@abloatai/cli 0.41.0 → 0.42.0

package/dist/cli.cjs

@@ -3047,23 +3047,28 @@ function readProjectWriteDatabaseUrl(cwd = process.cwd()) {
   return readProjectEnvValue("ABLO_WRITE_DATABASE_URL", cwd);
 }
 function readProjectEnvValue(variable, cwd) {
+  return readProjectEnvVariable(variable, cwd, false)?.value ?? null;
+}
+function readProjectEnvVariable(variable, cwd = process.cwd(), includeProcess = true) {
+  if (includeProcess && process.env[variable]) {
+    return { value: process.env[variable], source: "env" };
+  }
   for (const filename of [".env.local", ".env"]) {
     const path = (0, import_path.resolve)(cwd, filename);
     if (!(0, import_fs2.existsSync)(path)) continue;
     const match = new RegExp(`^${variable}=(.+)$`, "m").exec((0, import_fs2.readFileSync)(path, "utf8"));
-    if (match?.[1]) return match[1].trim().replace(/^["']|["']$/g, "");
+    if (match?.[1]) {
+      return {
+        value: match[1].trim().replace(/^["']|["']$/g, ""),
+        source: filename
+      };
+    }
   }
   return null;
 }
 function readProjectApiKey(cwd = process.cwd()) {
-  if (process.env.ABLO_API_KEY) return { key: process.env.ABLO_API_KEY, source: "env" };
-  for (const name of [".env.local", ".env"]) {
-    const path = (0, import_path.resolve)(cwd, name);
-    if (!(0, import_fs2.existsSync)(path)) continue;
-    const match = /^ABLO_API_KEY=(.+)$/m.exec((0, import_fs2.readFileSync)(path, "utf8"));
-    if (match?.[1]) return { key: match[1].trim().replace(/^["']|["']$/g, ""), source: name };
-  }
-  return null;
+  const found = readProjectEnvVariable("ABLO_API_KEY", cwd);
+  return found ? { key: found.value, source: found.source } : null;
 }
 var import_crypto2, import_fs2, import_path, REPLICATION_URL_VARS, ADMIN_URL_VAR;
 var init_dbRole = __esm({
@@ -3361,6 +3366,11 @@ function clearCredential() {
 function resolveApiKey(modeOverride) {
   return resolveKey({ purpose: "data", mode: modeOverride }).key;
 }
+function ambientEnvKeyNote(cwd) {
+  const ambient = readProjectApiKey(cwd);
+  if (!ambient || ambient.source === "env") return null;
+  return `Note: ${ambient.source} in this directory holds an ABLO_API_KEY, which this command does not load \u2014 it reads only the process environment and your stored login, so a file cannot silently choose the plane. Export the variable (or prefix the command with it) to use that key.`;
+}
 function resolveManagementKey() {
   if (process.env.ABLO_MANAGEMENT_KEY) return process.env.ABLO_MANAGEMENT_KEY;
   const cfg = readConfig();
@@ -3773,7 +3783,8 @@ async function confirmFromServer(opts) {
       branchId: identity.branchId ?? null,
       branchRoot: identity.branchRoot
     };
-  } catch {
+  } catch (error) {
+    if (opts.strict) throw error;
     return null;
   }
 }
@@ -5600,7 +5611,8 @@ function rotateWithoutConnection(input) {
     return "Ablo did not accept this API key, so it cannot be told about a new password. Rotate changes the password in your database first, so running it with a key Ablo refuses would leave the database on a password nobody holds.";
   }
   if (!input.known || input.planeHasConnection) return null;
-  return "This plane has no connected database, so there is no credential to re-key. Rotate changes the password in your database before Ablo can be told about it, so running it here would leave the database on a password Ablo never receives.";
+  if (input.existingRoles.length > 0) return null;
+  return "This plane has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
 }
 async function locateExistingConnection(input) {
   const result = await tryControlPlane({
@@ -5678,7 +5690,7 @@ async function executePlan(sql, steps, rebuildPlaintext) {
 async function runConnectApply(args) {
   const rotating = args.rotate;
   const verb = rotating ? "connect rotate" : "connect apply";
-  const adminUrl = args.url ?? readProjectAdminDatabaseUrl();
+  let adminUrl = args.url ?? readProjectAdminDatabaseUrl();
   if (!adminUrl) {
     throw new import_errors9.AbloValidationError(
       "No admin connection string. Pass --url <admin-conn> (or set DATABASE_URL) and re-run.",
@@ -5695,12 +5707,17 @@ async function runConnectApply(args) {
   const apiKey = resolveApiKey();
   if (!apiKey) {
     const loggedIn = resolveManagementKey() !== void 0;
+    const ambient = ambientEnvKeyNote();
     throw new import_errors9.AbloAuthenticationError(
       loggedIn ? `You are logged in, but this project has no ${getMode()} data key.
