@abloatai/ablo 0.9.4 → 0.9.6

package/dist/cli.cjs

@@ -125060,7 +125060,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve5 = factory2.createUniqueName("resolve");
+          const resolve6 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -125069,7 +125069,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve5
+              resolve6
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -125086,7 +125086,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve5, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve6, reject]
               )
             )
           ]);
@@ -211695,8 +211695,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve5, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve5, reject });
+          const promise = new Promise((resolve6, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve6, reject });
           });
           this.installer.send(request);
           return promise;
@@ -213965,7 +213965,7 @@ var require_path_browserify = __commonJS({
     }
     var posix = {
       // path.resolve([from ...], to)
-      resolve: function resolve5() {
+      resolve: function resolve6() {
         var resolvedPath = "";
         var resolvedAbsolute = false;
         var cwd;
@@ -218865,41 +218865,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push2(value) {
-        var p2 = new Promise(function(resolve5, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve5(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function unshift(value) {
-        var p2 = new Promise(function(resolve5, reject) {
+        var p2 = new Promise(function(resolve6, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve5(result);
+            resolve6(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function drained() {
-        var p2 = new Promise(function(resolve5) {
+        var p2 = new Promise(function(resolve6) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve5();
+              resolve6();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve5();
+                resolve6();
                 queue.drain = previousDrain;
               };
             }
@@ -219396,9 +219396,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve5(stats) : reject(error);
+            return error === null ? resolve6(stats) : reject(error);
           });
         });
       }
@@ -219423,10 +219423,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve5(entries);
+              resolve6(entries);
             } else {
               reject(error);
             }
@@ -219436,10 +219436,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve5(entries));
+          stream.once("end", () => resolve6(entries));
         });
       }
     };
@@ -252345,12 +252345,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
     };
     var NodeRuntimeFileSystem = class {
       delete(path2) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rm(path2, { recursive: true }, (err) => {
             if (err)
               reject(err);
             else
-              resolve5();
+              resolve6();
           });
         });
       }
@@ -252369,12 +252369,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         }));
       }
       readFile(filePath, encoding = "utf-8") {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.readFile(filePath, encoding, (err, data) => {
             if (err)
               reject(err);
             else
-              resolve5(data);
+              resolve6(data);
           });
         });
       }
@@ -252382,12 +252382,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         return fs__namespace.readFileSync(filePath, encoding);
       }
       async writeFile(filePath, fileText) {
-        await new Promise((resolve5, reject) => {
+        await new Promise((resolve6, reject) => {
           fs__namespace.writeFile(filePath, fileText, (err) => {
             if (err)
               reject(err);
             else
-              resolve5();
+              resolve6();
           });
         });
       }
@@ -252401,12 +252401,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.mkdirSync(dirPath, { recursive: true });
       }
       move(srcPath, destPath) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.rename(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve5();
+              resolve6();
           });
         });
       }
@@ -252414,12 +252414,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.renameSync(srcPath, destPath);
       }
       copy(srcPath, destPath) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.copyFile(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve5();
+              resolve6();
           });
         });
       }
@@ -252427,15 +252427,15 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.copyFileSync(srcPath, destPath);
       }
       stat(path2) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           fs__namespace.stat(path2, (err, stat) => {
             if (err) {
               if (err.code === "ENOENT" || err.code === "ENOTDIR")
-                resolve5(void 0);
+                resolve6(void 0);
               else
                 reject(err);
             } else {
-              resolve5(stat);
+              resolve6(stat);
             }
           });
         });
@@ -276700,9 +276700,9 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
 };
 
 // src/cli/index.ts
-var import_picocolors16 = __toESM(require_picocolors(), 1);
-var import_fs11 = require("fs");
-var import_path6 = require("path");
+var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_fs12 = require("fs");
+var import_path7 = require("path");
 var import_child_process2 = require("child_process");
 
 // src/cli/migrate.ts
@@ -276775,6 +276775,7 @@ var ERROR_CODES = {
   issuer_register_forbidden: wire("permission", 403, false, "Registering a trusted issuer requires a secret (sk_) API key."),
   capability_invalid: wire("capability", 403, false, "The capability is unknown, revoked, or expired."),
   test_database_not_registered: wire("permission", 403, false, "Test mode requires a registered dev database for this org \u2014 run `npx ablo init`, or construct the client with `databaseUrl` using your test key."),
+  tenant_routing_failed: wire("server", 500, true, "The org's registered database could not be resolved or dialed. Ablo never falls back to shared storage for a dedicated tenant \u2014 retry, and check the datasource status if it persists."),
   database_role_cannot_enforce_rls: wire("permission", 403, false, "The connected database role cannot enforce row-level security (superuser or BYPASSRLS)."),
   database_role_unreadable: wire("permission", 403, false, "The connected database role could not be introspected."),
   database_tables_unforced_rls: wire("permission", 403, false, "Synced tables in the connected database do not have FORCE ROW LEVEL SECURITY applied."),
@@ -276786,13 +276787,22 @@ var ERROR_CODES = {
   byo_tenant_tables_unforced_rls: wire("permission", 403, false, "Tenant tables do not have RLS forced under the direct Postgres connector role."),
   byo_host_not_allowed: wire("permission", 403, false, "The direct Postgres connector host resolves to a private, loopback, or link-local address and cannot be used."),
   // ── claim / intent conflict (409) ──────────────────────────────────
-  claim_conflict: wire("claim", 409, true, "The target entity is claimed by another participant."),
-  claim_lost: wire("claim", 409, true, "A previously held claim was lost before the write applied."),
-  entity_claimed: wire("claim", 409, true, "The target entity is currently claimed; write was blocked."),
-  intent_conflict: wire("claim", 409, true, "An intent on the target conflicts with an active intent (server-internal alias of claim_conflict)."),
+  // Held-claim rejections are NOT queue-retryable (gRPC FAILED_PRECONDITION /
+  // ABORTED semantics; Replicache/Zero SETTLE a rejected mutation — reject the
+  // caller, roll back the optimistic effect — instead of resending it).
+  // Blindly re-sending the same payload cannot succeed while the lease is
+  // held, and a lease can outlive any sane retry budget. The correct recovery
+  // lives at the CALLER: take a claim (`ablo.<model>.claim` queues fairly
+  // behind the holder) or re-read and rebase. `retryable: true` here turned
+  // every cross-client claim conflict into an infinite client resend loop
+  // (~150ms storm — found by the claims journey, 2026-06-10).
+  claim_conflict: wire("claim", 409, false, "The target entity is claimed by another participant."),
+  claim_lost: wire("claim", 409, false, "A previously held claim was lost before the write applied."),
+  entity_claimed: wire("claim", 409, false, "The target entity is currently claimed; write was blocked."),
+  intent_conflict: wire("claim", 409, false, "An intent on the target conflicts with an active intent (server-internal alias of claim_conflict)."),
   malformed_claim: wire("claim", 400, false, "The claim payload was malformed."),
-  model_claimed: wire("claim", 409, true, "The model instance is claimed by another participant."),
-  model_claimed_timeout: wire("claim", 409, true, "Timed out waiting for a model claim to clear."),
+  model_claimed: wire("claim", 409, false, "The model instance is claimed by another participant."),
+  model_claimed_timeout: wire("claim", 409, false, "Timed out waiting for a model claim to clear."),
   model_claim_not_configured: client("claim", "Claiming was requested on a model that has no claim configuration."),
   // ── stale context / idempotency (409) ──────────────────────────────
   stale_context: wire("conflict", 409, true, "The write carried a readAt watermark that is now stale; re-read and retry."),
@@ -277087,8 +277097,8 @@ var ErrorBodyShapeSchema = import_zod2.z.object({
 }).passthrough();
 
 // src/cli/migrate.ts
-var import_picocolors3 = __toESM(require_picocolors(), 1);
-var import_fs4 = require("fs");
+var import_picocolors4 = __toESM(require_picocolors(), 1);
+var import_fs5 = require("fs");
 
 // node_modules/postgres/src/index.js
 init_cjs_shims();
@@ -277106,9 +277116,9 @@ var originError = /* @__PURE__ */ Symbol("OriginError");
 var CLOSE = {};
 var Query = class extends Promise {
   constructor(strings, args, handler, canceller, options = {}) {
-    let resolve5, reject;
+    let resolve6, reject;
     super((a, b4) => {
-      resolve5 = a;
+      resolve6 = a;
       reject = b4;
     });
     this.tagged = Array.isArray(strings.raw);
@@ -277119,7 +277129,7 @@ var Query = class extends Promise {
     this.options = options;
     this.state = null;
     this.statement = null;
-    this.resolve = (x2) => (this.active = false, resolve5(x2));
+    this.resolve = (x2) => (this.active = false, resolve6(x2));
     this.reject = (x2) => (this.active = false, reject(x2));
     this.active = false;
     this.cancelled = null;
@@ -277167,12 +277177,12 @@ var Query = class extends Promise {
           if (this.executed && !this.active)
             return { done: true };
           prev && prev();
-          const promise = new Promise((resolve5, reject) => {
+          const promise = new Promise((resolve6, reject) => {
             this.cursorFn = (value) => {
-              resolve5({ value, done: false });
+              resolve6({ value, done: false });
               return new Promise((r2) => prev = r2);
             };
-            this.resolve = () => (this.active = false, resolve5({ done: true }));
+            this.resolve = () => (this.active = false, resolve6({ done: true }));
             this.reject = (x2) => (this.active = false, reject(x2));
           });
           this.execute();
@@ -277804,12 +277814,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x2.on("drain", drain);
     return x2;
   }
-  async function cancel({ pid, secret }, resolve5, reject) {
+  async function cancel({ pid, secret }, resolve6, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect();
       socket.once("error", reject);
-      socket.once("close", resolve5);
+      socket.once("close", resolve6);
     } catch (error2) {
       reject(error2);
     }
@@ -278758,7 +278768,7 @@ function parseEvent(x2) {
 init_cjs_shims();
 var import_stream2 = __toESM(require("stream"), 1);
 function largeObject(sql, oid, mode2 = 131072 | 262144) {
-  return new Promise(async (resolve5, reject) => {
+  return new Promise(async (resolve6, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -278784,7 +278794,7 @@ function largeObject(sql, oid, mode2 = 131072 | 262144) {
           ) seek
         `
       };
-      resolve5(lo);
+      resolve6(lo);
       return new Promise(async (r2) => finish = r2);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -278958,8 +278968,8 @@ function Postgres(a, b4) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve5, reject) => {
-      const query = { reserve: resolve5, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve6, reject) => {
+      const query = { reserve: resolve6, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
     });
@@ -278996,9 +279006,9 @@ function Postgres(a, b4) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve5, reject) => {
+        result = await new Promise((resolve6, reject) => {
           const x2 = fn2(sql2);
-          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve5, reject);
+          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve6, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -279055,8 +279065,8 @@ function Postgres(a, b4) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve5, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve5, reject) : query.cancelled = { resolve: resolve5, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve5());
+    return new Promise((resolve6, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve6, reject) : query.cancelled = { resolve: resolve6, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve6());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -279075,11 +279085,11 @@ function Postgres(a, b4) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve5) {
+  async function destroy(resolve6) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve5();
+    resolve6();
   }
   function connect(c, query) {
     move(c, connecting);
@@ -279224,32 +279234,198 @@ function osUsername() {
   }
 }
 
