bold("ABLO_API_KEY")} in ${import_picocolors11.default.bold(".env.local")} ${import_picocolors11.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
+      action = `Updated ${import_picocolors12.default.bold("ABLO_API_KEY")} in ${import_picocolors12.default.bold(".env.local")} ${import_picocolors12.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
   }
   const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
@@ -283271,7 +283388,7 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
 `}.env.local
 `
     );
-    gitignoreNote = ` Added ${import_picocolors11.default.bold(".env.local")} to ${import_picocolors11.default.bold(".gitignore")} so the key can't be committed.`;
+    gitignoreNote = ` Added ${import_picocolors12.default.bold(".env.local")} to ${import_picocolors12.default.bold(".gitignore")} so the key can't be committed.`;
   }
   return `${action}.${gitignoreNote}`;
 }
@@ -283286,7 +283403,7 @@ async function runPush(schema, args) {
   if (ok) {
     return {
       ok: true,
-      message: body.unchanged ? `schema unchanged ${import_picocolors11.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors11.default.dim(`(v${body.version}, hash ${body.hash})`)}`
+      message: body.unchanged ? `schema unchanged ${import_picocolors12.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors12.default.dim(`(v${body.version}, hash ${body.hash})`)}`
     };
   }
   if (status2 === 409) {
@@ -283296,33 +283413,33 @@ async function runPush(schema, args) {
       (s) => s.shadowed != null
     );
     const lines = [
-      import_picocolors11.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
+      import_picocolors12.default.bold("Incompatible schema change \u2014 not safe to apply as-is."),
       "",
-      ...unexecutable.map((u2) => import_picocolors11.default.red(fmtSignal(u2))),
-      ...warnings.map((w2) => import_picocolors11.default.yellow(fmtSignal(w2))),
+      ...unexecutable.map((u2) => import_picocolors12.default.red(fmtSignal(u2))),
+      ...warnings.map((w2) => import_picocolors12.default.yellow(fmtSignal(w2))),
       "",
       ...hasShadowed ? [
-        import_picocolors11.default.dim(
+        import_picocolors12.default.dim(
           "  These models exist in the baseline above but not in your push. Sandbox readers"
         ),
-        import_picocolors11.default.dim(
+        import_picocolors12.default.dim(
           "  fall back to the production schema until you push your own, so applying this drops them."
         ),
         ""
       ] : [],
-      import_picocolors11.default.dim(
-        `  Fix: ${import_picocolors11.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors11.default.bold("--rename old:new")} if you renamed a model.`
+      import_picocolors12.default.dim(
+        `  Fix: ${import_picocolors12.default.bold("ablo push --force")} to apply anyway, or ${import_picocolors12.default.bold("--rename old:new")} if you renamed a model.`
       )
     ];
     return { ok: false, message: lines.join("\n") };
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors11.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors11.default.bold("sandbox")} key with ${import_picocolors11.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors11.default.cyan("https://abloatai.com")}.`;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors12.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors12.default.bold("sandbox")} key with ${import_picocolors12.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors12.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
-` + import_picocolors11.default.dim(hint)
+` + import_picocolors12.default.dim(hint)
     };
   }
   return { ok: false, message: `Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}` };
@@ -283332,25 +283449,25 @@ async function dev(argv) {
   try {
     args = parseDevArgs(argv);
   } catch (err) {
-    console.error(import_picocolors11.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors12.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.apiKey) args.apiKey = resolveEffectiveApiKey("sandbox").key;
   const key = classifyKey(args.apiKey, getMode());
   if (!key.ok) {
-    console.error(import_picocolors11.default.red(`  ${key.reason}`));
+    console.error(import_picocolors12.default.red(`  ${key.reason}`));
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors11.default.dim("push")} ${import_picocolors11.default.dim("(sandbox)")}
+  ${brand("ablo")} ${import_picocolors12.default.dim("push")} ${import_picocolors12.default.dim("(sandbox)")}
 `);
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors11.default.dim("schema")}  ${import_picocolors11.default.bold(args.schemaPath)} ${import_picocolors11.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
+    `  ${import_picocolors12.default.dim("schema")}  ${import_picocolors12.default.bold(args.schemaPath)} ${import_picocolors12.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
   );
-  console.log(`  ${import_picocolors11.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
-  console.log(`  ${import_picocolors11.default.dim("api")}     ${args.url}
+  console.log(`  ${import_picocolors12.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
+  console.log(`  ${import_picocolors12.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
   s.start("Pushing schema definition (sandbox)");
@@ -283359,16 +283476,16 @@ async function dev(argv) {
   if (!first.ok) process.exit(1);
   if (process.env.ABLO_API_KEY) {
     console.log(`
-  ${import_picocolors11.default.green("\u2713")} ${import_picocolors11.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
+  ${import_picocolors12.default.green("\u2713")} ${import_picocolors12.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
   } else {
     console.log(`
-  ${import_picocolors11.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
-    console.log(`  ${import_picocolors11.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
+  ${import_picocolors12.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
+    console.log(`  ${import_picocolors12.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
   console.log(`  Your app is wired for the sandbox.`);
   if (!args.watch) return;
   const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
-  console.log(`  ${import_picocolors11.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
+  console.log(`  ${import_picocolors12.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
 `);
   let timer2 = null;
   let pushing = false;
@@ -283388,7 +283505,7 @@ async function dev(argv) {
       const r2 = await runPush(next, args);
       s2.stop(r2.message, r2.ok ? 0 : 1);
     } catch (err) {
-      s2.stop(import_picocolors11.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
+      s2.stop(import_picocolors12.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
     } finally {
       pushing = false;
     }
@@ -283396,7 +283513,7 @@ async function dev(argv) {
   const stop = () => {
     watcher.close();
     console.log(`
-  ${import_picocolors11.default.dim("stopped.")}`);
+  ${import_picocolors12.default.dim("stopped.")}`);
     process.exit(0);
   };
   process.on("SIGINT", stop);
@@ -283408,7 +283525,7 @@ async function dev(argv) {
 // src/cli/login.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 init_dist2();
 init_config();
 init_theme();
@@ -283469,9 +283586,9 @@ async function deviceLogin(argv, deps = {}) {
   const code = await codeRes.json();
   const approvePath = `/cli?user_code=${code.user_code}`;
   const url = account === "signup" ? `${DASHBOARD_URL}/signup?next=${encodeURIComponent(approvePath)}` : `${DASHBOARD_URL}${approvePath}`;
-  Me(`${import_picocolors12.default.bold(code.user_code)}
+  Me(`${import_picocolors13.default.bold(code.user_code)}
 
-${import_picocolors12.default.dim(url)}`, "Approve in your browser");
+${import_picocolors13.default.dim(url)}`, "Approve in your browser");
   openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -283538,7 +283655,7 @@ ${import_picocolors12.default.dim(url)}`, "Approve in your browser");
     if (reason) M2.error(reason);
     else if (provRes) M2.error(`Key provisioning returned ${provRes.status} from ${DASHBOARD_URL}/api/cli/provision-key.`);
     M2.error(
-      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors12.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors12.default.bold("ABLO_API_KEY")}.`
+      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors13.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors13.default.bold("ABLO_API_KEY")}.`
     );
     process.exit(1);
   }
@@ -283558,9 +283675,9 @@ ${import_picocolors12.default.dim(url)}`, "Approve in your browser");
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
   s.stop(`Saved keys to ${path}`);
-  const where = prov.project ? ` ${import_picocolors12.default.dim(`(project ${prov.project.slug})`)}` : "";
+  const where = prov.project ? ` ${import_picocolors13.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
-    `${import_picocolors12.default.green("\u2713")} Logged in ${import_picocolors12.default.dim("(sandbox)")}${where}. Run ${import_picocolors12.default.bold("npx ablo push")} to push your schema.`