 
 The key is looked for in ABLO_API_KEY, then in the credential stored for the active project in the active mode (${getMode()}). Logging in stores a management credential, which administers the project but cannot register a database \u2014 and a key for another mode is never used implicitly, so registering against production takes an explicit production key.
 
-Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the plane this database should join (its sk_live_ key for production).` : "Not logged in, and no ABLO_API_KEY is set. Run `ablo login` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.",
+Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the plane this database should join (its sk_live_ key for production).${ambient ? `
+
+${ambient}` : ""}` : `Not logged in, and no ABLO_API_KEY is set. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -5715,23 +5732,39 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
   );
   const pooledAdmin = detectPooler(adminUrl);
   if (pooledAdmin?.confidence === "host") {
-    console.error(
-      `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(target)} is a connection pooler, not the database.
+    if (pooledAdmin.direct) {
+      adminUrl = pooledAdmin.direct;
+      const pooledLabel = target;
+      try {
+        const parsed = new URL(adminUrl);
+        target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+      } catch {
+      }
+      console.log(
+        `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(pooledLabel)} is a connection pooler, so this run uses the direct host:
+    ${import_picocolors11.default.bold(target)}
+` + import_picocolors11.default.dim(
+          `    A pooler terminates the session, so replication cannot run over it. Your app
+    keeps the pooled URL; the setup needs the database itself.
 `
-    );
-    console.error(
-      import_picocolors11.default.dim(
-        `    A pooler terminates the session, so replication cannot run over it. Setting up
-    through it creates roles that Ablo then cannot use to stream.
+        )
+      );
+    } else {
+      console.error(
+        `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(target)} is a connection pooler, not the database.
 `
-      )
-    );
-    console.error(
-      pooledAdmin.direct ? `    Re-run against the direct host: ${import_picocolors11.default.bold(pooledAdmin.direct)}
-` : `    Re-run against the direct database host, not the pooled one.
+      );
+      console.error(
+        import_picocolors11.default.dim(
+          `    A pooler terminates the session, so replication cannot run over it. Setting up
+    through it creates roles that Ablo then cannot use to stream.
 `
-    );
-    process.exit(1);
+        )
+      );
+      console.error(`    Re-run against the direct database host, not the pooled one.
+`);
+      process.exit(1);
+    }
   }
   if (pooledAdmin?.confidence === "port") {
     console.log(
@@ -5771,31 +5804,31 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
 `);
     console.error(
       import_picocolors11.default.dim(`    Your database is untouched.
-`) + `  To move it here, disconnect it there first with ${import_picocolors11.default.cyan("ablo connect deregister")}.
-`
+`) + `  To move it here, disconnect it there first with ${import_picocolors11.default.cyan("ablo connect deregister")}
+` + import_picocolors11.default.dim(`  (run with a key for that plane). Match the project id to a name with `) + import_picocolors11.default.bold("ablo projects list --json") + import_picocolors11.default.dim(".") + "\n"
     );
     process.exit(1);
   }
+  let rotatePlane = null;
   if (rotating) {
     const state = await fetchDataSourceState(apiBaseUrl(), apiKey).catch(
       () => ({ kind: "unknown", detail: "unreachable" })
     );
-    const refusal = rotateWithoutConnection({
-      rotating,
+    rotatePlane = {
       planeHasConnection: state.kind === "connected",
       known: state.kind !== "unknown",
       // 401/403 is Ablo answering and declining the key, not a network failure.
       keyRejected: state.kind === "unknown" && /HTTP 40[13]/.test(state.detail)
-    });
-    if (refusal) {
-      console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
+    };
+    if (rotatePlane.keyRejected) {
+      const refusal = rotateWithoutConnection({ rotating, ...rotatePlane, existingRoles: [] });
+      if (refusal) {
+        console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
 `);
-      console.error(
-        import_picocolors11.default.dim(`    Your database is untouched.