+// src/cli/dbRole.ts
+init_cjs_shims();
+var import_crypto2 = require("crypto");
+var import_picocolors2 = __toESM(require_picocolors(), 1);
+var import_fs2 = require("fs");
+var import_path = require("path");
+var DEFAULT_SCOPED_ROLE = "ablo_app";
+async function detectRoleSafety(sql) {
+  const rows = await sql`SELECT rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user`;
+  const row = rows[0];
+  if (!row) return { role: "unknown", superuser: false, bypassRls: false, unsafe: false };
+  return {
+    role: row.rolname,
+    superuser: row.rolsuper,
+    bypassRls: row.rolbypassrls,
+    unsafe: row.rolsuper || row.rolbypassrls
+  };
+}
+function generateRolePassword() {
+  return (0, import_crypto2.randomBytes)(24).toString("base64url");
+}
+function scramSha256Verifier(password, iterations = 4096) {
+  const salt = (0, import_crypto2.randomBytes)(16);
+  const saltedPassword = (0, import_crypto2.pbkdf2Sync)(password, salt, iterations, 32, "sha256");
+  const clientKey = (0, import_crypto2.createHmac)("sha256", saltedPassword).update("Client Key").digest();
+  const storedKey = (0, import_crypto2.createHash)("sha256").update(clientKey).digest();
+  const serverKey = (0, import_crypto2.createHmac)("sha256", saltedPassword).update("Server Key").digest();
+  return `SCRAM-SHA-256$${iterations}:${salt.toString("base64")}$${storedKey.toString("base64")}:${serverKey.toString("base64")}`;
+}
+function scopedRoleStatements(input) {
+  const role = input.role ?? DEFAULT_SCOPED_ROLE;
+  const q2 = (id) => `"${id.replace(/"/g, '""')}"`;
+  const pw = (input.passwordMode ?? "scram-verifier") === "scram-verifier" ? scramSha256Verifier(input.password) : input.password.replace(/'/g, "''");
+  return [
+    `DO $$ BEGIN
+  CREATE ROLE ${q2(role)} LOGIN PASSWORD '${pw}'
+    NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
+EXCEPTION WHEN duplicate_object THEN
+  -- Rerun: rotate ONLY the password. Re-asserting attributes here trips
+  -- managed-Postgres permission walls (Neon: "permission denied to alter
+  -- role" for attribute changes by non-superusers); the attributes were set
+  -- at creation, and the server-side probe still audits the live role.
+  ALTER ROLE ${q2(role)} WITH LOGIN PASSWORD '${pw}';
+END $$;`,
+    `GRANT CREATE, CONNECT ON DATABASE ${q2(input.database)} TO ${q2(role)};`,
+    `GRANT CREATE, USAGE ON SCHEMA public TO ${q2(role)};`
+  ];
+}
+function rewriteDatabaseUrl(ownerUrl, role, password) {
+  const url = new URL(ownerUrl);
+  url.username = role;
+  url.password = password;
+  return url.toString();
+}
+async function createScopedRole(ownerUrl, options) {
+  const role = options?.role ?? DEFAULT_SCOPED_ROLE;
+  const password = generateRolePassword();
+  const database = new URL(ownerUrl).pathname.replace(/^\//, "") || "postgres";
+  const sql = src_default(ownerUrl, { max: 1, prepare: false, onnotice: () => {
+  } });
+  try {
+    try {
+      for (const statement of scopedRoleStatements({ database, role, password })) {
+        await sql.unsafe(statement);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (!/plaintext password/i.test(message)) throw err;
+      for (const statement of scopedRoleStatements({ database, role, password, passwordMode: "plaintext" })) {
+        await sql.unsafe(statement);
+      }
+    }
+  } finally {
+    await sql.end({ timeout: 5 });
+  }
+  return { role, databaseUrl: rewriteDatabaseUrl(ownerUrl, role, password) };
+}
+async function ensureScopedRoleInteractive(dbUrl) {
+  let safety;
+  try {
+    const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
+    } });
+    try {
+      safety = await detectRoleSafety(sql);
+    } finally {
+      await sql.end({ timeout: 5 });
+    }
+  } catch {
+    return dbUrl;
+  }
+  if (!safety.unsafe) return dbUrl;
+  const why = safety.superuser ? "a superuser" : "BYPASSRLS";
+  console.log(
+    `
+  ${import_picocolors2.default.yellow("!")} DATABASE_URL connects as ${import_picocolors2.default.bold(safety.role)} \u2014 ${why}, so row-level security can't be enforced.
+    Ablo's server will refuse this connection (${import_picocolors2.default.bold("database_role_cannot_enforce_rls")}).`
+  );
+  if (!process.stdout.isTTY) {
+    console.log(
+      import_picocolors2.default.dim(
+        `    Create a scoped role and update DATABASE_URL \u2014 run \`npx ablo migrate\` interactively
+    to do it automatically, or see https://docs.abloatai.com/quickstart#scoped-role`
+      )
+    );
+    return dbUrl;
+  }
+  const proceed = await ye({
+    message: `Create a scoped role ${DEFAULT_SCOPED_ROLE} (NOSUPERUSER, NOBYPASSRLS) and update DATABASE_URL?`,
+    initialValue: true
+  });
+  if (pD(proceed) || !proceed) {
+    console.log(import_picocolors2.default.dim("    Skipped \u2014 see https://docs.abloatai.com/quickstart#scoped-role for the manual recipe."));
+    return dbUrl;
+  }
+  const { role, databaseUrl } = await createScopedRole(dbUrl);
+  const where = persistDatabaseUrl(databaseUrl);
+  console.log(
+    `  ${import_picocolors2.default.green("\u2713")} Created role ${import_picocolors2.default.bold(role)} and updated ${import_picocolors2.default.bold("DATABASE_URL")} in ${import_picocolors2.default.bold(where)}.
+` + import_picocolors2.default.dim(`    The owner credential never left this machine; the new password was written, not printed.`)
+  );
+  return databaseUrl;
+}
+function persistDatabaseUrl(databaseUrl, cwd = process.cwd()) {
+  const line = `DATABASE_URL=${databaseUrl}`;
+  for (const name of [".env.local", ".env"]) {
+    const path = (0, import_path.resolve)(cwd, name);
+    if (!(0, import_fs2.existsSync)(path)) continue;
+    const content = (0, import_fs2.readFileSync)(path, "utf8");
+    if (/^DATABASE_URL=/m.test(content)) {
+      (0, import_fs2.writeFileSync)(path, content.replace(/^DATABASE_URL=.*$/m, line));
+      return name;
+    }
+  }
+  const envLocal = (0, import_path.resolve)(cwd, ".env.local");
+  if ((0, import_fs2.existsSync)(envLocal)) {
+    const content = (0, import_fs2.readFileSync)(envLocal, "utf8");
+    (0, import_fs2.appendFileSync)(envLocal, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
+`);
+  } else {
+    (0, import_fs2.writeFileSync)(envLocal, `${line}
+`, { mode: 384 });
+  }
+  const gitignorePath = (0, import_path.resolve)(cwd, ".gitignore");
+  const gitignore = (0, import_fs2.existsSync)(gitignorePath) ? (0, import_fs2.readFileSync)(gitignorePath, "utf8") : "";
+  if (!/^(\.env\.local|\.env\*|\.env\.\*|\.env.*)$/m.test(gitignore)) {
+    (0, import_fs2.writeFileSync)(
+      gitignorePath,
+      `${gitignore.endsWith("\n") || gitignore.length === 0 ? gitignore : `${gitignore}
+`}.env.local
+`
+    );
+  }
+  return ".env.local";
+}
+function readProjectDatabaseUrl(cwd = process.cwd()) {
+  const fromEnv = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
+  if (fromEnv) return fromEnv;
+  for (const name of [".env.local", ".env"]) {
+    const path = (0, import_path.resolve)(cwd, name);
+    if (!(0, import_fs2.existsSync)(path)) continue;
+    const match = (0, import_fs2.readFileSync)(path, "utf8").match(/^DATABASE_URL=(.+)$/m);
+    if (match?.[1]) return match[1].trim().replace(/^["']|["']$/g, "");
+  }
+  return null;
+}
+
 // src/cli/migrate.ts
 var import_schema2 = require("@abloatai/ablo/schema");
 var import_source = require("@abloatai/ablo/source");
 
 // src/cli/push.ts
 init_cjs_shims();
-var import_picocolors2 = __toESM(require_picocolors(), 1);
-var import_fs3 = require("fs");
-var import_path2 = require("path");
+var import_picocolors3 = __toESM(require_picocolors(), 1);
+var import_fs4 = require("fs");
+var import_path3 = require("path");
 var import_schema = require("@abloatai/ablo/schema");
 