+    `${import_picocolors13.default.green("\u2713")} Logged in ${import_picocolors13.default.dim("(sandbox)")}${where}. Run ${import_picocolors13.default.bold("npx ablo push")} to push your schema.`
   );
 }
 async function login(argv = [], deps = {}) {
@@ -283569,13 +283686,13 @@ async function login(argv = [], deps = {}) {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors12.default.green("\u2713")} Logged out ${import_picocolors12.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors13.default.green("\u2713")} Logged out ${import_picocolors13.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors12.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors13.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_API_KEY) {
     console.log(
-      import_picocolors12.default.dim(`  Note: ${import_picocolors12.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
+      import_picocolors13.default.dim(`  Note: ${import_picocolors13.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
     );
   }
 }
@@ -283585,7 +283702,7 @@ init_config();
 
 // src/cli/mode.ts
 init_cjs_shims();
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 init_dist2();
 init_config();
 var PREFIX = { sandbox: "sk_test_", production: "rk_live_" };
@@ -283597,10 +283714,10 @@ function hintFor(m2, current) {
 }
 function apply(m2) {
   setMode(m2);
-  console.log(`  ${import_picocolors13.default.green("\u2713")} now in ${import_picocolors13.default.bold(m2)}`);
+  console.log(`  ${import_picocolors14.default.green("\u2713")} now in ${import_picocolors14.default.bold(m2)}`);
   if (!getKeyEntry(m2)) {
     console.log(
-      import_picocolors13.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors13.default.bold("ablo login")} or ${import_picocolors13.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
+      import_picocolors14.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors14.default.bold("ablo login")} or ${import_picocolors14.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
     );
   }
 }
@@ -283613,14 +283730,14 @@ async function mode(argv) {
   }
   if (arg) {
     console.error(
-      import_picocolors13.default.red(`  unknown mode: ${arg}`) + import_picocolors13.default.dim(` (expected ${import_picocolors13.default.bold("sandbox")} or ${import_picocolors13.default.bold("production")})`)
+      import_picocolors14.default.red(`  unknown mode: ${arg}`) + import_picocolors14.default.dim(` (expected ${import_picocolors14.default.bold("sandbox")} or ${import_picocolors14.default.bold("production")})`)
     );
     process.exit(1);
   }
   const current = getMode();
   if (!process.stdin.isTTY || process.env.CI) {
     console.error(
-      import_picocolors13.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors13.default.bold("ablo mode sandbox") + import_picocolors13.default.dim(" | ") + import_picocolors13.default.bold("ablo mode production") + import_picocolors13.default.dim(`  (current: ${current})`)
+      import_picocolors14.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors14.default.bold("ablo mode sandbox") + import_picocolors14.default.dim(" | ") + import_picocolors14.default.bold("ablo mode production") + import_picocolors14.default.dim(`  (current: ${current})`)
     );
     process.exit(1);
   }
@@ -283644,7 +283761,7 @@ init_projects();
 
 // src/cli/status.ts
 init_cjs_shims();
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 init_config();
 init_target();
 init_theme();
@@ -283652,9 +283769,9 @@ init_push();
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
   if (Number.isNaN(ms)) return "";
-  if (ms <= 0) return import_picocolors14.default.red("expired");
+  if (ms <= 0) return import_picocolors15.default.red("expired");
   const days = Math.floor(ms / (24 * 60 * 60 * 1e3));
-  return import_picocolors14.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
+  return import_picocolors15.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
 }
 async function ping(apiUrl2) {
   const ctrl = new AbortController();
@@ -283738,27 +283855,27 @@ function formatConflict(conflict) {
 function printTargetLines(target, localProject) {
   const confirmed = target?.confirmed ?? null;
   if (confirmed?.organizationId) {
-    console.log(`  ${import_picocolors14.default.dim("org")}     ${import_picocolors14.default.dim(confirmed.organizationId)}`);
+    console.log(`  ${import_picocolors15.default.dim("org")}     ${import_picocolors15.default.dim(confirmed.organizationId)}`);
   }
   let projectLine;
   if (confirmed?.project) {
     const p2 = confirmed.project;
-    projectLine = p2.isDefault ? `${import_picocolors14.default.bold("default")} ${import_picocolors14.default.dim("(org-default)")}` : `${import_picocolors14.default.bold(p2.slug)} ${import_picocolors14.default.dim(`(${p2.id})`)}`;
+    projectLine = p2.isDefault ? `${import_picocolors15.default.bold("default")} ${import_picocolors15.default.dim("(org-default)")}` : `${import_picocolors15.default.bold(p2.slug)} ${import_picocolors15.default.dim(`(${p2.id})`)}`;
   } else if (confirmed) {
-    projectLine = `${import_picocolors14.default.bold("default")} ${import_picocolors14.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors15.default.bold("default")} ${import_picocolors15.default.dim("(org-default)")}`;
   } else if (localProject) {
-    projectLine = `${import_picocolors14.default.bold(localProject.slug)} ${import_picocolors14.default.dim(`(${localProject.id})`)} ${import_picocolors14.default.yellow("(unconfirmed)")}`;
+    projectLine = `${import_picocolors15.default.bold(localProject.slug)} ${import_picocolors15.default.dim(`(${localProject.id})`)} ${import_picocolors15.default.yellow("(unconfirmed)")}`;
   } else {
-    projectLine = `${import_picocolors14.default.bold("default")} ${target ? import_picocolors14.default.yellow("(unconfirmed)") : import_picocolors14.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors15.default.bold("default")} ${target ? import_picocolors15.default.yellow("(unconfirmed)") : import_picocolors15.default.dim("(org-default)")}`;
   }
-  console.log(`  ${import_picocolors14.default.dim("project")} ${projectLine}`);
+  console.log(`  ${import_picocolors15.default.dim("project")} ${projectLine}`);
   const env = confirmed?.environment ?? target?.keyEnv ?? null;
   if (env) {
-    const suffix = confirmed ? "" : ` ${import_picocolors14.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors14.default.dim("env")}     ${import_picocolors14.default.bold(env)}${suffix}`);
+    const suffix = confirmed ? "" : ` ${import_picocolors15.default.yellow("(unconfirmed)")}`;
+    console.log(`  ${import_picocolors15.default.dim("env")}     ${import_picocolors15.default.bold(env)}${suffix}`);
   }
   for (const m2 of target?.mismatches ?? []) {
-    console.log(`  ${import_picocolors14.default.yellow("\u26A0")} ${import_picocolors14.default.yellow(describeMismatch(m2))}`);
+    console.log(`  ${import_picocolors15.default.yellow("\u26A0")} ${import_picocolors15.default.yellow(describeMismatch(m2))}`);
   }
 }
 async function status(args = []) {
@@ -283829,80 +283946,80 @@ async function status(args = []) {
     return;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors14.default.dim("status")}
+  ${brand("ablo")} ${import_picocolors15.default.dim("status")}
 `);
   if (effective.key && effective.source && effective.source !== "stored") {
     const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
     console.log(
-      `  ${import_picocolors14.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors14.default.dim(`(${label} \u2014 overrides stored)`)}`
+      `  ${import_picocolors15.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors15.default.dim(`(${label} \u2014 overrides stored)`)}`
     );
   } else if (!cfg) {
-    console.log(`  ${import_picocolors14.default.yellow("!")} Not logged in \u2014 run ${import_picocolors14.default.bold("ablo login")}.`);
+    console.log(`  ${import_picocolors15.default.yellow("!")} Not logged in \u2014 run ${import_picocolors15.default.bold("ablo login")}.`);
   }
-  console.log(`  ${import_picocolors14.default.dim("mode")}    ${import_picocolors14.default.bold(mode2)}`);
+  console.log(`  ${import_picocolors15.default.dim("mode")}    ${import_picocolors15.default.bold(mode2)}`);
   const activeEntry = getKeyEntry(mode2);
   const key = describeEffectiveKey(mode2, process.env.ABLO_API_KEY, activeEntry);
   if (key.keyMismatch) {
-    console.log(`  ${import_picocolors14.default.yellow("!")} ${import_picocolors14.default.yellow(key.keyMismatch.message)}`);
+    console.log(`  ${import_picocolors15.default.yellow("!")} ${import_picocolors15.default.yellow(key.keyMismatch.message)}`);
   }
   const activeProject = getActiveProject();
   printTargetLines(target, activeProject);
   for (const m2 of ["sandbox", "production"]) {
     const entry = getKeyEntry(m2);
-    const marker = m2 === mode2 ? import_picocolors14.default.green("\u25CF") : import_picocolors14.default.dim("\u25CB");
+    const marker = m2 === mode2 ? import_picocolors15.default.green("\u25CF") : import_picocolors15.default.dim("\u25CB");
     if (entry) {
       const exp = entry.expiresAt ? ` ${expiryLabel(entry.expiresAt)}` : "";
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors14.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors15.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