-`) + `  Connect it instead:  ${import_picocolors11.default.cyan("npx ablo connect apply")}
-`
-      );
-      process.exit(1);
+        console.error(import_picocolors11.default.dim(`    Your database is untouched.
+`));
+        process.exit(1);
+      }
     }
   }
   const admin = src_default(adminUrl, {
@@ -5855,9 +5888,21 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
   const pubReconcile = reconcilePublicationPlan(existingPublication, tables);
   const role = args.role && args.role.length > 0 ? args.role : import_footprint.ABLO_REPLICATION_ROLE;
   const writeRole = args.writeRole && args.writeRole.length > 0 ? args.writeRole : import_footprint.ABLO_WRITE_ROLE;
+  const existingRoles = await presentRoles(admin, [role, writeRole]).catch(() => []);
+  if (rotatePlane) {
+    const refusal = rotateWithoutConnection({ rotating, ...rotatePlane, existingRoles });
+    if (refusal) {
+      await admin.end({ timeout: 2 });
+      console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
+`);
+      console.error(import_picocolors11.default.dim(`    Your database is untouched.
+`));
+      process.exit(1);
+    }
+  }
   const blocker = reapplyBlocker({
     rotating,
-    existingRoles: await presentRoles(admin, [role, writeRole]).catch(() => [])
+    existingRoles
   });
   if (blocker) {
     await admin.end({ timeout: 2 });
@@ -6080,6 +6125,7 @@ function parseConnectArgs(argv) {
   let yes = false;
   let showSql = false;
   let scan = false;
+  let locate = false;
   let manual = false;
   let tables = [];
   let role = import_footprint.ABLO_REPLICATION_ROLE;
@@ -6104,9 +6150,12 @@ function parseConnectArgs(argv) {
       case "scan":
         scan = true;
         break;
+      case "locate":
+        locate = true;
+        break;
       default:
         throw new import_errors10.AbloValidationError(
-          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan)`,
+          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan, locate)`,
           { code: "cli_invalid_arguments" }
         );
     }
@@ -6168,6 +6217,7 @@ function parseConnectArgs(argv) {
     yes,
     showSql,
     scan,
+    locate,
     tables,
     role,
     writeRole,
@@ -6465,8 +6515,11 @@ async function runCheck() {
   );
   const apiKey = resolveApiKey();
   if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      "No API key found. Run `ablo login` (or set ABLO_API_KEY), then re-run `ablo connect check`.",
+      `No API key found. Run \`ablo login\` (or set ABLO_API_KEY), then re-run \`ablo connect check\`.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -6531,8 +6584,11 @@ async function runRegister(args) {
   const writeDbUrl = requireScopedUrl("write", "register");
   const apiKey = resolveApiKey();
   if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      "Not logged in. Run `ablo login` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.",
+      `Not logged in. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -6633,6 +6689,62 @@ async function runScan() {
   }
   process.exit(retired.length > 0 ? 1 : 0);
 }
+async function runLocate(args) {
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which plane holds this database")}
+`
+  );
+  const url = args.url ?? readProjectAdminDatabaseUrl();
+  if (!url) {
+    throw new import_errors10.AbloValidationError(
+      "Locating needs a connection string to identify the database. Pass --url <conn> (or set DATABASE_URL) and re-run.",
+      { code: "cli_database_url_missing" }
+    );
+  }
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
+    throw new import_errors10.AbloAuthenticationError(
+      `No API key found. Run \`ablo login\` (or set ABLO_API_KEY), then re-run \`ablo connect locate\`.${ambient ? `
+
+${ambient}` : ""}`,
+      { code: "cli_api_key_missing" }
+    );
+  }
+  let label = "this database";
+  try {
+    const parsed = new URL(url);
+    label = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+  } catch {
+  }
+  const answer = await requestControlPlane({
+    path: "/v1/datasources/locate",
+    method: "POST",
+    apiKey,
+    body: { connectionString: url },
+    responseSchema: import_wire7.datasourceLocationResponseSchema
+  });
+  if (!answer.held) {
+    console.log(
+      `  ${import_picocolors12.default.green("\u2713")} No plane holds ${import_picocolors12.default.bold(label)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
+`
+    );
+    return;
+  }
+  console.log(
+    `  ${import_picocolors12.default.yellow("!")} ${import_picocolors12.default.bold(label)} is connected to ${answer.held.project ? `project ${import_picocolors12.default.bold(answer.held.project)}, ` : ""}branch ${import_picocolors12.default.bold(answer.held.branch)}.