 // src/cli/config.ts
 init_cjs_shims();
 var import_os2 = require("os");
-var import_path = require("path");
-var import_fs2 = require("fs");
+var import_path2 = require("path");
+var import_fs3 = require("fs");
 function configDir() {
   if (process.env.ABLO_CONFIG_DIR) return process.env.ABLO_CONFIG_DIR;
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg ? (0, import_path.join)(xdg, "ablo") : (0, import_path.join)((0, import_os2.homedir)(), ".config", "ablo");
+  return xdg ? (0, import_path2.join)(xdg, "ablo") : (0, import_path2.join)((0, import_os2.homedir)(), ".config", "ablo");
 }
 function configPath() {
-  return (0, import_path.join)(configDir(), "config.json");
+  return (0, import_path2.join)(configDir(), "config.json");
 }
 function credentialsPath() {
-  return (0, import_path.join)(configDir(), "credentials.json");
+  return (0, import_path2.join)(configDir(), "credentials.json");
 }
 function asKeyEntry(value) {
   if (value && typeof value === "object" && typeof value.apiKey === "string") {
@@ -279258,9 +279434,9 @@ function asKeyEntry(value) {
   return void 0;
 }
 function readJson(path) {
-  if (!(0, import_fs2.existsSync)(path)) return null;
+  if (!(0, import_fs3.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_fs2.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_fs3.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -279297,14 +279473,14 @@ function readConfig() {
 }
 function writeConfig(cfg) {
   const dir = configDir();
-  (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: 448 });
-  (0, import_fs2.writeFileSync)(configPath(), `${JSON.stringify({ mode: cfg.mode }, null, 2)}
+  (0, import_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_fs3.writeFileSync)(configPath(), `${JSON.stringify({ mode: cfg.mode }, null, 2)}
 `, { mode: 384 });
   const credentials = {
     ...cfg.sandbox ? { sandbox: cfg.sandbox } : {},
     ...cfg.production ? { production: cfg.production } : {}
   };
-  (0, import_fs2.writeFileSync)(credentialsPath(), `${JSON.stringify(credentials, null, 2)}
+  (0, import_fs3.writeFileSync)(credentialsPath(), `${JSON.stringify(credentials, null, 2)}
 `, { mode: 384 });
   return credentialsPath();
 }
@@ -279325,8 +279501,8 @@ function normalizeMode(value) {
 function clearCredential() {
   let removed = false;
   for (const path of [configPath(), credentialsPath()]) {
-    if ((0, import_fs2.existsSync)(path)) {
-      (0, import_fs2.rmSync)(path);
+    if ((0, import_fs3.existsSync)(path)) {
+      (0, import_fs3.rmSync)(path);
       removed = true;
     }
   }
@@ -279355,7 +279531,7 @@ var DEFAULT_URL = "https://api.abloatai.com";
 function fmtSignal(s) {
   const sig = s;
   const where = sig.field ? `${sig.model}.${sig.field}` : sig.model;
-  return `    \u2022 ${import_picocolors2.default.bold(where ?? "?")} \u2014 ${sig.detail ?? ""}`;
+  return `    \u2022 ${import_picocolors3.default.bold(where ?? "?")} \u2014 ${sig.detail ?? ""}`;
 }
 async function pushSchema(schema, args) {
   const schemaJson = JSON.parse((0, import_schema.serializeSchema)(schema));
@@ -279433,10 +279609,10 @@ function parsePushArgs(argv) {
   return { schemaPath, exportName, url, apiKey: process.env.ABLO_API_KEY, force, renames, backfills };
 }
 async function loadSchema(schemaPath, exportName) {
-  const abs = (0, import_path2.resolve)(process.cwd(), schemaPath);
-  if (!(0, import_fs3.existsSync)(abs)) {
+  const abs = (0, import_path3.resolve)(process.cwd(), schemaPath);
+  if (!(0, import_fs4.existsSync)(abs)) {
     throw new AbloValidationError(
-      `schema not found at ${import_picocolors2.default.bold(schemaPath)}. Run ${import_picocolors2.default.bold("npx ablo init")} or pass ${import_picocolors2.default.bold("--schema <path>")}.`,
+      `schema not found at ${import_picocolors3.default.bold(schemaPath)}. Run ${import_picocolors3.default.bold("npx ablo init")} or pass ${import_picocolors3.default.bold("--schema <path>")}.`,
       { code: "cli_invalid_arguments" }
     );
   }
@@ -279447,7 +279623,7 @@ async function loadSchema(schemaPath, exportName) {
   const schema = mod[exportName] ?? nested?.[exportName];
   if (!schema || typeof schema !== "object" || !("models" in schema)) {
     throw new AbloValidationError(
-      `${import_picocolors2.default.bold(schemaPath)} has no \`${exportName}\` export that looks like a Schema. Did you \`export const ${exportName} = defineSchema({ ... })\`?`,
+      `${import_picocolors3.default.bold(schemaPath)} has no \`${exportName}\` export that looks like a Schema. Did you \`export const ${exportName} = defineSchema({ ... })\`?`,
       { code: "cli_invalid_arguments" }
     );
   }
@@ -279458,30 +279634,30 @@ async function push(argv) {
   try {
     args = parsePushArgs(argv);
   } catch (err) {
-    console.error(import_picocolors2.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors3.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.apiKey) args.apiKey = resolveApiKey();
   if (!args.apiKey) {
     console.error(
-      import_picocolors2.default.red(`  No API key.`) + import_picocolors2.default.dim(` Run ${import_picocolors2.default.bold("ablo login")} or set ${import_picocolors2.default.bold("ABLO_API_KEY")} (a secret sk_ key with schema:push).`)
+      import_picocolors3.default.red(`  No API key.`) + import_picocolors3.default.dim(` Run ${import_picocolors3.default.bold("ablo login")} or set ${import_picocolors3.default.bold("ABLO_API_KEY")} (a secret sk_ key with schema:push).`)
     );
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const hash = (0, import_schema.schemaHash)(schema);
   console.log(
-    `  Pushing ${import_picocolors2.default.bold(args.schemaPath)} ${import_picocolors2.default.dim(`(${Object.keys(schema.models).length} models, hash ${hash})`)} \u2192 ${import_picocolors2.default.dim(args.url)}`
+    `  Pushing ${import_picocolors3.default.bold(args.schemaPath)} ${import_picocolors3.default.dim(`(${Object.keys(schema.models).length} models, hash ${hash})`)} \u2192 ${import_picocolors3.default.dim(args.url)}`
   );
   const { ok: resOk, status: status2, body, bodyText } = await pushSchema(schema, args);
   if (resOk) {
     if (body.unchanged) {
-      console.log(`  ${import_picocolors2.default.dim("\u25CB")} No changes \u2014 schema already active (v${body.version}).`);
+      console.log(`  ${import_picocolors3.default.dim("\u25CB")} No changes \u2014 schema already active (v${body.version}).`);
     } else {
-      console.log(`  ${import_picocolors2.default.green("\u2713")} Activated ${import_picocolors2.default.bold(`v${body.version}`)} ${import_picocolors2.default.dim(`(hash ${body.hash})`)}`);
+      console.log(`  ${import_picocolors3.default.green("\u2713")} Activated ${import_picocolors3.default.bold(`v${body.version}`)} ${import_picocolors3.default.dim(`(hash ${body.hash})`)}`);
       if (Array.isArray(body.warnings) && body.warnings.length > 0) {
-        console.log(import_picocolors2.default.yellow(`  Applied ${body.warnings.length} destructive change(s):`));
-        for (const w2 of body.warnings) console.log(import_picocolors2.default.yellow(fmtSignal(w2)));
+        console.log(import_picocolors3.default.yellow(`  Applied ${body.warnings.length} destructive change(s):`));
+        for (const w2 of body.warnings) console.log(import_picocolors3.default.yellow(fmtSignal(w2)));
       }
     }
     return;
@@ -279489,20 +279665,20 @@ async function push(argv) {
   if (status2 === 409) {
     const unexecutable = Array.isArray(body.unexecutable) ? body.unexecutable : [];
     const warnings = Array.isArray(body.warnings) ? body.warnings : [];
-    console.error(import_picocolors2.default.red("  Incompatible change \u2014 this push is not safe to apply as-is."));
+    console.error(import_picocolors3.default.red("  Incompatible change \u2014 this push is not safe to apply as-is."));
     if (unexecutable.length > 0) {
-      console.error(import_picocolors2.default.red(`  Unexecutable (would fail on existing rows):`));
-      for (const u2 of unexecutable) console.error(import_picocolors2.default.red(fmtSignal(u2)));
+      console.error(import_picocolors3.default.red(`  Unexecutable (would fail on existing rows):`));
+      for (const u2 of unexecutable) console.error(import_picocolors3.default.red(fmtSignal(u2)));
     }
     if (warnings.length > 0) {
-      console.error(import_picocolors2.default.yellow(`  Destructive (data loss):`));
-      for (const w2 of warnings) console.error(import_picocolors2.default.yellow(fmtSignal(w2)));
+      console.error(import_picocolors3.default.yellow(`  Destructive (data loss):`));
+      for (const w2 of warnings) console.error(import_picocolors3.default.yellow(fmtSignal(w2)));
     }
-    console.error(import_picocolors2.default.dim(`  Re-push with ${import_picocolors2.default.bold("--force")} to override, or use ${import_picocolors2.default.bold("--rename old:new")} if you renamed a model.`));
+    console.error(import_picocolors3.default.dim(`  Re-push with ${import_picocolors3.default.bold("--force")} to override, or use ${import_picocolors3.default.bold("--rename old:new")} if you renamed a model.`));
   } else if (status2 === 403) {
-    console.error(import_picocolors2.default.red(`  Forbidden: ${body.reason ?? "key lacks schema:push scope"}.`));
+    console.error(import_picocolors3.default.red(`  Forbidden: ${body.message ?? body.reason ?? "key lacks schema:push scope"}`));
   } else {
-    console.error(import_picocolors2.default.red(`  Push failed (${status2}): ${body.reason ?? bodyText}`));
+    console.error(import_picocolors3.default.red(`  Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}`));
   }
   process.exit(1);
 }
@@ -279550,8 +279726,8 @@ function planFor(schema, targetSchema = "public") {
 }
 var log = {
   info: (msg, fields) => console.log(`[migrate] ${msg}`, fields),
-  warn: (msg, fields) => console.warn(import_picocolors3.default.yellow(`[migrate] ${msg}`), fields),
-  error: (msg, fields) => console.error(import_picocolors3.default.red(`[migrate] ${msg}`), fields)
+  warn: (msg, fields) => console.warn(import_picocolors4.default.yellow(`[migrate] ${msg}`), fields),
+  error: (msg, fields) => console.error(import_picocolors4.default.red(`[migrate] ${msg}`), fields)
 };
 var PG_LOCK_NOT_AVAILABLE = "55P03";
 var LOCK_TIMEOUT = process.env.ABLO_SCHEMA_LOCK_TIMEOUT ?? process.env.ABLO_DDL_LOCK_TIMEOUT ?? "5s";
@@ -279595,7 +279771,7 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [])
         if (pg.code === PG_LOCK_NOT_AVAILABLE && attempt < MAX_LOCK_ATTEMPTS) {
           const backoffMs = Math.min(6e4, 10 * 2 ** attempt) + Math.floor(Math.random() * 50);
           log.warn("schema change blocked by a lock; backing off and retrying", { targetSchema, attempt, backoffMs });
-          await new Promise((resolve5) => setTimeout(resolve5, backoffMs));
+          await new Promise((resolve6) => setTimeout(resolve6, backoffMs));
           continue;
         }
         throw err;
@@ -279626,7 +279802,7 @@ async function migrate(argv) {
   try {
     args = parseMigrateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors3.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors4.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
@@ -279637,11 +279813,11 @@ async function migrate(argv) {
   ].join("\n");
   const totalStatements = plan.statements.length + plan.concurrent.length;
   console.log(
-    `  ${import_picocolors3.default.dim("Schema")} ${import_picocolors3.default.bold(args.schemaPath)} \u2192 ${import_picocolors3.default.dim(`${Object.keys(schema.models).length} models, ${totalStatements} statements`)}`
+    `  ${import_picocolors4.default.dim("Schema")} ${import_picocolors4.default.bold(args.schemaPath)} \u2192 ${import_picocolors4.default.dim(`${Object.keys(schema.models).length} models, ${totalStatements} statements`)}`
   );
   if (args.outputFile) {
-    (0, import_fs4.writeFileSync)(args.outputFile, sql + "\n");
-    console.log(`  ${import_picocolors3.default.green("\u2713")} SQL written to ${import_picocolors3.default.bold(args.outputFile)}`);
+    (0, import_fs5.writeFileSync)(args.outputFile, sql + "\n");
+    console.log(`  ${import_picocolors4.default.green("\u2713")} SQL written to ${import_picocolors4.default.bold(args.outputFile)}`);
     return;
   }
   if (args.dryRun) {
@@ -279650,12 +279826,13 @@ async function migrate(argv) {
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
-    console.error(import_picocolors3.default.red("  Set DATABASE_URL (or ABLO_DATABASE_URL) to apply, or use --dry-run to preview."));
+    console.error(import_picocolors4.default.red("  Set DATABASE_URL (or ABLO_DATABASE_URL) to apply, or use --dry-run to preview."));
     process.exit(1);
   }
+  const effectiveUrl = await ensureScopedRoleInteractive(dbUrl);
   try {
-    await applyStatements(dbUrl, args.targetSchema, plan.statements, plan.concurrent);
-    console.log(`  ${import_picocolors3.default.green("\u2713")} Migration complete`);
+    await applyStatements(effectiveUrl, args.targetSchema, plan.statements, plan.concurrent);
+    console.log(`  ${import_picocolors4.default.green("\u2713")} Migration complete`);
   } catch {
     process.exit(1);
   }
@@ -279663,9 +279840,9 @@ async function migrate(argv) {
 
 // src/cli/generate.ts
 init_cjs_shims();
-var import_fs5 = require("fs");
-var import_path3 = require("path");
-var import_picocolors4 = __toESM(require_picocolors(), 1);
+var import_fs6 = require("fs");
+var import_path4 = require("path");
+var import_picocolors5 = __toESM(require_picocolors(), 1);
 var import_schema3 = require("@abloatai/ablo/schema");
 var DEFAULT_SCHEMA_PATH3 = "ablo/schema.ts";
 var DEFAULT_EXPORT3 = "schema";
@@ -279697,7 +279874,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors4.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -279706,20 +279883,20 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema3.serializeSchema)(schema));
     source = (0, import_schema3.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors4.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  const abs = (0, import_path3.resolve)(process.cwd(), args.out);
-  (0, import_fs5.mkdirSync)((0, import_path3.dirname)(abs), { recursive: true });
-  (0, import_fs5.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors4.default.green("\u2713")} Generated types \u2192 ${import_picocolors4.default.bold(args.out)}`);
+  const abs = (0, import_path4.resolve)(process.cwd(), args.out);
+  (0, import_fs6.mkdirSync)((0, import_path4.dirname)(abs), { recursive: true });
+  (0, import_fs6.writeFileSync)(abs, source);
+  console.log(`  ${import_picocolors5.default.green("\u2713")} Generated types \u2192 ${import_picocolors5.default.bold(args.out)}`);
 }
 
 // src/cli/dev.ts
 init_cjs_shims();
-var import_picocolors5 = __toESM(require_picocolors(), 1);
-var import_fs6 = require("fs");
-var import_path4 = require("path");
+var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_fs7 = require("fs");
+var import_path5 = require("path");
 var import_schema4 = require("@abloatai/ablo/schema");
 