     } else {
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors14.default.dim("\u2014 no key")}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors15.default.dim("\u2014 no key")}`);
     }
   }
   const org = target?.confirmed?.organizationId ?? activeEntry?.organizationId;
   const plan = resolvePushPlan();
   console.log(
-    `  ${import_picocolors14.default.dim("push")}    ${plan.apiKey ? `${import_picocolors14.default.bold(plan.flow)} ${import_picocolors14.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors14.default.bold(plan.flow)} ${import_picocolors14.default.yellow("\u2014 no credential")} ${import_picocolors14.default.dim(`(run ${import_picocolors14.default.bold("ablo login")} or set ${import_picocolors14.default.bold("ABLO_API_KEY")})`)}`}`
+    `  ${import_picocolors15.default.dim("push")}    ${plan.apiKey ? `${import_picocolors15.default.bold(plan.flow)} ${import_picocolors15.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors15.default.bold(plan.flow)} ${import_picocolors15.default.yellow("\u2014 no credential")} ${import_picocolors15.default.dim(`(run ${import_picocolors15.default.bold("ablo login")} or set ${import_picocolors15.default.bold("ABLO_API_KEY")})`)}`}`
   );
-  process.stdout.write(`  ${import_picocolors14.default.dim("api")}     ${apiUrl2}  `);
+  process.stdout.write(`  ${import_picocolors15.default.dim("api")}     ${apiUrl2}  `);
   const reachable = await ping(apiUrl2);
-  console.log(reachable ? import_picocolors14.default.green("reachable") : import_picocolors14.default.red("unreachable"));
+  console.log(reachable ? import_picocolors15.default.green("reachable") : import_picocolors15.default.red("unreachable"));
   if (reachable) {
     const introspectKey = effective.key;
     const pushed = await fetchPushedSchema(apiUrl2, introspectKey);
     if (pushed?.active) {
-      const when = pushed.pushedAt ? ` ${import_picocolors14.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
-      const ver = pushed.version != null ? ` ${import_picocolors14.default.dim(`(rev ${pushed.version})`)}` : "";
-      const hashLabel = pushed.hash ? ` ${import_picocolors14.default.dim(`hash ${pushed.hash}`)}` : "";
-      console.log(`  ${import_picocolors14.default.dim("schema")}  ${import_picocolors14.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
+      const when = pushed.pushedAt ? ` ${import_picocolors15.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
+      const ver = pushed.version != null ? ` ${import_picocolors15.default.dim(`(rev ${pushed.version})`)}` : "";
+      const hashLabel = pushed.hash ? ` ${import_picocolors15.default.dim(`hash ${pushed.hash}`)}` : "";
+      console.log(`  ${import_picocolors15.default.dim("schema")}  ${import_picocolors15.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
       for (const m2 of pushed.models) {
-        const tn = m2.typename === m2.key ? import_picocolors14.default.dim(`typename=${m2.typename}`) : import_picocolors14.default.yellow(`typename=${m2.typename}`);
+        const tn = m2.typename === m2.key ? import_picocolors15.default.dim(`typename=${m2.typename}`) : import_picocolors15.default.yellow(`typename=${m2.typename}`);
         const conflict = formatConflict(m2.conflict);
-        const conflictStr2 = conflict ? `  ${import_picocolors14.default.dim(`conflict=${conflict}`)}` : "";
-        console.log(`          ${import_picocolors14.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
+        const conflictStr2 = conflict ? `  ${import_picocolors15.default.dim(`conflict=${conflict}`)}` : "";
+        console.log(`          ${import_picocolors15.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
       }
     } else if (pushed && !pushed.active) {
-      console.log(`  ${import_picocolors14.default.dim("schema")}  ${import_picocolors14.default.yellow("none pushed")} ${import_picocolors14.default.dim(`(run ${import_picocolors14.default.bold("ablo push")} or ${import_picocolors14.default.bold("ablo dev")})`)}`);
+      console.log(`  ${import_picocolors15.default.dim("schema")}  ${import_picocolors15.default.yellow("none pushed")} ${import_picocolors15.default.dim(`(run ${import_picocolors15.default.bold("ablo push")} or ${import_picocolors15.default.bold("ablo dev")})`)}`);
     }
     const firstPushedModel = pushed?.active ? pushed.models[0] : void 0;
     if (firstPushedModel !== void 0) {
       const probe = await probeDataPlane(apiUrl2, introspectKey, firstPushedModel.typename);
       if (probe.status === "no_database") {
-        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.red("\u2717 no database registered")}${org ? import_picocolors14.default.dim(` for org ${org}`) : ""}`);
+        console.log(`  ${import_picocolors15.default.dim("data")}    ${import_picocolors15.default.red("\u2717 no database registered")}${org ? import_picocolors15.default.dim(` for org ${org}`) : ""}`);
         console.log(
-          `          ${import_picocolors14.default.dim(
-            `reads/writes will fail with ${import_picocolors14.default.bold("tenant_routing_failed")}. Connect one with ${import_picocolors14.default.bold("ablo connect")}, or point ${import_picocolors14.default.bold("ABLO_API_KEY")} at an org that has a database.`
+          `          ${import_picocolors15.default.dim(
+            `reads/writes will fail with ${import_picocolors15.default.bold("tenant_routing_failed")}. Connect one with ${import_picocolors15.default.bold("ablo connect")}, or point ${import_picocolors15.default.bold("ABLO_API_KEY")} at an org that has a database.`
           )}`
         );
       } else if (probe.status === "intermittent") {
-        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.red(`\u2717 database routing is intermittent`)} ${import_picocolors14.default.dim(`(${probe.ok} ok / ${probe.failed} failed of ${probe.ok + probe.failed})`)}${org ? import_picocolors14.default.dim(` for org ${org}`) : ""}`);
+        console.log(`  ${import_picocolors15.default.dim("data")}    ${import_picocolors15.default.red(`\u2717 database routing is intermittent`)} ${import_picocolors15.default.dim(`(${probe.ok} ok / ${probe.failed} failed of ${probe.ok + probe.failed})`)}${org ? import_picocolors15.default.dim(` for org ${org}`) : ""}`);
         console.log(
-          `          ${import_picocolors14.default.dim(
-            `some reads/writes fail with ${import_picocolors14.default.bold("tenant_routing_failed")} \u2014 the registration is unstable. Re-establish it with ${import_picocolors14.default.bold("ablo connect")} (or check for a recent server redeploy).`
+          `          ${import_picocolors15.default.dim(
+            `some reads/writes fail with ${import_picocolors15.default.bold("tenant_routing_failed")} \u2014 the registration is unstable. Re-establish it with ${import_picocolors15.default.bold("ablo connect")} (or check for a recent server redeploy).`
           )}`
         );
       } else if (probe.status === "forbidden") {
-        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.yellow("? key not authorized to read")}${probe.detail ? import_picocolors14.default.dim(` (${probe.detail})`) : ""}`);
+        console.log(`  ${import_picocolors15.default.dim("data")}    ${import_picocolors15.default.yellow("? key not authorized to read")}${probe.detail ? import_picocolors15.default.dim(` (${probe.detail})`) : ""}`);
       } else if (probe.status === "unknown") {
-        console.log(`  ${import_picocolors14.default.dim("data")}    ${import_picocolors14.default.yellow(`? data-plane check inconclusive (${probe.detail})`)}`);
+        console.log(`  ${import_picocolors15.default.dim("data")}    ${import_picocolors15.default.yellow(`? data-plane check inconclusive (${probe.detail})`)}`);
       }
     }
   }
@@ -283912,7 +284029,7 @@ async function status(args = []) {
 // src/cli/logs.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 init_config();
 init_theme();
 init_push();
@@ -283979,10 +284096,10 @@ function resolveSince(since) {
 var sleep2 = (ms) => new Promise((r2) => setTimeout(r2, ms));
 function colorOp(op) {
   const label = op.padEnd(6);
-  if (op === "create") return import_picocolors15.default.green(label);
-  if (op === "update") return import_picocolors15.default.yellow(label);
-  if (op === "delete") return import_picocolors15.default.red(label);
-  return import_picocolors15.default.dim(label);
+  if (op === "create") return import_picocolors16.default.green(label);
+  if (op === "update") return import_picocolors16.default.yellow(label);
+  if (op === "delete") return import_picocolors16.default.red(label);
+  return import_picocolors16.default.dim(label);
 }
 function render(e2, json) {
   if (json) {
@@ -283991,21 +284108,21 @@ function render(e2, json) {
     return;
   }
   const t = new Date(e2.at).toLocaleTimeString();
-  const actor = e2.actor ? import_picocolors15.default.dim(`  ${e2.actor}`) : "";
-  console.log(`  ${import_picocolors15.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors15.default.bold(e2.model)} ${import_picocolors15.default.dim(e2.recordId)}${actor}`);
+  const actor = e2.actor ? import_picocolors16.default.dim(`  ${e2.actor}`) : "";