 // src/cli/theme.ts
@@ -279740,7 +279917,7 @@ function parseDevArgs(argv) {
   let schemaPath = DEFAULT_SCHEMA_PATH;
   let exportName = DEFAULT_EXPORT;
   let url = process.env.ABLO_API_URL ?? DEFAULT_URL;
-  let watchEnabled = true;
+  let watchEnabled = false;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     switch (arg) {
@@ -279753,6 +279930,9 @@ function parseDevArgs(argv) {
       case "--url":
         url = argv[++i] ?? url;
         break;
+      case "--watch":
+        watchEnabled = true;
+        break;
       case "--no-watch":
         watchEnabled = false;
         break;
@@ -279767,58 +279947,58 @@ function classifyKey(apiKey) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors5.default.bold("ablo login")} (or set ${import_picocolors5.default.bold("ABLO_API_KEY")}) with a ${import_picocolors5.default.bold("sk_test_")} key from ${import_picocolors5.default.cyan("https://abloatai.com")}.`
+      reason: `No API key. Run ${import_picocolors6.default.bold("ablo login")} (or set ${import_picocolors6.default.bold("ABLO_API_KEY")}) with a ${import_picocolors6.default.bold("sk_test_")} key from ${import_picocolors6.default.cyan("https://abloatai.com")}.`
     };
   }
   if (apiKey.startsWith("sk_test_")) return { ok: true };
   if (apiKey.startsWith("sk_live_")) {
     return {
       ok: false,
-      reason: `${import_picocolors5.default.bold("ablo dev")} refuses production keys. Use a ${import_picocolors5.default.bold("sk_test_")} key so the watch loop can't churn production data.`
+      reason: `${import_picocolors6.default.bold("ablo dev")} refuses production keys. Use a ${import_picocolors6.default.bold("sk_test_")} key so the watch loop can't churn production data.`
     };
   }
   if (apiKey.startsWith("rk_")) {
     return {
       ok: false,
-      reason: `Restricted (${import_picocolors5.default.bold("rk_")}) keys can't push schema. Use a secret ${import_picocolors5.default.bold("sk_test_")} key.`
+      reason: `Restricted (${import_picocolors6.default.bold("rk_")}) keys can't push schema. Use a secret ${import_picocolors6.default.bold("sk_test_")} key.`
     };
   }
-  return { ok: false, reason: `${import_picocolors5.default.bold("ABLO_API_KEY")} is not an Ablo key (expected ${import_picocolors5.default.bold("sk_test_\u2026")}).` };
+  return { ok: false, reason: `${import_picocolors6.default.bold("ABLO_API_KEY")} is not an Ablo key (expected ${import_picocolors6.default.bold("sk_test_\u2026")}).` };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
-  const envPath = (0, import_path4.resolve)(cwd, ".env.local");
+  const envPath = (0, import_path5.resolve)(cwd, ".env.local");
   const line = `ABLO_API_KEY=${apiKey}`;
   let action;
-  if (!(0, import_fs6.existsSync)(envPath)) {
-    (0, import_fs6.writeFileSync)(envPath, `${line}
+  if (!(0, import_fs7.existsSync)(envPath)) {
+    (0, import_fs7.writeFileSync)(envPath, `${line}
 `, { mode: 384 });
-    action = `Created ${import_picocolors5.default.bold(".env.local")} with ${import_picocolors5.default.bold("ABLO_API_KEY")}`;
+    action = `Created ${import_picocolors6.default.bold(".env.local")} with ${import_picocolors6.default.bold("ABLO_API_KEY")}`;
   } else {
-    const content = (0, import_fs6.readFileSync)(envPath, "utf8");
+    const content = (0, import_fs7.readFileSync)(envPath, "utf8");
     const match = content.match(/^ABLO_API_KEY=(.*)$/m);
     if (!match) {
-      (0, import_fs6.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
+      (0, import_fs7.appendFileSync)(envPath, `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${line}
 `);
-      action = `Added ${import_picocolors5.default.bold("ABLO_API_KEY")} to ${import_picocolors5.default.bold(".env.local")}`;
+      action = `Added ${import_picocolors6.default.bold("ABLO_API_KEY")} to ${import_picocolors6.default.bold(".env.local")}`;
     } else if (match[1] === apiKey) {
-      action = `${import_picocolors5.default.bold(".env.local")} already has this key`;
+      action = `${import_picocolors6.default.bold(".env.local")} already has this key`;
     } else {
-      (0, import_fs6.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
-      action = `Updated ${import_picocolors5.default.bold("ABLO_API_KEY")} in ${import_picocolors5.default.bold(".env.local")} ${import_picocolors5.default.dim(`(was ${match[1].slice(0, 12)}\u2026)`)}`;
+      (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
+      action = `Updated ${import_picocolors6.default.bold("ABLO_API_KEY")} in ${import_picocolors6.default.bold(".env.local")} ${import_picocolors6.default.dim(`(was ${match[1].slice(0, 12)}\u2026)`)}`;
     }
   }
-  const gitignorePath = (0, import_path4.resolve)(cwd, ".gitignore");
-  const gitignore = (0, import_fs6.existsSync)(gitignorePath) ? (0, import_fs6.readFileSync)(gitignorePath, "utf8") : "";
+  const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
+  const gitignore = (0, import_fs7.existsSync)(gitignorePath) ? (0, import_fs7.readFileSync)(gitignorePath, "utf8") : "";
   const ignored = /^(\.env\.local|\.env\*|\.env\.\*|\.env.*)$/m.test(gitignore);
   let gitignoreNote = "";
   if (!ignored) {
-    (0, import_fs6.writeFileSync)(
+    (0, import_fs7.writeFileSync)(
       gitignorePath,
       `${gitignore.endsWith("\n") || gitignore.length === 0 ? gitignore : `${gitignore}
 `}.env.local
 `
     );
-    gitignoreNote = ` Added ${import_picocolors5.default.bold(".env.local")} to ${import_picocolors5.default.bold(".gitignore")} so the key can't be committed.`;
+    gitignoreNote = ` Added ${import_picocolors6.default.bold(".env.local")} to ${import_picocolors6.default.bold(".gitignore")} so the key can't be committed.`;
   }
   return `${action}.${gitignoreNote}`;
 }
@@ -279833,7 +280013,7 @@ async function runPush(schema, args) {
   if (ok) {
     return {
       ok: true,
-      message: body.unchanged ? `schema unchanged ${import_picocolors5.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors5.default.dim(`(v${body.version}, hash ${body.hash})`)}`
+      message: body.unchanged ? `schema unchanged ${import_picocolors6.default.dim(`(v${body.version})`)}` : `schema pushed (sandbox) ${import_picocolors6.default.dim(`(v${body.version}, hash ${body.hash})`)}`
     };
   }
   if (status2 === 409) {
@@ -279841,47 +280021,49 @@ async function runPush(schema, args) {
     const warnings = Array.isArray(body.warnings) ? body.warnings : [];
     const lines = [
       "Incompatible schema change \u2014 not safe to apply as-is.",
-      ...unexecutable.map((u2) => import_picocolors5.default.red(fmtSignal(u2))),
-      ...warnings.map((w2) => import_picocolors5.default.yellow(fmtSignal(w2))),
-      import_picocolors5.default.dim(`Run ${import_picocolors5.default.bold("ablo push --force")} (or ${import_picocolors5.default.bold("--rename old:new")}) to resolve.`)
+      ...unexecutable.map((u2) => import_picocolors6.default.red(fmtSignal(u2))),
+      ...warnings.map((w2) => import_picocolors6.default.yellow(fmtSignal(w2))),
+      import_picocolors6.default.dim(`Run ${import_picocolors6.default.bold("ablo push --force")} (or ${import_picocolors6.default.bold("--rename old:new")}) to resolve.`)
     ];
     return { ok: false, message: lines.join("\n") };
   }
   if (status2 === 403) {
+    const serverSays = body.message ?? body.reason;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors6.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors6.default.bold("sandbox")} key with ${import_picocolors6.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors6.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
-      message: `This key can't author schema (${body.reason ?? "missing schema:push scope"}).
-` + import_picocolors5.default.dim(
-        `Use a ${import_picocolors5.default.bold("sandbox")} key, or one with ${import_picocolors5.default.bold("schema authoring")} enabled at ${import_picocolors5.default.cyan("https://abloatai.com")}.`
-      )
+      message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
+` + import_picocolors6.default.dim(hint)
     };
   }
-  return { ok: false, message: `Push failed (${status2}): ${body.reason ?? bodyText}` };
+  return { ok: false, message: `Push failed (${status2}): ${body.message ?? body.reason ?? bodyText}` };
 }
 async function dev(argv) {
   let args;
   try {
     args = parseDevArgs(argv);
   } catch (err) {
-    console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors6.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.apiKey) args.apiKey = resolveApiKey("sandbox");
   const key = classifyKey(args.apiKey);
   if (!key.ok) {
-    console.error(import_picocolors5.default.red(`  ${key.reason}`));
+    console.error(import_picocolors6.default.red(`  ${key.reason}`));
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("sync engine \u2014 dev")} ${import_picocolors5.default.dim("(sandbox)")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("sync engine \u2014 dev")} ${import_picocolors6.default.dim("(sandbox)")}
 `);
+  const projectDbUrl = readProjectDatabaseUrl();
+  if (projectDbUrl) await ensureScopedRoleInteractive(projectDbUrl);
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors5.default.dim("schema")}  ${import_picocolors5.default.bold(args.schemaPath)} ${import_picocolors5.default.dim(`(${modelCount} models, hash ${(0, import_schema4.schemaHash)(schema)})`)}`
+    `  ${import_picocolors6.default.dim("schema")}  ${import_picocolors6.default.bold(args.schemaPath)} ${import_picocolors6.default.dim(`(${modelCount} models, hash ${(0, import_schema4.schemaHash)(schema)})`)}`
   );
-  console.log(`  ${import_picocolors5.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
-  console.log(`  ${import_picocolors5.default.dim("api")}     ${args.url}
+  console.log(`  ${import_picocolors6.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
+  console.log(`  ${import_picocolors6.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
   s.start("Pushing schema definition (sandbox)");
@@ -279890,20 +280072,20 @@ async function dev(argv) {
   if (!first.ok) process.exit(1);
   if (process.env.ABLO_API_KEY) {
     console.log(`
-  ${import_picocolors5.default.green("\u2713")} ${import_picocolors5.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
+  ${import_picocolors6.default.green("\u2713")} ${import_picocolors6.default.bold("ABLO_API_KEY")} is set in this shell \u2014 the SDK reads it directly.`);
   } else {
     console.log(`
-  ${import_picocolors5.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
-    console.log(`  ${import_picocolors5.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
+  ${import_picocolors6.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
+    console.log(`  ${import_picocolors6.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
   console.log(`  Your app is wired for the sandbox.`);
   if (!args.watch) return;
-  const abs = (0, import_path4.resolve)(process.cwd(), args.schemaPath);
-  console.log(`  ${import_picocolors5.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
+  const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
+  console.log(`  ${import_picocolors6.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
 `);
   let timer2 = null;
   let pushing = false;
-  const watcher = (0, import_fs6.watch)(abs, () => {
+  const watcher = (0, import_fs7.watch)(abs, () => {
     if (timer2) clearTimeout(timer2);
     timer2 = setTimeout(() => {
       void rePush();
@@ -279919,7 +280101,7 @@ async function dev(argv) {
       const r2 = await runPush(next, args);
       s2.stop(r2.message, r2.ok ? 0 : 1);
     } catch (err) {
-      s2.stop(import_picocolors5.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
+      s2.stop(import_picocolors6.default.red(`schema reload failed: ${err instanceof Error ? err.message : String(err)}`), 1);
     } finally {
       pushing = false;
     }
@@ -279927,7 +280109,7 @@ async function dev(argv) {
   const stop = () => {
     watcher.close();
     console.log(`
-  ${import_picocolors5.default.dim("stopped.")}`);
+  ${import_picocolors6.default.dim("stopped.")}`);
     process.exit(0);
   };
   process.on("SIGINT", stop);
@@ -279939,7 +280121,7 @@ async function dev(argv) {
 // src/cli/login.ts
 init_cjs_shims();
 var import_child_process = require("child_process");
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 var CLIENT_ID = "ablo-cli";
 var AUTH_URL = (process.env.ABLO_AUTH_URL ?? "https://www.abloatai.com").replace(/\/+$/, "");
 var sleep = (ms) => new Promise((r2) => setTimeout(r2, ms));
@@ -279955,16 +280137,21 @@ function openBrowser(url) {
 }
 async function deviceLogin() {
   Ie(`${brand("ablo")} login`);
-  const account = await ve({
-    message: "Ablo account",
-    options: [
-      { value: "login", label: "Log in to an existing account" },
-      { value: "signup", label: "Create a new account" }
-    ]
-  });
-  if (pD(account)) {
-    xe("Cancelled.");
-    process.exit(0);
+  const interactive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
+  let account = "login";
+  if (interactive) {
+    const choice = await ve({
+      message: "Ablo account",
+      options: [
+        { value: "login", label: "Log in to an existing account" },
+        { value: "signup", label: "Create a new account" }
+      ]
+    });
+    if (pD(choice)) {
+      xe("Cancelled.");
+      process.exit(0);
+    }
+    account = choice;
   }
   const codeRes = await fetch(`${AUTH_URL}/api/auth/device/code`, {
     method: "POST",
@@ -279978,9 +280165,9 @@ async function deviceLogin() {
   const code = await codeRes.json();
   const approvePath = `/cli?user_code=${code.user_code}`;
   const url = account === "signup" ? `${AUTH_URL}/signup?next=${encodeURIComponent(approvePath)}` : code.verification_uri_complete ?? code.verification_uri;
-  Me(`${import_picocolors6.default.bold(code.user_code)}
+  Me(`${import_picocolors7.default.bold(code.user_code)}
 