+  console.log(`  ${import_picocolors16.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors16.default.bold(e2.model)} ${import_picocolors16.default.dim(e2.recordId)}${actor}`);
 }
 async function logs(argv) {
   let args;
   try {
     args = parseLogsArgs(argv);
   } catch (err) {
-    console.error(import_picocolors15.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const apiKey = resolveApiKey(args.mode);
   if (!apiKey) {
     console.error(
-      import_picocolors15.default.red(`  No API key.`) + import_picocolors15.default.dim(` Run ${import_picocolors15.default.bold("ablo login")} or set ${import_picocolors15.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors16.default.red(`  No API key.`) + import_picocolors16.default.dim(` Run ${import_picocolors16.default.bold("ablo login")} or set ${import_picocolors16.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
@@ -284019,7 +284136,7 @@ async function logs(argv) {
     if (!res) return null;
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
-      console.error(import_picocolors15.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
+      console.error(import_picocolors16.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
       process.exit(1);
     }
     const json = await res.json();
@@ -284030,7 +284147,7 @@ async function logs(argv) {
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors15.default.dim("logs")} ${import_picocolors15.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors16.default.dim("logs")} ${import_picocolors16.default.dim(`(${args.mode ?? "active"} mode)`)}
 `);
   }
   const initial = await fetchPage({
@@ -284040,13 +284157,13 @@ async function logs(argv) {
     ...args.op ? { op: args.op } : {}
   });
   if (!initial) {
-    console.error(import_picocolors15.default.red(`  Couldn't reach ${baseUrl2}.`));
+    console.error(import_picocolors16.default.red(`  Couldn't reach ${baseUrl2}.`));
     process.exit(1);
   }
   for (const e2 of initial.events) render(e2, args.json);
   let cursor = initial.cursor;
   if (!args.follow) return;
-  if (!args.json) console.log(`  ${import_picocolors15.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
+  if (!args.json) console.log(`  ${import_picocolors16.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
 `);
   for (; ; ) {
     await sleep2(1500);
@@ -284064,7 +284181,7 @@ async function logs(argv) {
 // src/cli/webhooks.ts
 init_cjs_shims();
 var import_fs8 = require("fs");
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 init_credentialPolicy();
 init_config();
 init_theme();
@@ -284097,12 +284214,12 @@ function requireKey2(mode2) {
   const apiKey = resolveApiKey(mode2);
   if (!apiKey) {
     console.error(
-      import_picocolors16.default.red("  No API key.") + import_picocolors16.default.dim(` Run ${import_picocolors16.default.bold("ablo login")} or set ${import_picocolors16.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors17.default.red("  No API key.") + import_picocolors17.default.dim(` Run ${import_picocolors17.default.bold("ablo login")} or set ${import_picocolors17.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
   if (classifyCredentialKind(apiKey) !== "secret") {
-    console.error(import_picocolors16.default.red("  Managing webhooks requires a secret key ") + import_picocolors16.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors17.default.red("  Managing webhooks requires a secret key ") + import_picocolors17.default.dim("(sk_test_ / sk_live_)."));
     process.exit(1);
   }
   return apiKey;
@@ -284118,12 +284235,12 @@ async function api(apiKey, method, path, body) {
     ...body ? { body: JSON.stringify(body) } : {}
   }).catch(() => null);
   if (!res) {
-    console.error(import_picocolors16.default.red(`  Couldn't reach ${baseUrl()}.`));
+    console.error(import_picocolors17.default.red(`  Couldn't reach ${baseUrl()}.`));
     process.exit(1);
   }
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    console.error(import_picocolors16.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
+    console.error(import_picocolors17.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
     process.exit(1);
   }
   return await res.json();
@@ -284145,11 +284262,11 @@ ${line}
   return file;
 }
 function printEndpoint(e2) {
-  const dot = e2.status === "enabled" ? import_picocolors16.default.green("\u25CF") : import_picocolors16.default.red("\u25CF");
-  const health = e2.last_error ? import_picocolors16.default.red(` last error: ${e2.last_error}`) : "";
-  console.log(`  ${dot} ${import_picocolors16.default.bold(e2.id)}  ${e2.url}`);
+  const dot = e2.status === "enabled" ? import_picocolors17.default.green("\u25CF") : import_picocolors17.default.red("\u25CF");
+  const health = e2.last_error ? import_picocolors17.default.red(` last error: ${e2.last_error}`) : "";
+  console.log(`  ${dot} ${import_picocolors17.default.bold(e2.id)}  ${e2.url}`);
   console.log(
-    import_picocolors16.default.dim(
+    import_picocolors17.default.dim(
       `      ${e2.status} \xB7 ${e2.environment} \xB7 events ${e2.enabled_events.join(",")} \xB7 cursor ${e2.cursor ?? "\u2014"}${health}`
     )
   );
@@ -284161,7 +284278,7 @@ async function webhooks(argv) {
   if (sub === "create") {
     const url = positional(rest);
     if (!url) {
-      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
+      console.error(import_picocolors17.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
@@ -284173,8 +284290,8 @@ async function webhooks(argv) {
     });
     const file = writeSecretToEnv(created.secret);
     console.log(`
-  ${import_picocolors16.default.green("\u2713")} Registered ${import_picocolors16.default.bold(created.id)} \u2192 ${created.url}`);
-    console.log(`  ${import_picocolors16.default.green("\u2713")} Wrote ${import_picocolors16.default.bold(ENV_KEY)} to ${import_picocolors16.default.bold(file)} ${import_picocolors16.default.dim("(shown once)")}
+  ${import_picocolors17.default.green("\u2713")} Registered ${import_picocolors17.default.bold(created.id)} \u2192 ${created.url}`);
+    console.log(`  ${import_picocolors17.default.green("\u2713")} Wrote ${import_picocolors17.default.bold(ENV_KEY)} to ${import_picocolors17.default.bold(file)} ${import_picocolors17.default.dim("(shown once)")}
 `);
     return;
   }
@@ -284182,7 +284299,7 @@ async function webhooks(argv) {
     const apiKey = requireKey2(mode2);
     const { data } = await api(apiKey, "GET", "");
     if (data.length === 0) {
-      console.log(import_picocolors16.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
+      console.log(import_picocolors17.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
       return;
     }
     console.log();
@@ -284193,40 +284310,40 @@ async function webhooks(argv) {
   if (sub === "roll") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
+      console.error(import_picocolors17.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     const rolled = await api(apiKey, "POST", `/${id}/roll_secret`);
     const file = writeSecretToEnv(rolled.secret);
     console.log(`
-  ${import_picocolors16.default.green("\u2713")} Rolled secret for ${import_picocolors16.default.bold(id)} \u2192 ${import_picocolors16.default.bold(file)} ${import_picocolors16.default.dim("(old secret now invalid)")}
+  ${import_picocolors17.default.green("\u2713")} Rolled secret for ${import_picocolors17.default.bold(id)} \u2192 ${import_picocolors17.default.bold(file)} ${import_picocolors17.default.dim("(old secret now invalid)")}
 `);
     return;
   }
   if (sub === "enable") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
+      console.error(import_picocolors17.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     const e2 = await api(apiKey, "POST", `/${id}/enable`);
-    console.log(`  ${import_picocolors16.default.green("\u2713")} Re-enabled ${import_picocolors16.default.bold(e2.id)}`);
+    console.log(`  ${import_picocolors17.default.green("\u2713")} Re-enabled ${import_picocolors17.default.bold(e2.id)}`);
     return;
   }
   if (sub === "rm" || sub === "delete") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors16.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
+      console.error(import_picocolors17.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
       process.exit(1);
     }
     const apiKey = requireKey2(mode2);
     await api(apiKey, "DELETE", `/${id}`);
-    console.log(`  ${import_picocolors16.default.green("\u2713")} Removed ${import_picocolors16.default.bold(id)}`);
+    console.log(`  ${import_picocolors17.default.green("\u2713")} Removed ${import_picocolors17.default.bold(id)}`);
     return;
   }
-  console.log(`  ${import_picocolors16.default.bold("Usage:")}`);
+  console.log(`  ${import_picocolors17.default.bold("Usage:")}`);
   console.log(`    ${brand("ablo webhooks create <url>")}   Register an endpoint; writes ${ENV_KEY}`);
   console.log(`    ${brand("ablo webhooks list")}           List endpoints + delivery health`);
   console.log(`    ${brand("ablo webhooks roll <id>")}       Mint a fresh signing secret`);
@@ -284238,7 +284355,7 @@ async function webhooks(argv) {
 // src/cli/check.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 init_src();
 var import_schema6 = require("@abloatai/ablo/schema");
 init_push();
@@ -284276,13 +284393,13 @@ async function check(argv) {
   try {
     args = parseCheckArgs(argv);
   } catch (err) {
-    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors18.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
     console.error(
-      import_picocolors17.default.red(`  No database.`) + import_picocolors17.default.dim(` Set ${import_picocolors17.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
+      import_picocolors18.default.red(`  No database.`) + import_picocolors18.default.dim(` Set ${import_picocolors18.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
     );
     process.exit(1);
   }
@@ -284297,7 +284414,7 @@ async function check(argv) {
       [args.appSchema]
     );
   } catch (err) {
-    console.error(import_picocolors17.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors18.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -284312,7 +284429,7 @@ async function check(argv) {
     set.add(r2.column_name);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors17.default.dim("check")}  ${import_picocolors17.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors18.default.dim("check")}  ${import_picocolors18.default.dim(`schema "${args.appSchema}"`)}
 `);
   const declaredTables = /* @__PURE__ */ new Set();
   let errors = 0;
@@ -284322,7 +284439,7 @@ async function check(argv) {
     declaredTables.add(table);
     const present = colsByTable.get(table);
     if (!present) {
-      console.log(`  ${import_picocolors17.default.red("\u2717")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} table ${import_picocolors17.default.bold(table)} ${import_picocolors17.default.red("not found")}`);
+      console.log(`  ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.bold(key)} ${import_picocolors18.default.dim("\u2192")} table ${import_picocolors18.default.bold(table)} ${import_picocolors18.default.red("not found")}`);
       errors++;
       continue;
     }
@@ -284344,26 +284461,26 @@ async function check(argv) {
       if (!present.has(col)) problems.push(`missing column "${col}" (field ${fieldName})`);
     }
     if (problems.length > 0) {
-      console.log(`  ${import_picocolors17.default.red("\u2717")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} ${table}`);
-      for (const p2 of problems) console.log(`      ${import_picocolors17.default.red("\u2022")} ${p2}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors17.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.bold(key)} ${import_picocolors18.default.dim("\u2192")} ${table}`);
+      for (const p2 of problems) console.log(`      ${import_picocolors18.default.red("\u2022")} ${p2}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors18.default.yellow("\u2022")} ${w2}`);
       errors++;
     } else if (warns.length > 0) {
-      console.log(`  ${import_picocolors17.default.yellow("!")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim("\u2192")} ${table}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors17.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors18.default.yellow("!")} ${import_picocolors18.default.bold(key)} ${import_picocolors18.default.dim("\u2192")} ${table}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors18.default.yellow("\u2022")} ${w2}`);
       warnings++;
     } else {
-      console.log(`  ${import_picocolors17.default.green("\u2713")} ${import_picocolors17.default.bold(key)} ${import_picocolors17.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
+      console.log(`  ${import_picocolors18.default.green("\u2713")} ${import_picocolors18.default.bold(key)} ${import_picocolors18.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
     }
   }
   const modelCount = Object.keys(schemaJson.models).length;
   const ignored = [...colsByTable.keys()].filter((t) => !declaredTables.has(t)).length;
   console.log(
     `
-  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors17.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors17.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors17.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
+  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors18.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors18.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors18.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
   );
   if (ignored > 0) {
-    console.log(`  ${import_picocolors17.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
+    console.log(`  ${import_picocolors18.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
   }
   console.log();
   process.exit(errors > 0 ? 1 : 0);
@@ -284371,7 +284488,7 @@ async function check(argv) {
 
 // src/cli/upgrade.ts
 init_cjs_shims();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -284449,7 +284566,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors18.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors19.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -284523,39 +284640,39 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors18.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors19.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors18.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors19.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors18.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors18.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors18.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors18.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors19.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors19.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors19.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors19.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors18.default.bold(import_picocolors18.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors19.default.bold(import_picocolors19.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors18.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors18.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors18.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors19.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors19.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors19.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors18.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors19.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors18.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors19.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/cli/pull.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 init_src();
 var import_fs9 = require("fs");
 init_theme();
@@ -284669,45 +284786,45 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors19.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
-    console.error(import_picocolors19.default.red(`  No database.`) + import_picocolors19.default.dim(` Set ${import_picocolors19.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
+    console.error(import_picocolors20.default.red(`  No database.`) + import_picocolors20.default.dim(` Set ${import_picocolors20.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
     process.exit(1);
   }
   if ((0, import_fs9.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors19.default.red(`  ${args.out} already exists.`) + import_picocolors19.default.dim(` Re-run with ${import_picocolors19.default.bold("--force")} to overwrite.`)
+      import_picocolors20.default.red(`  ${args.out} already exists.`) + import_picocolors20.default.dim(` Re-run with ${import_picocolors20.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors19.default.dim("pull")}  ${import_picocolors19.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors20.default.dim("pull")}  ${import_picocolors20.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors19.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors20.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors19.default.yellow(`  No adoptable tables found`) + import_picocolors19.default.dim(` (a model needs an ${import_picocolors19.default.bold("id")} + ${import_picocolors19.default.bold("organization_id")} column).`)
+      import_picocolors20.default.yellow(`  No adoptable tables found`) + import_picocolors20.default.dim(` (a model needs an ${import_picocolors20.default.bold("id")} + ${import_picocolors20.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs9.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors19.default.green("\u2713")} wrote ${import_picocolors19.default.bold(args.out)} ${import_picocolors19.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors19.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors20.default.green("\u2713")} wrote ${import_picocolors20.default.bold(args.out)} ${import_picocolors20.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors20.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped > 0) {
-    console.log(`  ${import_picocolors19.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
+    console.log(`  ${import_picocolors20.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
   }
   console.log(
     `
-  ${import_picocolors19.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors19.default.bold("ablo check")}.