-${import_picocolors6.default.dim(url)}`, "Approve in your browser");
+${import_picocolors7.default.dim(url)}`, "Approve in your browser");
   openBrowser(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -280038,7 +280225,7 @@ ${import_picocolors6.default.dim(url)}`, "Approve in your browser");
     if (reason) M2.error(reason);
     else if (provRes) M2.error(`Key provisioning returned ${provRes.status} from ${AUTH_URL}/api/cli/provision-key.`);
     M2.error(
-      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors6.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors6.default.bold("ABLO_API_KEY")}.`
+      `The browser approval succeeded but the key handoff failed. Try again, or grab a ${import_picocolors7.default.bold("sk_test_")} key from the dashboard and set ${import_picocolors7.default.bold("ABLO_API_KEY")}.`
     );
     process.exit(1);
   }
@@ -280054,7 +280241,7 @@ ${import_picocolors6.default.dim(url)}`, "Approve in your browser");
     ...prov.live ? { production: entry(prov.live) } : {}
   });
   s.stop(`Saved keys to ${path}`);
-  Se(`${import_picocolors6.default.green("\u2713")} Logged in ${import_picocolors6.default.dim("(sandbox)")}. Run ${import_picocolors6.default.bold("ablo dev")}, or ${import_picocolors6.default.bold("ablo mode production")} to switch.`);
+  Se(`${import_picocolors7.default.green("\u2713")} Logged in ${import_picocolors7.default.dim("(sandbox)")}. Run ${import_picocolors7.default.bold("ablo dev")}, or ${import_picocolors7.default.bold("ablo mode production")} to switch.`);
 }
 async function login() {
   await deviceLogin();
@@ -280062,20 +280249,20 @@ async function login() {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors6.default.green("\u2713")} Logged out ${import_picocolors6.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors7.default.green("\u2713")} Logged out ${import_picocolors7.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors6.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors7.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_API_KEY) {
     console.log(
-      import_picocolors6.default.dim(`  Note: ${import_picocolors6.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
+      import_picocolors7.default.dim(`  Note: ${import_picocolors7.default.bold("ABLO_API_KEY")} is still set in this shell and takes precedence.`)
     );
   }
 }
 
 // src/cli/mode.ts
 init_cjs_shims();
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 var PREFIX = { sandbox: "sk_test_", production: "rk_live_" };
 function hintFor(m2, current) {
   const parts = [];
@@ -280085,10 +280272,10 @@ function hintFor(m2, current) {
 }
 function apply(m2) {
   setMode(m2);
-  console.log(`  ${import_picocolors7.default.green("\u2713")} now in ${import_picocolors7.default.bold(m2)}`);
+  console.log(`  ${import_picocolors8.default.green("\u2713")} now in ${import_picocolors8.default.bold(m2)}`);
   if (!getKeyEntry(m2)) {
     console.log(
-      import_picocolors7.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors7.default.bold("ablo login")} or ${import_picocolors7.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
+      import_picocolors8.default.dim(`  No ${m2} key stored \u2014 run ${import_picocolors8.default.bold("ablo login")} or ${import_picocolors8.default.bold(`ablo login --api-key ${PREFIX[m2]}\u2026`)}.`)
     );
   }
 }
@@ -280101,14 +280288,14 @@ async function mode(argv) {
   }
   if (arg) {
     console.error(
-      import_picocolors7.default.red(`  unknown mode: ${arg}`) + import_picocolors7.default.dim(` (expected ${import_picocolors7.default.bold("sandbox")} or ${import_picocolors7.default.bold("production")})`)
+      import_picocolors8.default.red(`  unknown mode: ${arg}`) + import_picocolors8.default.dim(` (expected ${import_picocolors8.default.bold("sandbox")} or ${import_picocolors8.default.bold("production")})`)
     );
     process.exit(1);
   }
   const current = getMode();
   if (!process.stdin.isTTY || process.env.CI) {
     console.error(
-      import_picocolors7.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors7.default.bold("ablo mode sandbox") + import_picocolors7.default.dim(" | ") + import_picocolors7.default.bold("ablo mode production") + import_picocolors7.default.dim(`  (current: ${current})`)
+      import_picocolors8.default.red("  `ablo mode` needs an argument without a TTY: ") + import_picocolors8.default.bold("ablo mode sandbox") + import_picocolors8.default.dim(" | ") + import_picocolors8.default.bold("ablo mode production") + import_picocolors8.default.dim(`  (current: ${current})`)
     );
     process.exit(1);
   }
@@ -280129,13 +280316,13 @@ async function mode(argv) {
 
 // src/cli/status.ts
 init_cjs_shims();
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
   if (Number.isNaN(ms)) return "";
-  if (ms <= 0) return import_picocolors8.default.red("expired");
+  if (ms <= 0) return import_picocolors9.default.red("expired");
   const days = Math.floor(ms / (24 * 60 * 60 * 1e3));
-  return import_picocolors8.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
+  return import_picocolors9.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
 }
 async function ping(apiUrl) {
   const ctrl = new AbortController();
@@ -280154,36 +280341,36 @@ async function status() {
   const cfg = readConfig();
   const mode2 = getMode();
   console.log(`
-  ${brand("ablo")} ${import_picocolors8.default.dim("status")}
+  ${brand("ablo")} ${import_picocolors9.default.dim("status")}
 `);
   if (process.env.ABLO_API_KEY) {
     console.log(
-      `  ${import_picocolors8.default.dim("key")}     ${process.env.ABLO_API_KEY.slice(0, 12)}\u2026 ${import_picocolors8.default.dim("(ABLO_API_KEY env \u2014 overrides stored)")}`
+      `  ${import_picocolors9.default.dim("key")}     ${process.env.ABLO_API_KEY.slice(0, 12)}\u2026 ${import_picocolors9.default.dim("(ABLO_API_KEY env \u2014 overrides stored)")}`
     );
   } else if (!cfg) {
-    console.log(`  ${import_picocolors8.default.yellow("!")} Not logged in \u2014 run ${import_picocolors8.default.bold("ablo login")}.`);
+    console.log(`  ${import_picocolors9.default.yellow("!")} Not logged in \u2014 run ${import_picocolors9.default.bold("ablo login")}.`);
   }
-  console.log(`  ${import_picocolors8.default.dim("mode")}    ${import_picocolors8.default.bold(mode2)}`);
+  console.log(`  ${import_picocolors9.default.dim("mode")}    ${import_picocolors9.default.bold(mode2)}`);
   for (const m2 of ["sandbox", "production"]) {
     const entry = getKeyEntry(m2);
-    const marker = m2 === mode2 ? import_picocolors8.default.green("\u25CF") : import_picocolors8.default.dim("\u25CB");
+    const marker = m2 === mode2 ? import_picocolors9.default.green("\u25CF") : import_picocolors9.default.dim("\u25CB");
     if (entry) {
       const exp = entry.expiresAt ? ` ${expiryLabel(entry.expiresAt)}` : "";
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors8.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors9.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${exp}`);
     } else {
-      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors8.default.dim("\u2014 no key")}`);
+      console.log(`  ${marker} ${m2.padEnd(10)}  ${import_picocolors9.default.dim("\u2014 no key")}`);
     }
   }
   const org = getKeyEntry(mode2)?.organizationId;
-  if (org) console.log(`  ${import_picocolors8.default.dim("org")}     ${org}`);
-  process.stdout.write(`  ${import_picocolors8.default.dim("api")}     ${apiUrl}  `);
-  console.log(await ping(apiUrl) ? import_picocolors8.default.green("reachable") : import_picocolors8.default.red("unreachable"));
+  if (org) console.log(`  ${import_picocolors9.default.dim("org")}     ${org}`);
+  process.stdout.write(`  ${import_picocolors9.default.dim("api")}     ${apiUrl}  `);
+  console.log(await ping(apiUrl) ? import_picocolors9.default.green("reachable") : import_picocolors9.default.red("unreachable"));
   console.log();
 }
 
 // src/cli/logs.ts
 init_cjs_shims();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 function parseLogsArgs(argv) {
   const args = {
     follow: true,
@@ -280247,10 +280434,10 @@ function resolveSince(since) {
 var sleep2 = (ms) => new Promise((r2) => setTimeout(r2, ms));
 function colorOp(op) {
   const label = op.padEnd(6);
-  if (op === "create") return import_picocolors9.default.green(label);
-  if (op === "update") return import_picocolors9.default.yellow(label);
-  if (op === "delete") return import_picocolors9.default.red(label);
-  return import_picocolors9.default.dim(label);
+  if (op === "create") return import_picocolors10.default.green(label);
+  if (op === "update") return import_picocolors10.default.yellow(label);
+  if (op === "delete") return import_picocolors10.default.red(label);
+  return import_picocolors10.default.dim(label);
 }
 function render(e2, json) {
   if (json) {
@@ -280259,21 +280446,21 @@ function render(e2, json) {
     return;
   }
   const t = new Date(e2.at).toLocaleTimeString();
-  const actor = e2.actor ? import_picocolors9.default.dim(`  ${e2.actor}`) : "";
-  console.log(`  ${import_picocolors9.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors9.default.bold(e2.model)} ${import_picocolors9.default.dim(e2.recordId)}${actor}`);
+  const actor = e2.actor ? import_picocolors10.default.dim(`  ${e2.actor}`) : "";
+  console.log(`  ${import_picocolors10.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors10.default.bold(e2.model)} ${import_picocolors10.default.dim(e2.recordId)}${actor}`);
 }
 async function logs(argv) {
   let args;
   try {
     args = parseLogsArgs(argv);
   } catch (err) {
-    console.error(import_picocolors9.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors10.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const apiKey = resolveApiKey(args.mode);
   if (!apiKey) {
     console.error(
-      import_picocolors9.default.red(`  No API key.`) + import_picocolors9.default.dim(` Run ${import_picocolors9.default.bold("ablo login")} or set ${import_picocolors9.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors10.default.red(`  No API key.`) + import_picocolors10.default.dim(` Run ${import_picocolors10.default.bold("ablo login")} or set ${import_picocolors10.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
@@ -280287,7 +280474,7 @@ async function logs(argv) {
     if (!res) return null;
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
-      console.error(import_picocolors9.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
+      console.error(import_picocolors10.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
       process.exit(1);
     }
     const json = await res.json();
@@ -280298,7 +280485,7 @@ async function logs(argv) {
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors9.default.dim("logs")} ${import_picocolors9.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors10.default.dim("logs")} ${import_picocolors10.default.dim(`(${args.mode ?? "active"} mode)`)}
 `);
   }
   const initial = await fetchPage({
@@ -280308,13 +280495,13 @@ async function logs(argv) {
     ...args.op ? { op: args.op } : {}
   });
   if (!initial) {
-    console.error(import_picocolors9.default.red(`  Couldn't reach ${baseUrl2}.`));
+    console.error(import_picocolors10.default.red(`  Couldn't reach ${baseUrl2}.`));
     process.exit(1);
   }
   for (const e2 of initial.events) render(e2, args.json);
   let cursor = initial.cursor;
   if (!args.follow) return;
-  if (!args.json) console.log(`  ${import_picocolors9.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
+  if (!args.json) console.log(`  ${import_picocolors10.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
 `);
   for (; ; ) {
     await sleep2(1500);
@@ -280331,8 +280518,8 @@ async function logs(argv) {
 