+  ${import_picocolors20.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors20.default.bold("ablo check")}.
 `
   );
 }
@@ -284715,7 +284832,7 @@ async function pull(argv) {
 // src/cli/prismaPull.ts
 init_cjs_shims();
 init_errors();
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 var import_fs10 = require("fs");
 init_theme();
 
@@ -285000,55 +285117,55 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!(0, import_fs10.existsSync)(args.schema)) {
     console.error(
-      import_picocolors20.default.red(`  No Prisma schema at ${import_picocolors20.default.bold(args.schema)}.`) + import_picocolors20.default.dim(` Pass a path: ${import_picocolors20.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors21.default.red(`  No Prisma schema at ${import_picocolors21.default.bold(args.schema)}.`) + import_picocolors21.default.dim(` Pass a path: ${import_picocolors21.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
   if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors20.default.red(`  ${args.out} already exists.`) + import_picocolors20.default.dim(` Re-run with ${import_picocolors20.default.bold("--force")} to overwrite.`)
+      import_picocolors21.default.red(`  ${args.out} already exists.`) + import_picocolors21.default.dim(` Re-run with ${import_picocolors21.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors20.default.dim("pull prisma")}  ${import_picocolors20.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors21.default.dim("pull prisma")}  ${import_picocolors21.default.dim(args.schema)}
 `);
   let result;
   try {
     const src = (0, import_fs10.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors20.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors21.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors20.default.yellow(`  No adoptable models found`) + import_picocolors20.default.dim(` (a model needs an ${import_picocolors20.default.bold("id")} + ${import_picocolors20.default.bold("organizationId")} / ${import_picocolors20.default.bold("organization_id")}).`)
+      import_picocolors21.default.yellow(`  No adoptable models found`) + import_picocolors21.default.dim(` (a model needs an ${import_picocolors21.default.bold("id")} + ${import_picocolors21.default.bold("organizationId")} / ${import_picocolors21.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
   (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors20.default.green("\u2713")} wrote ${import_picocolors20.default.bold(args.out)} ${import_picocolors20.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors20.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors21.default.green("\u2713")} wrote ${import_picocolors21.default.bold(args.out)} ${import_picocolors21.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors21.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors20.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors20.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors21.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors21.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors20.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors20.default.bold("ablo check")}.
+  ${import_picocolors21.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors21.default.bold("ablo check")}.
 `
   );
 }
 
 // src/cli/drizzlePull.ts
 init_cjs_shims();
-var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 init_errors();
 var import_fs11 = require("fs");
 var import_path6 = require("path");
@@ -285187,27 +285304,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors22.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors21.default.red(`  No Drizzle schema given.`) + import_picocolors21.default.dim(` Pass the module: ${import_picocolors21.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors22.default.red(`  No Drizzle schema given.`) + import_picocolors22.default.dim(` Pass the module: ${import_picocolors22.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
   if (!(0, import_fs11.existsSync)(args.schema)) {
-    console.error(import_picocolors21.default.red(`  No file at ${import_picocolors21.default.bold(args.schema)}.`));
+    console.error(import_picocolors22.default.red(`  No file at ${import_picocolors22.default.bold(args.schema)}.`));
     process.exit(1);
   }
   if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors21.default.red(`  ${args.out} already exists.`) + import_picocolors21.default.dim(` Re-run with ${import_picocolors21.default.bold("--force")} to overwrite.`)
+      import_picocolors22.default.red(`  ${args.out} already exists.`) + import_picocolors22.default.dim(` Re-run with ${import_picocolors22.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors21.default.dim("pull drizzle")}  ${import_picocolors21.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors22.default.dim("pull drizzle")}  ${import_picocolors22.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -285215,26 +285332,26 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors21.default.dim(` (install ${import_picocolors21.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors21.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors22.default.dim(` (install ${import_picocolors22.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors22.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors21.default.yellow(`  No adoptable tables found`) + import_picocolors21.default.dim(` (a table needs an ${import_picocolors21.default.bold("id")} + ${import_picocolors21.default.bold("organization_id")} column).`)
+      import_picocolors22.default.yellow(`  No adoptable tables found`) + import_picocolors22.default.dim(` (a table needs an ${import_picocolors22.default.bold("id")} + ${import_picocolors22.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs11.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors21.default.green("\u2713")} wrote ${import_picocolors21.default.bold(args.out)} ${import_picocolors21.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors21.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors22.default.green("\u2713")} wrote ${import_picocolors22.default.bold(args.out)} ${import_picocolors22.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors22.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors21.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors21.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors22.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors22.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors21.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors21.default.bold("ablo check")}.
+  ${import_picocolors22.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors22.default.bold("ablo check")}.
 `
   );
 }
@@ -285244,7 +285361,7 @@ init_theme();
 
 // src/cli/renderError.ts
 init_cjs_shims();
-var import_picocolors22 = __toESM(require_picocolors(), 1);
+var import_picocolors23 = __toESM(require_picocolors(), 1);
 init_errors();
 init_theme();
 var RECOVERY_HINT = {
@@ -285266,15 +285383,15 @@ function isStringArray(v2) {
 function renderKnownDetails(details, line) {
   if (!details) return;
   const { retryAfterSeconds, missingIds, requiredCapability, unexecutable, errors } = details;
-  if (typeof retryAfterSeconds === "number") line(`    ${import_picocolors22.default.dim("retry")}  after ${retryAfterSeconds}s`);
+  if (typeof retryAfterSeconds === "number") line(`    ${import_picocolors23.default.dim("retry")}  after ${retryAfterSeconds}s`);
   if (isStringArray(missingIds) && missingIds.length > 0) {
     const shown = missingIds.slice(0, 5).join(", ");
     const more = missingIds.length > 5 ? ` (+${missingIds.length - 5} more)` : "";
-    line(`    ${import_picocolors22.default.dim("missing")} ${shown}${more}`);
+    line(`    ${import_picocolors23.default.dim("missing")} ${shown}${more}`);
   }
-  if (typeof requiredCapability === "string") line(`    ${import_picocolors22.default.dim("needs")}  ${requiredCapability}`);
+  if (typeof requiredCapability === "string") line(`    ${import_picocolors23.default.dim("needs")}  ${requiredCapability}`);
   if (Array.isArray(unexecutable) && unexecutable.length > 0) {
-    line(`    ${import_picocolors22.default.dim("blocked")} ${unexecutable.length} change(s) can't be applied \u2014 see \`unexecutable\` (--verbose)`);
+    line(`    ${import_picocolors23.default.dim("blocked")} ${unexecutable.length} change(s) can't be applied \u2014 see \`unexecutable\` (--verbose)`);
   }
   if (Array.isArray(errors)) {
     for (const e2 of errors.slice(0, 8)) {
@@ -285282,7 +285399,7 @@ function renderKnownDetails(details, line) {
         const rec = e2;
         const where = typeof rec.param === "string" ? `${rec.param}: ` : "";
         const msg = typeof rec.message === "string" ? rec.message : "";
-        if (msg) line(`    ${import_picocolors22.default.dim("\xB7")} ${where}${msg}`);
+        if (msg) line(`    ${import_picocolors23.default.dim("\xB7")} ${where}${msg}`);
       }
     }
   }
@@ -285293,22 +285410,22 @@ function renderCliError(err, opts = {}) {
   });
   const verbose = opts.verbose ?? (process.argv.includes("--verbose") || process.env.ABLO_VERBOSE === "1");
   if (err instanceof AbloError) {
-    const codeTag = err.code ? `  ${import_picocolors22.default.dim(`[${err.code}]`)}` : "";
+    const codeTag = err.code ? `  ${import_picocolors23.default.dim(`[${err.code}]`)}` : "";
     line("");
-    line(`  ${brand("ablo")} ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(titleForType(err.type))}${codeTag}`);
+    line(`  ${brand("ablo")} ${import_picocolors23.default.red("\u2717")} ${import_picocolors23.default.bold(titleForType(err.type))}${codeTag}`);
     line("");
     line(`    ${err.message}`);
-    if (err.param) line(`    ${import_picocolors22.default.dim("field")}  ${err.param}`);
+    if (err.param) line(`    ${import_picocolors23.default.dim("field")}  ${err.param}`);
     renderKnownDetails(err.details, line);
     const hint = err.code ? RECOVERY_HINT[classifyRecovery(err.code)] : void 0;
-    if (hint) line(`    ${import_picocolors22.default.dim(hint)}`);
-    if (err.docUrl) line(`    ${import_picocolors22.default.dim("docs")}   ${err.docUrl}`);
-    if (err.requestId) line(`    ${import_picocolors22.default.dim("ref")}    ${err.requestId}`);
+    if (hint) line(`    ${import_picocolors23.default.dim(hint)}`);
+    if (err.docUrl) line(`    ${import_picocolors23.default.dim("docs")}   ${err.docUrl}`);
+    if (err.requestId) line(`    ${import_picocolors23.default.dim("ref")}    ${err.requestId}`);
     if (verbose) {
       if (err.details && Object.keys(err.details).length > 0) {
-        line(`    ${import_picocolors22.default.dim("details")} ${JSON.stringify(err.details)}`);
+        line(`    ${import_picocolors23.default.dim("details")} ${JSON.stringify(err.details)}`);
       }
-      if (err.stack) line(import_picocolors22.default.dim(err.stack));
+      if (err.stack) line(import_picocolors23.default.dim(err.stack));
     }
     line("");
     process.exitCode = 1;
@@ -285316,16 +285433,16 @@ function renderCliError(err, opts = {}) {
   }
   const message = err instanceof Error ? err.message : String(err);
   line("");
-  line(`  ${brand("ablo")} ${import_picocolors22.default.red("\u2717")} ${message}`);
-  if (verbose && err instanceof Error && err.stack) line(import_picocolors22.default.dim(err.stack));
-  else line(`    ${import_picocolors22.default.dim("Run with --verbose for the full error.")}`);
+  line(`  ${brand("ablo")} ${import_picocolors23.default.red("\u2717")} ${message}`);
+  if (verbose && err instanceof Error && err.stack) line(import_picocolors23.default.dim(err.stack));
+  else line(`    ${import_picocolors23.default.dim("Run with --verbose for the full error.")}`);
   line("");
   process.exitCode = 1;
 }
 
 // src/cli/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors23.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors24.default.dim("sync engine")}
 `;
 var SUBCOMMAND_USAGE = {
   connect: CONNECT_USAGE,
@@ -285360,7 +285477,7 @@ async function main() {
     const devArgs = process.argv.slice(3);
     const oneShot = devArgs.includes("--no-watch");
     console.log(
-      import_picocolors23.default.dim(
+      import_picocolors24.default.dim(
         oneShot ? "  `ablo dev --no-watch` is `ablo push` (push once, no watcher) \u2014 running that." : "  `ablo dev` is now `ablo push --watch` \u2014 running that."