 // src/cli/webhooks.ts
 init_cjs_shims();
-var import_fs7 = require("fs");
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_fs8 = require("fs");
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 var ENV_KEY = "ABLO_WEBHOOK_SECRET";
 function flag(args, name) {
   const inline = args.find((a) => a.startsWith(`${name}=`));
@@ -280359,12 +280546,12 @@ function requireKey(mode2) {
   const apiKey = resolveApiKey(mode2);
   if (!apiKey) {
     console.error(
-      import_picocolors10.default.red("  No API key.") + import_picocolors10.default.dim(` Run ${import_picocolors10.default.bold("ablo login")} or set ${import_picocolors10.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors11.default.red("  No API key.") + import_picocolors11.default.dim(` Run ${import_picocolors11.default.bold("ablo login")} or set ${import_picocolors11.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
   if (!apiKey.startsWith("sk_")) {
-    console.error(import_picocolors10.default.red("  Managing webhooks requires a secret key ") + import_picocolors10.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors11.default.red("  Managing webhooks requires a secret key ") + import_picocolors11.default.dim("(sk_test_ / sk_live_)."));
     process.exit(1);
   }
   return apiKey;
@@ -280380,22 +280567,22 @@ async function api(apiKey, method, path, body) {
     ...body ? { body: JSON.stringify(body) } : {}
   }).catch(() => null);
   if (!res) {
-    console.error(import_picocolors10.default.red(`  Couldn't reach ${baseUrl()}.`));
+    console.error(import_picocolors11.default.red(`  Couldn't reach ${baseUrl()}.`));
     process.exit(1);
   }
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    console.error(import_picocolors10.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
+    console.error(import_picocolors11.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
     process.exit(1);
   }
   return await res.json();
 }
 function writeSecretToEnv(secret) {
-  const file = (0, import_fs7.existsSync)(".env.local") ? ".env.local" : (0, import_fs7.existsSync)(".env") ? ".env" : ".env.local";
+  const file = (0, import_fs8.existsSync)(".env.local") ? ".env.local" : (0, import_fs8.existsSync)(".env") ? ".env" : ".env.local";
   const line = `${ENV_KEY}=${secret}`;
   let next;
-  if ((0, import_fs7.existsSync)(file)) {
-    const existing = (0, import_fs7.readFileSync)(file, "utf-8");
+  if ((0, import_fs8.existsSync)(file)) {
+    const existing = (0, import_fs8.readFileSync)(file, "utf-8");
     next = new RegExp(`^${ENV_KEY}=.*$`, "m").test(existing) ? existing.replace(new RegExp(`^${ENV_KEY}=.*$`, "m"), line) : `${existing.replace(/\n*$/, "")}
 ${line}
 `;
@@ -280403,15 +280590,15 @@ ${line}
     next = `${line}
 `;
   }
-  (0, import_fs7.writeFileSync)(file, next);
+  (0, import_fs8.writeFileSync)(file, next);
   return file;
 }
 function printEndpoint(e2) {
-  const dot = e2.status === "enabled" ? import_picocolors10.default.green("\u25CF") : import_picocolors10.default.red("\u25CF");
-  const health = e2.last_error ? import_picocolors10.default.red(` last error: ${e2.last_error}`) : "";
-  console.log(`  ${dot} ${import_picocolors10.default.bold(e2.id)}  ${e2.url}`);
+  const dot = e2.status === "enabled" ? import_picocolors11.default.green("\u25CF") : import_picocolors11.default.red("\u25CF");
+  const health = e2.last_error ? import_picocolors11.default.red(` last error: ${e2.last_error}`) : "";
+  console.log(`  ${dot} ${import_picocolors11.default.bold(e2.id)}  ${e2.url}`);
   console.log(
-    import_picocolors10.default.dim(
+    import_picocolors11.default.dim(
       `      ${e2.status} \xB7 ${e2.environment} \xB7 events ${e2.enabled_events.join(",")} \xB7 cursor ${e2.cursor ?? "\u2014"}${health}`
     )
   );
@@ -280423,7 +280610,7 @@ async function webhooks(argv) {
   if (sub === "create") {
     const url = positional(rest);
     if (!url) {
-      console.error(import_picocolors10.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
+      console.error(import_picocolors11.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
       process.exit(1);
     }
     const apiKey = requireKey(mode2);
@@ -280435,8 +280622,8 @@ async function webhooks(argv) {
     });
     const file = writeSecretToEnv(created.secret);
     console.log(`
-  ${import_picocolors10.default.green("\u2713")} Registered ${import_picocolors10.default.bold(created.id)} \u2192 ${created.url}`);
-    console.log(`  ${import_picocolors10.default.green("\u2713")} Wrote ${import_picocolors10.default.bold(ENV_KEY)} to ${import_picocolors10.default.bold(file)} ${import_picocolors10.default.dim("(shown once)")}
+  ${import_picocolors11.default.green("\u2713")} Registered ${import_picocolors11.default.bold(created.id)} \u2192 ${created.url}`);
+    console.log(`  ${import_picocolors11.default.green("\u2713")} Wrote ${import_picocolors11.default.bold(ENV_KEY)} to ${import_picocolors11.default.bold(file)} ${import_picocolors11.default.dim("(shown once)")}
 `);
     return;
   }
@@ -280444,7 +280631,7 @@ async function webhooks(argv) {
     const apiKey = requireKey(mode2);
     const { data } = await api(apiKey, "GET", "");
     if (data.length === 0) {
-      console.log(import_picocolors10.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
+      console.log(import_picocolors11.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
       return;
     }
     console.log();
@@ -280455,40 +280642,40 @@ async function webhooks(argv) {
   if (sub === "roll") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors10.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
+      console.error(import_picocolors11.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
       process.exit(1);
     }
     const apiKey = requireKey(mode2);
     const rolled = await api(apiKey, "POST", `/${id}/roll_secret`);
     const file = writeSecretToEnv(rolled.secret);
     console.log(`
-  ${import_picocolors10.default.green("\u2713")} Rolled secret for ${import_picocolors10.default.bold(id)} \u2192 ${import_picocolors10.default.bold(file)} ${import_picocolors10.default.dim("(old secret now invalid)")}
+  ${import_picocolors11.default.green("\u2713")} Rolled secret for ${import_picocolors11.default.bold(id)} \u2192 ${import_picocolors11.default.bold(file)} ${import_picocolors11.default.dim("(old secret now invalid)")}
 `);
     return;
   }
   if (sub === "enable") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors10.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
+      console.error(import_picocolors11.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
       process.exit(1);
     }
     const apiKey = requireKey(mode2);
     const e2 = await api(apiKey, "POST", `/${id}/enable`);
-    console.log(`  ${import_picocolors10.default.green("\u2713")} Re-enabled ${import_picocolors10.default.bold(e2.id)}`);
+    console.log(`  ${import_picocolors11.default.green("\u2713")} Re-enabled ${import_picocolors11.default.bold(e2.id)}`);
     return;
   }
   if (sub === "rm" || sub === "delete") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors10.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
+      console.error(import_picocolors11.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
       process.exit(1);
     }
     const apiKey = requireKey(mode2);
     await api(apiKey, "DELETE", `/${id}`);
-    console.log(`  ${import_picocolors10.default.green("\u2713")} Removed ${import_picocolors10.default.bold(id)}`);
+    console.log(`  ${import_picocolors11.default.green("\u2713")} Removed ${import_picocolors11.default.bold(id)}`);
     return;
   }
-  console.log(`  ${import_picocolors10.default.bold("Usage:")}`);
+  console.log(`  ${import_picocolors11.default.bold("Usage:")}`);
   console.log(`    ${brand("ablo webhooks create <url>")}   Register an endpoint; writes ${ENV_KEY}`);
   console.log(`    ${brand("ablo webhooks list")}           List endpoints + delivery health`);
   console.log(`    ${brand("ablo webhooks roll <id>")}       Mint a fresh signing secret`);
@@ -280499,7 +280686,7 @@ async function webhooks(argv) {
 
 // src/cli/check.ts
 init_cjs_shims();
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 var import_schema5 = require("@abloatai/ablo/schema");
 var DEFAULT_SCHEMA_PATH4 = "ablo/schema.ts";
 var DEFAULT_EXPORT4 = "schema";
@@ -280534,13 +280721,13 @@ async function check(argv) {
   try {
     args = parseCheckArgs(argv);
   } catch (err) {
-    console.error(import_picocolors11.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors12.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
     console.error(
-      import_picocolors11.default.red(`  No database.`) + import_picocolors11.default.dim(` Set ${import_picocolors11.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
+      import_picocolors12.default.red(`  No database.`) + import_picocolors12.default.dim(` Set ${import_picocolors12.default.bold("DATABASE_URL")} to the Postgres you want Ablo to adopt.`)
     );
     process.exit(1);
   }
@@ -280555,7 +280742,7 @@ async function check(argv) {
       [args.appSchema]
     );
   } catch (err) {
-    console.error(import_picocolors11.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors12.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -280570,7 +280757,7 @@ async function check(argv) {
     set.add(r2.column_name);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors11.default.dim("check")}  ${import_picocolors11.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors12.default.dim("check")}  ${import_picocolors12.default.dim(`schema "${args.appSchema}"`)}
 `);
   const declaredTables = /* @__PURE__ */ new Set();
   let errors = 0;
@@ -280580,7 +280767,7 @@ async function check(argv) {
     declaredTables.add(table);
     const present = colsByTable.get(table);
     if (!present) {
-      console.log(`  ${import_picocolors11.default.red("\u2717")} ${import_picocolors11.default.bold(key)} ${import_picocolors11.default.dim("\u2192")} table ${import_picocolors11.default.bold(table)} ${import_picocolors11.default.red("not found")}`);
+      console.log(`  ${import_picocolors12.default.red("\u2717")} ${import_picocolors12.default.bold(key)} ${import_picocolors12.default.dim("\u2192")} table ${import_picocolors12.default.bold(table)} ${import_picocolors12.default.red("not found")}`);
       errors++;
       continue;
     }
@@ -280602,26 +280789,26 @@ async function check(argv) {
       if (!present.has(col)) problems.push(`missing column "${col}" (field ${fieldName})`);
     }
     if (problems.length > 0) {
-      console.log(`  ${import_picocolors11.default.red("\u2717")} ${import_picocolors11.default.bold(key)} ${import_picocolors11.default.dim("\u2192")} ${table}`);
-      for (const p2 of problems) console.log(`      ${import_picocolors11.default.red("\u2022")} ${p2}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors11.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors12.default.red("\u2717")} ${import_picocolors12.default.bold(key)} ${import_picocolors12.default.dim("\u2192")} ${table}`);
+      for (const p2 of problems) console.log(`      ${import_picocolors12.default.red("\u2022")} ${p2}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors12.default.yellow("\u2022")} ${w2}`);
       errors++;
     } else if (warns.length > 0) {
-      console.log(`  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(key)} ${import_picocolors11.default.dim("\u2192")} ${table}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors11.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors12.default.yellow("!")} ${import_picocolors12.default.bold(key)} ${import_picocolors12.default.dim("\u2192")} ${table}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors12.default.yellow("\u2022")} ${w2}`);
       warnings++;
     } else {
-      console.log(`  ${import_picocolors11.default.green("\u2713")} ${import_picocolors11.default.bold(key)} ${import_picocolors11.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
+      console.log(`  ${import_picocolors12.default.green("\u2713")} ${import_picocolors12.default.bold(key)} ${import_picocolors12.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
     }
   }
   const modelCount = Object.keys(schemaJson.models).length;
   const ignored = [...colsByTable.keys()].filter((t) => !declaredTables.has(t)).length;
   console.log(
     `
-  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors11.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors11.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors11.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
+  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors12.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors12.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors12.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
   );
   if (ignored > 0) {
-    console.log(`  ${import_picocolors11.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
+    console.log(`  ${import_picocolors12.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
   }
   console.log();
   process.exit(errors > 0 ? 1 : 0);
@@ -280629,7 +280816,7 @@ async function check(argv) {
 
 // src/cli/upgrade.ts
 init_cjs_shims();
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -280707,7 +280894,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors12.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors13.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -280781,39 +280968,39 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors12.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors13.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors12.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors13.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors12.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors12.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors12.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors12.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors13.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors13.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors13.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors13.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors12.default.bold(import_picocolors12.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors13.default.bold(import_picocolors13.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors12.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors12.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors12.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors13.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors13.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors13.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors12.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors13.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors12.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors13.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/cli/pull.ts
 init_cjs_shims();
-var import_picocolors13 = __toESM(require_picocolors(), 1);
-var import_fs8 = require("fs");
+var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_fs9 = require("fs");
 var DEFAULT_OUT2 = "ablo/schema.ts";
 var DEFAULT_IMPORT = "@abloatai/ablo/schema";
 var TENANCY_COLUMN = "organization_id";
@@ -280924,53 +281111,53 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors13.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors14.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (!dbUrl) {
-    console.error(import_picocolors13.default.red(`  No database.`) + import_picocolors13.default.dim(` Set ${import_picocolors13.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
+    console.error(import_picocolors14.default.red(`  No database.`) + import_picocolors14.default.dim(` Set ${import_picocolors14.default.bold("DATABASE_URL")} to the Postgres to pull from.`));
     process.exit(1);
   }
-  if ((0, import_fs8.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs9.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors13.default.red(`  ${args.out} already exists.`) + import_picocolors13.default.dim(` Re-run with ${import_picocolors13.default.bold("--force")} to overwrite.`)
+      import_picocolors14.default.red(`  ${args.out} already exists.`) + import_picocolors14.default.dim(` Re-run with ${import_picocolors14.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors13.default.dim("pull")}  ${import_picocolors13.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors14.default.dim("pull")}  ${import_picocolors14.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors13.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors14.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors13.default.yellow(`  No adoptable tables found`) + import_picocolors13.default.dim(` (a model needs an ${import_picocolors13.default.bold("id")} + ${import_picocolors13.default.bold("organization_id")} column).`)
+      import_picocolors14.default.yellow(`  No adoptable tables found`) + import_picocolors14.default.dim(` (a model needs an ${import_picocolors14.default.bold("id")} + ${import_picocolors14.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
-  (0, import_fs8.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors13.default.green("\u2713")} wrote ${import_picocolors13.default.bold(args.out)} ${import_picocolors13.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors13.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs9.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors14.default.green("\u2713")} wrote ${import_picocolors14.default.bold(args.out)} ${import_picocolors14.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors14.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped > 0) {
-    console.log(`  ${import_picocolors13.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
+    console.log(`  ${import_picocolors14.default.dim(`${result.skipped} table(s) skipped \u2014 no id/organization_id`)}`);
   }
   console.log(
     `
-  ${import_picocolors13.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors13.default.bold("ablo check")}.
+  ${import_picocolors14.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors14.default.bold("ablo check")}.
 `
   );
 }
 
 // src/cli/prisma-pull.ts
 init_cjs_shims();
-var import_picocolors14 = __toESM(require_picocolors(), 1);
-var import_fs9 = require("fs");
+var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_fs10 = require("fs");
 
 // src/cli/schema-ir.ts
 init_cjs_shims();
@@ -281247,57 +281434,57 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors14.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors15.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  if (!(0, import_fs9.existsSync)(args.schema)) {
+  if (!(0, import_fs10.existsSync)(args.schema)) {
     console.error(
-      import_picocolors14.default.red(`  No Prisma schema at ${import_picocolors14.default.bold(args.schema)}.`) + import_picocolors14.default.dim(` Pass a path: ${import_picocolors14.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors15.default.red(`  No Prisma schema at ${import_picocolors15.default.bold(args.schema)}.`) + import_picocolors15.default.dim(` Pass a path: ${import_picocolors15.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
-  if ((0, import_fs9.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors14.default.red(`  ${args.out} already exists.`) + import_picocolors14.default.dim(` Re-run with ${import_picocolors14.default.bold("--force")} to overwrite.`)
+      import_picocolors15.default.red(`  ${args.out} already exists.`) + import_picocolors15.default.dim(` Re-run with ${import_picocolors15.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors14.default.dim("pull prisma")}  ${import_picocolors14.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors15.default.dim("pull prisma")}  ${import_picocolors15.default.dim(args.schema)}
 `);
   let result;
   try {
-    const src = (0, import_fs9.readFileSync)(args.schema, "utf8");
+    const src = (0, import_fs10.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors14.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors15.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors14.default.yellow(`  No adoptable models found`) + import_picocolors14.default.dim(` (a model needs an ${import_picocolors14.default.bold("id")} + ${import_picocolors14.default.bold("organizationId")} / ${import_picocolors14.default.bold("organization_id")}).`)
+      import_picocolors15.default.yellow(`  No adoptable models found`) + import_picocolors15.default.dim(` (a model needs an ${import_picocolors15.default.bold("id")} + ${import_picocolors15.default.bold("organizationId")} / ${import_picocolors15.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
-  (0, import_fs9.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors14.default.green("\u2713")} wrote ${import_picocolors14.default.bold(args.out)} ${import_picocolors14.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors14.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs10.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors15.default.green("\u2713")} wrote ${import_picocolors15.default.bold(args.out)} ${import_picocolors15.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors15.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors14.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors14.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors15.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors15.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors14.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors14.default.bold("ablo check")}.
+  ${import_picocolors15.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors15.default.bold("ablo check")}.
 `
   );
 }
 
 // src/cli/drizzle-pull.ts
 init_cjs_shims();
-var import_picocolors15 = __toESM(require_picocolors(), 1);
-var import_fs10 = require("fs");
-var import_path5 = require("path");
+var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_fs11 = require("fs");
+var import_path6 = require("path");
 var DEFAULT_OUT4 = "ablo/schema.ts";
 var DEFAULT_IMPORT3 = "@abloatai/ablo/schema";
 var BASE_FIELD_NAMES2 = /* @__PURE__ */ new Set(["id", "organizationId", "createdBy", "createdAt", "updatedAt"]);
@@ -281423,7 +281610,7 @@ function parseDrizzlePullArgs(argv) {
 async function loadModule(path) {
   const { createJiti } = await import("jiti");
   const jiti = createJiti(process.cwd());
-  const mod = await jiti.import((0, import_path5.resolve)(path));
+  const mod = await jiti.import((0, import_path6.resolve)(path));
   return mod;
 }
 async function drizzlePull(argv) {
@@ -281431,27 +281618,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors15.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors15.default.red(`  No Drizzle schema given.`) + import_picocolors15.default.dim(` Pass the module: ${import_picocolors15.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors16.default.red(`  No Drizzle schema given.`) + import_picocolors16.default.dim(` Pass the module: ${import_picocolors16.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
-  if (!(0, import_fs10.existsSync)(args.schema)) {
-    console.error(import_picocolors15.default.red(`  No file at ${import_picocolors15.default.bold(args.schema)}.`));
+  if (!(0, import_fs11.existsSync)(args.schema)) {
+    console.error(import_picocolors16.default.red(`  No file at ${import_picocolors16.default.bold(args.schema)}.`));
     process.exit(1);
   }
-  if ((0, import_fs10.existsSync)(args.out) && !args.force) {
+  if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors15.default.red(`  ${args.out} already exists.`) + import_picocolors15.default.dim(` Re-run with ${import_picocolors15.default.bold("--force")} to overwrite.`)
+      import_picocolors16.default.red(`  ${args.out} already exists.`) + import_picocolors16.default.dim(` Re-run with ${import_picocolors16.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors15.default.dim("pull drizzle")}  ${import_picocolors15.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors16.default.dim("pull drizzle")}  ${import_picocolors16.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -281459,33 +281646,33 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = /Cannot find package 'drizzle-orm'/.test(msg) ? import_picocolors15.default.dim(` (install ${import_picocolors15.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors15.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = /Cannot find package 'drizzle-orm'/.test(msg) ? import_picocolors16.default.dim(` (install ${import_picocolors16.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors16.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors15.default.yellow(`  No adoptable tables found`) + import_picocolors15.default.dim(` (a table needs an ${import_picocolors15.default.bold("id")} + ${import_picocolors15.default.bold("organization_id")} column).`)
+      import_picocolors16.default.yellow(`  No adoptable tables found`) + import_picocolors16.default.dim(` (a table needs an ${import_picocolors16.default.bold("id")} + ${import_picocolors16.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
-  (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors15.default.green("\u2713")} wrote ${import_picocolors15.default.bold(args.out)} ${import_picocolors15.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors15.default.dim(`models: ${result.models.join(", ")}`)}`);
+  (0, import_fs11.writeFileSync)(args.out, result.source);
+  console.log(`  ${import_picocolors16.default.green("\u2713")} wrote ${import_picocolors16.default.bold(args.out)} ${import_picocolors16.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors16.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors15.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors15.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors16.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors16.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors15.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors15.default.bold("ablo check")}.
+  ${import_picocolors16.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors16.default.bold("ablo check")}.
 `
   );
 }
 