       )
     );
@@ -285389,14 +285506,14 @@ async function main() {
     const guard = guardActiveProjectKey();
     if (!guard.ok && guard.available.length > 0 && !rest.includes("--url")) {
       console.error(
-        `  ${import_picocolors23.default.yellow("\u26A0")} active project ${import_picocolors23.default.bold(guard.activeProfile)} has no stored key ${import_picocolors23.default.dim(
+        `  ${import_picocolors24.default.yellow("\u26A0")} active project ${import_picocolors24.default.bold(guard.activeProfile)} has no stored key ${import_picocolors24.default.dim(
           `(you have keys for: ${guard.available.join(", ")})`
         )}`
       );
       const loginCmd = guard.activeProfile === "default" ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
       console.error(
-        import_picocolors23.default.dim(
-          `    Mint one with ${import_picocolors23.default.bold(loginCmd)}, or switch with ${import_picocolors23.default.bold("ablo projects use <slug>")}.`
+        import_picocolors24.default.dim(
+          `    Mint one with ${import_picocolors24.default.bold(loginCmd)}, or switch with ${import_picocolors24.default.bold("ablo projects use <slug>")}.`
         )
       );
       process.exitCode = 1;
@@ -285414,13 +285531,13 @@ async function main() {
     await generate(process.argv.slice(3));
   } else if (command === "schema") {
     console.error(
-      `  ${import_picocolors23.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
+      `  ${import_picocolors24.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
     );
     console.error(`    Run \`ablo push${process.argv.slice(4).join(" ") ? " " + process.argv.slice(4).join(" ") : ""}\` instead.`);
     process.exitCode = 1;
   } else {
     console.log(LOGO);
-    console.log(`  ${import_picocolors23.default.bold("Usage:")}`);
+    console.log(`  ${import_picocolors24.default.bold("Usage:")}`);
     console.log(`    npx ablo init                          Scaffold ablo/ directory + starter schema`);
     console.log(`    npx ablo init --yes [--framework nextjs] Non-interactive (agents/CI): no prompts, flag-driven`);
     console.log(`                  [--auth apikey] [--storage replication|endpoint] [--project <slug>] [--no-project]`);
@@ -285457,10 +285574,10 @@ async function main() {
     console.log(`    npx ablo generate                      Emit TypeScript types from your schema`);
     console.log(`    npx ablo generate --out path.ts        Write generated types to a path`);
     console.log();
-    console.log(`  ${import_picocolors23.default.bold("Schema workflow:")}`);
+    console.log(`  ${import_picocolors24.default.bold("Schema workflow:")}`);
     console.log(`    The server holds its own copy of your schema \u2014 edit ${brand("ablo/schema.ts")}, then`);
     console.log(`    run ${brand("ablo push")} (or keep ${brand("ablo dev")} running) before the server will accept`);
-    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors23.default.yellow("server_execute_unknown_model")}.`);
+    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors24.default.yellow("server_execute_unknown_model")}.`);
     console.log();
   }
 }
@@ -285511,7 +285628,7 @@ async function ensureInitProject(opts) {
   const ensured = await ensureProject(slug);
   if (ensured) {
     console.log(
-      `  ${import_picocolors23.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors23.default.bold(ensured.slug)} ${import_picocolors23.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
+      `  ${import_picocolors24.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors24.default.bold(ensured.slug)} ${import_picocolors24.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
     );
   }
 }
@@ -285553,7 +285670,7 @@ async function chooseBool(flagValue, fallback, interactive, prompt) {
 async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors23.default.dim("sync engine")}`);
+  Ie(`${brand("ablo")} ${import_picocolors24.default.dim("sync engine")}`);
   if (!(0, import_fs12.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
@@ -285631,7 +285748,7 @@ async function init(args = []) {
   if (pullExisting) {
     const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
     if (!dbUrl) {
-      schemaNote = import_picocolors23.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
+      schemaNote = import_picocolors24.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -285641,12 +285758,12 @@ async function init(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors23.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors24.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors23.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors24.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors23.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors24.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
@@ -285672,14 +285789,14 @@ async function init(args = []) {
     const existing = (0, import_fs12.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
       (0, import_fs12.writeFileSync)(envFile, existing + "\n" + envBody);
-      created.push(`${envFile} ${import_picocolors23.default.dim("(appended)")}`);
+      created.push(`${envFile} ${import_picocolors24.default.dim("(appended)")}`);
     } else {
-      created.push(`${envFile} ${import_picocolors23.default.dim("(already configured)")}`);
+      created.push(`${envFile} ${import_picocolors24.default.dim("(already configured)")}`);
     }
   }
   if (wireRealKey && resolvedKey) {
     wireEnvLocal(resolvedKey);
-    created.push(`.env.local ${import_picocolors23.default.dim("(ABLO_API_KEY set from your login)")}`);
+    created.push(`.env.local ${import_picocolors24.default.dim("(ABLO_API_KEY set from your login)")}`);
   }
   if (agent) {
     (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "agent.ts"), generateAgent());
@@ -285694,17 +285811,17 @@ async function init(args = []) {
     }
     const providersPath = (0, import_path7.join)(layout.appBase, "providers.tsx");
     (0, import_fs12.writeFileSync)(providersPath, generateProviders());
-    created.push(`${providersPath} ${import_picocolors23.default.dim(`(wrap ${(0, import_path7.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    created.push(`${providersPath} ${import_picocolors24.default.dim(`(wrap ${(0, import_path7.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
     const sessionDir = (0, import_path7.join)(layout.appBase, "api", "ablo-session");
     (0, import_fs12.mkdirSync)(sessionDir, { recursive: true });
     (0, import_fs12.writeFileSync)((0, import_path7.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`${(0, import_path7.join)(sessionDir, "route.ts")} ${import_picocolors23.default.dim("(wire your auth)")}`);
+    created.push(`${(0, import_path7.join)(sessionDir, "route.ts")} ${import_picocolors24.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
     (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
-  Me(created.map((f) => `${import_picocolors23.default.green("\u2713")} ${f}`).join("\n"), "Created");
+  Me(created.map((f) => `${import_picocolors24.default.green("\u2713")} ${f}`).join("\n"), "Created");
   const pm = detectPackageManager();
   if (opts.install) {
     const s = Y2();
@@ -285713,47 +285830,47 @@ async function init(args = []) {
       (0, import_child_process3.execSync)(`${pm} add @abloatai/ablo`, { stdio: "ignore" });
       s.stop("Installed @abloatai/ablo");
     } catch {
-      s.stop(`${import_picocolors23.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors23.default.bold(`${pm} install @abloatai/ablo`)}`);
+      s.stop(`${import_picocolors24.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors24.default.bold(`${pm} install @abloatai/ablo`)}`);
     }
   }
   const steps = [
-    `Get a ${import_picocolors23.default.bold("sk_test_")} key at ${import_picocolors23.default.cyan("https://abloatai.com")}`,
-    `Run ${import_picocolors23.default.bold("npx ablo login")} (or add ${import_picocolors23.default.bold("ABLO_API_KEY")} to ${import_picocolors23.default.bold(envFile)})`,
-    `Set ${import_picocolors23.default.bold("DATABASE_URL")} in ${import_picocolors23.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors23.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Get a ${import_picocolors24.default.bold("sk_test_")} key at ${import_picocolors24.default.cyan("https://abloatai.com")}`,
+    `Run ${import_picocolors24.default.bold("npx ablo login")} (or add ${import_picocolors24.default.bold("ABLO_API_KEY")} to ${import_picocolors24.default.bold(envFile)})`,
+    `Set ${import_picocolors24.default.bold("DATABASE_URL")} in ${import_picocolors24.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors24.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "replication" ? [
-      `Connect your database \u2014 ${import_picocolors23.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
-      `Verify it \u2014 ${import_picocolors23.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
-      `Register it \u2014 ${import_picocolors23.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
+      `Connect your database \u2014 ${import_picocolors24.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
+      `Verify it \u2014 ${import_picocolors24.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
+      `Register it \u2014 ${import_picocolors24.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
     ] : [
-      `Provision your DB: ${import_picocolors23.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors23.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors23.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors24.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors24.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors24.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors23.default.bold((0, import_path7.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors23.default.bold("<Providers>")} (${(0, import_path7.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors23.default.bold((0, import_path7.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors24.default.bold((0, import_path7.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors24.default.bold("<Providers>")} (${(0, import_path7.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors24.default.bold((0, import_path7.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
-    `Run ${import_picocolors23.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors24.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors23.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
-      `Run ${import_picocolors23.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors24.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
+      `Run ${import_picocolors24.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
   const existingKey = resolveApiKey("sandbox");
   if (existingKey) {
     await ensureInitProject(opts);
-    Se(`Already authorized ${import_picocolors23.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)} \u2014 run ${import_picocolors23.default.bold("npx ablo push")} next. ${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
+    Se(`Already authorized ${import_picocolors24.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)} \u2014 run ${import_picocolors24.default.bold("npx ablo push")} next. ${import_picocolors24.default.dim("Docs:")} https://abloatai.com/docs`);
     return;
   }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors24.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       await ensureInitProject(opts);
       return;
     }
   }
-  Se(`Run ${import_picocolors23.default.bold("npx ablo login")} when ready. ${import_picocolors23.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors24.default.bold("npx ablo login")} when ready. ${import_picocolors24.default.dim("Docs:")} https://abloatai.com/docs`);
 }
 function generateSchema() {
   return `import { defineSchema, model, relation, z } from '@abloatai/ablo/schema';