 // src/cli/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors16.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors17.default.dim("sync engine")}
 `;
 async function main() {
   const command = process.argv[2];
@@ -281504,7 +281691,8 @@ async function main() {
   } else if (command === "webhooks") {
     await webhooks(process.argv.slice(3));
   } else if (command === "dev") {
-    await dev(process.argv.slice(3));
+    console.log(import_picocolors17.default.dim("  `ablo dev` is now `ablo push --watch` \u2014 running that."));
+    await dev([...process.argv.slice(3), "--watch"]);
   } else if (command === "check") {
     await check(process.argv.slice(3));
   } else if (command === "pull") {
@@ -281519,20 +281707,27 @@ async function main() {
   } else if (command === "migrate") {
     await migrate(process.argv.slice(3));
   } else if (command === "push") {
-    await push(process.argv.slice(3));
+    const rest = process.argv.slice(3);
+    const advanced = rest.some((a) => ["--force", "--rename", "--backfill", "--url"].includes(a));
+    const liveKey = (process.env.ABLO_API_KEY ?? "").startsWith("sk_live_");
+    if (advanced || liveKey) {
+      await push(rest);
+    } else {
+      await dev(rest);
+    }
   } else if (command === "upgrade") {
     await upgrade(process.argv.slice(3));
   } else if (command === "generate") {
     await generate(process.argv.slice(3));
   } else if (command === "schema") {
     console.error(
-      `  ${import_picocolors16.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
+      `  ${import_picocolors17.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`
     );
     console.error(`    Run \`ablo push${process.argv.slice(4).join(" ") ? " " + process.argv.slice(4).join(" ") : ""}\` instead.`);
     process.exitCode = 1;
   } else {
     console.log(LOGO);
-    console.log(`  ${import_picocolors16.default.bold("Usage:")}`);
+    console.log(`  ${import_picocolors17.default.bold("Usage:")}`);
     console.log(`    npx ablo init                          Scaffold ablo/ directory + starter schema`);
     console.log(`    npx ablo init --yes [--framework nextjs] Non-interactive (agents/CI): no prompts, flag-driven`);
     console.log(`                  [--auth apikey] [--storage direct|endpoint] [--no-agent] [--no-pull] [--no-install] [--no-login]`);
@@ -281557,10 +281752,10 @@ async function main() {
     console.log(`    npx ablo generate                      Emit TypeScript types from your schema`);
     console.log(`    npx ablo generate --out path.ts        Write generated types to a path`);
     console.log();
-    console.log(`  ${import_picocolors16.default.bold("Schema workflow:")}`);
+    console.log(`  ${import_picocolors17.default.bold("Schema workflow:")}`);
     console.log(`    The server holds its own copy of your schema \u2014 edit ${brand("ablo/schema.ts")}, then`);
     console.log(`    run ${brand("ablo push")} (or keep ${brand("ablo dev")} running) before the server will accept`);
-    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors16.default.yellow("server_execute_unknown_model")}.`);
+    console.log(`    writes to new or changed models. Skip it and writes fail with ${import_picocolors17.default.yellow("server_execute_unknown_model")}.`);
     console.log();
   }
 }
@@ -281597,7 +281792,7 @@ function parseInitArgs(args) {
 function detectOrm(override) {
   if (override === "prisma" || override === "drizzle" || override === "none") return override;
   try {
-    const pkg = JSON.parse((0, import_fs11.readFileSync)("package.json", "utf-8"));
+    const pkg = JSON.parse((0, import_fs12.readFileSync)("package.json", "utf-8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (deps["@prisma/client"] || deps["prisma"]) return "prisma";
     if (deps["drizzle-orm"]) return "drizzle";
@@ -281628,8 +281823,8 @@ async function chooseBool(flagValue, fallback, interactive, prompt) {
 async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors16.default.dim("sync engine")}`);
-  if (!(0, import_fs11.existsSync)("package.json")) {
+  Ie(`${brand("ablo")} ${import_picocolors17.default.dim("sync engine")}`);
+  if (!(0, import_fs12.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
   }
@@ -281705,14 +281900,14 @@ async function init(args = []) {
     );
   }
   const abloDir = "ablo";
-  (0, import_fs11.mkdirSync)(abloDir, { recursive: true });
+  (0, import_fs12.mkdirSync)(abloDir, { recursive: true });
   const created = [];
   let schemaSource = generateSchema();
   let schemaNote = "";
   if (pullExisting) {
     const dbUrl = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
     if (!dbUrl) {
-      schemaNote = import_picocolors16.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
+      schemaNote = import_picocolors17.default.dim(" (no DATABASE_URL \u2014 wrote starter; run `ablo pull` later)");
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -281722,60 +281917,60 @@ async function init(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors16.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors17.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors16.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors17.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors16.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors17.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
-  (0, import_fs11.writeFileSync)((0, import_path6.join)(abloDir, "schema.ts"), schemaSource);
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "schema.ts"), schemaSource);
   created.push(`${abloDir}/schema.ts${schemaNote}`);
-  (0, import_fs11.writeFileSync)((0, import_path6.join)(abloDir, "index.ts"), generateSyncConfig(auth, storage));
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth, storage));
   created.push(`${abloDir}/index.ts`);
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
-    (0, import_fs11.writeFileSync)((0, import_path6.join)(abloDir, "data-source.ts"), generateDataSource(orm));
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "data-source.ts"), generateDataSource(orm));
     created.push(`${abloDir}/data-source.ts${orm === "drizzle" ? " (Drizzle)" : " (Prisma)"}`);
   }
   const envFile = framework === "nextjs" ? ".env.local" : ".env";
-  if (!(0, import_fs11.existsSync)(envFile)) {
-    (0, import_fs11.writeFileSync)(envFile, generateEnv(storage));
+  if (!(0, import_fs12.existsSync)(envFile)) {
+    (0, import_fs12.writeFileSync)(envFile, generateEnv(storage));
     created.push(envFile);
   } else {
-    const existing = (0, import_fs11.readFileSync)(envFile, "utf-8");
+    const existing = (0, import_fs12.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
-      (0, import_fs11.writeFileSync)(envFile, existing + "\n" + generateEnv(storage));
-      created.push(`${envFile} ${import_picocolors16.default.dim("(appended)")}`);
+      (0, import_fs12.writeFileSync)(envFile, existing + "\n" + generateEnv(storage));
+      created.push(`${envFile} ${import_picocolors17.default.dim("(appended)")}`);
     } else {
-      created.push(`${envFile} ${import_picocolors16.default.dim("(already configured)")}`);
+      created.push(`${envFile} ${import_picocolors17.default.dim("(already configured)")}`);
     }
   }
   if (agent) {
-    (0, import_fs11.writeFileSync)((0, import_path6.join)(abloDir, "agent.ts"), generateAgent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "agent.ts"), generateAgent());
     created.push(`${abloDir}/agent.ts`);
   }
   if (framework === "nextjs") {
     if (storage === "endpoint") {
-      const webhookDir = (0, import_path6.join)("app", "api", "ablo", "webhooks");
-      (0, import_fs11.mkdirSync)(webhookDir, { recursive: true });
-      (0, import_fs11.writeFileSync)((0, import_path6.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
+      const webhookDir = (0, import_path7.join)("app", "api", "ablo", "webhooks");
+      (0, import_fs12.mkdirSync)(webhookDir, { recursive: true });
+      (0, import_fs12.writeFileSync)((0, import_path7.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
       created.push(`${webhookDir}/route.ts${orm === "prisma" ? " (Prisma mirror)" : " (add your database write)"}`);
     }
-    (0, import_fs11.writeFileSync)((0, import_path6.join)("app", "providers.tsx"), generateProviders());
-    created.push(`app/providers.tsx ${import_picocolors16.default.dim("(wrap app/layout.tsx in <Providers>)")}`);
-    const sessionDir = (0, import_path6.join)("app", "api", "ablo-session");
-    (0, import_fs11.mkdirSync)(sessionDir, { recursive: true });
-    (0, import_fs11.writeFileSync)((0, import_path6.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`app/api/ablo-session/route.ts ${import_picocolors16.default.dim("(wire your auth)")}`);
+    (0, import_fs12.writeFileSync)((0, import_path7.join)("app", "providers.tsx"), generateProviders());
+    created.push(`app/providers.tsx ${import_picocolors17.default.dim("(wrap app/layout.tsx in <Providers>)")}`);
+    const sessionDir = (0, import_path7.join)("app", "api", "ablo-session");
+    (0, import_fs12.mkdirSync)(sessionDir, { recursive: true });
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(sessionDir, "route.ts"), generateSessionRoute());
+    created.push(`app/api/ablo-session/route.ts ${import_picocolors17.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
-    (0, import_fs11.writeFileSync)((0, import_path6.join)(abloDir, "TaskList.tsx"), generateComponent());
+    (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
-  Me(created.map((f) => `${import_picocolors16.default.green("\u2713")} ${f}`).join("\n"), "Created");
+  Me(created.map((f) => `${import_picocolors17.default.green("\u2713")} ${f}`).join("\n"), "Created");
   const pm = detectPackageManager();
   if (opts.install) {
     const s = Y2();
@@ -281784,38 +281979,43 @@ async function init(args = []) {
       (0, import_child_process2.execSync)(`${pm} add @abloatai/ablo`, { stdio: "ignore" });
       s.stop("Installed @abloatai/ablo");
     } catch {
-      s.stop(`${import_picocolors16.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors16.default.bold(`${pm} install @abloatai/ablo`)}`);
+      s.stop(`${import_picocolors17.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors17.default.bold(`${pm} install @abloatai/ablo`)}`);
     }
   }
   const steps = [
-    `Get a ${import_picocolors16.default.bold("sk_test_")} key at ${import_picocolors16.default.cyan("https://abloatai.com")}`,
-    `Run ${import_picocolors16.default.bold("npx ablo login")} (or add ${import_picocolors16.default.bold("ABLO_API_KEY")} to ${import_picocolors16.default.bold(envFile)})`,
-    `Set ${import_picocolors16.default.bold("DATABASE_URL")} in ${import_picocolors16.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors16.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Get a ${import_picocolors17.default.bold("sk_test_")} key at ${import_picocolors17.default.cyan("https://abloatai.com")}`,
+    `Run ${import_picocolors17.default.bold("npx ablo login")} (or add ${import_picocolors17.default.bold("ABLO_API_KEY")} to ${import_picocolors17.default.bold(envFile)})`,
+    `Set ${import_picocolors17.default.bold("DATABASE_URL")} in ${import_picocolors17.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors17.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "direct" ? [
-      `Provision your DB: ${import_picocolors16.default.bold("npx ablo migrate")} (creates your synced-model tables with row-level security; keep your own migrations for everything else)`
+      `Provision your DB: ${import_picocolors17.default.bold("npx ablo migrate")} (creates your synced-model tables with row-level security; keep your own migrations for everything else)`
     ] : [
-      `Provision your DB: ${import_picocolors16.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors16.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors16.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors17.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors17.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors17.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors16.default.bold("app/layout.tsx")} in ${import_picocolors16.default.bold("<Providers>")} (app/providers.tsx) and add your auth to ${import_picocolors16.default.bold("app/api/ablo-session/route.ts")}`
+      `Wrap ${import_picocolors17.default.bold("app/layout.tsx")} in ${import_picocolors17.default.bold("<Providers>")} (app/providers.tsx) and add your auth to ${import_picocolors17.default.bold("app/api/ablo-session/route.ts")}`
     ] : [],
-    `Run ${import_picocolors16.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors17.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors16.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
-      `Run ${import_picocolors16.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors17.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
+      `Run ${import_picocolors17.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
+  const existingKey = resolveApiKey("sandbox");
+  if (existingKey) {
+    Se(`Already authorized ${import_picocolors17.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)} \u2014 run ${import_picocolors17.default.bold("npx ablo push")} next. ${import_picocolors17.default.dim("Docs:")} https://abloatai.com/docs`);
+    return;
+  }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors16.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors17.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       return;
     }
   }
-  Se(`Run ${import_picocolors16.default.bold("npx ablo login")} when ready. ${import_picocolors16.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors17.default.bold("npx ablo login")} when ready. ${import_picocolors17.default.dim("Docs:")} https://abloatai.com/docs`);
 }
 function generateSchema() {
   return `import { defineSchema, model, relation, z } from '@abloatai/ablo/schema';
@@ -282169,9 +282369,9 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
 `;
 }
 function detectPackageManager() {
-  if ((0, import_fs11.existsSync)("pnpm-lock.yaml")) return "pnpm";
-  if ((0, import_fs11.existsSync)("yarn.lock")) return "yarn";
-  if ((0, import_fs11.existsSync)("bun.lockb")) return "bun";
+  if ((0, import_fs12.existsSync)("pnpm-lock.yaml")) return "pnpm";
+  if ((0, import_fs12.existsSync)("yarn.lock")) return "yarn";
+  if ((0, import_fs12.existsSync)("bun.lockb")) return "bun";
   return "npm";
 }
 main().catch(console.error);