+`
+  );
+  console.log(
+    import_picocolors12.default.dim(
+      `    Ablo streams a database from one plane at a time. To move it, disconnect it there
+    first \u2014 run `
+    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that plane, then connect here.
+`) + import_picocolors12.default.dim(`    Confirm a candidate key first with `) + import_picocolors12.default.bold("ablo whoami --key-env <NAME>") + import_picocolors12.default.dim(`.
+`) + import_picocolors12.default.dim(`    Match the project id to a name with `) + import_picocolors12.default.bold("ablo projects list --json") + import_picocolors12.default.dim(".") + "\n"
+  );
+}
 async function connect(argv) {
   if (argv[0] === "deregister") {
     const { disconnect: disconnect2 } = await Promise.resolve().then(() => (init_disconnect(), disconnect_exports));
@@ -6657,6 +6769,10 @@ async function connect(argv) {
     await runScan();
     return;
   }
+  if (args.locate) {
+    await runLocate(args);
+    return;
+  }
   const credentialReachable = (args.url ?? readProjectAdminDatabaseUrl()) != null;
   const canConfirm = process.stdout.isTTY || args.yes;
   if (!args.manual && credentialReachable && canConfirm) {
@@ -6666,7 +6782,7 @@ async function connect(argv) {
   }
   printConnectRecipe(args);
 }
-var import_errors10, import_picocolors12, import_footprint2, FOOTPRINT_LOOKUP, CONNECT_USAGE;
+var import_errors10, import_picocolors12, import_footprint2, import_wire7, FOOTPRINT_LOOKUP, CONNECT_USAGE;
 var init_connect = __esm({
   "src/connect.ts"() {
     "use strict";
@@ -6678,6 +6794,7 @@ var init_connect = __esm({
     init_dbRole();
     init_config();
     init_controlPlane();
+    import_wire7 = require("@abloatai/transaction/wire");
     init_theme();
     init_remoteValidation();
     init_connectSetup();
@@ -6701,6 +6818,7 @@ var init_connect = __esm({
     npx ablo connect check                Confirm the connected database is ready, from Ablo's side (needs only ABLO_API_KEY)
     npx ablo connect rotate               New passwords for both logins, then re-register
     npx ablo connect scan                 List anything Ablo ever set up in your database (read-only, never drops)
+    npx ablo connect locate               See which plane holds this database (read-only; nothing is changed)
 
   Running it: bare \`ablo connect\` sets everything up for you \u2014 creating the two
   scoped logins, sharing your tables, and registering \u2014 whenever it finds a
@@ -282702,7 +282820,7 @@ Node text: ${this.#forgottenText}`;
 // src/index.ts
 init_cjs_shims();
 init_dist2();
-var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_picocolors28 = __toESM(require_picocolors(), 1);
 var import_fs13 = require("fs");
 var import_path8 = require("path");
 var import_child_process3 = require("child_process");
@@ -283736,6 +283854,223 @@ async function runBranchDev(argv, dependencies = {}) {
   });
 }
 
+// src/whoami.ts
+init_cjs_shims();
+var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_errors13 = require("@abloatai/transaction/errors");
+init_config();
+init_controlPlane();
+
+// src/credentialCapability.ts
+init_cjs_shims();
+var import_credentialPolicy3 = require("@abloatai/transaction/auth/credentialPolicy");
+init_config();
+function secretCounterpart(key) {
+  return modeFromKey(key) === "production" ? "sk_live_" : "sk_test_";
+}
+function credentialCapability(key) {
+  const kind = key ? (0, import_credentialPolicy3.classifyCredentialKind)(key) : null;
+  if (!key || kind === null) return { kind, label: "", note: null };
+  const secret = `${secretCounterpart(key)}\u2026`;
+  switch (kind) {
+    case "secret":
+      return { kind, label: "", note: null };
+    case "restricted":
+      return {
+        kind,
+        label: "scoped",
+        note: `A scoped key does exactly what it was minted for. The production key \`ablo login\` stores is for observing your live plane with \`ablo status\` and \`ablo logs\`; authoring schema there takes a secret ${secret} key from the dashboard.`
+      };
+    case "publishable":
+      return {
+        kind,
+        label: "read-only",
+        note: `This is the key that is safe to ship in a browser bundle, and it reads. Work from a terminal wants a secret ${secret} key.`
+      };
+    case "ephemeral":
+      return {
+        kind,
+        label: "session key",
+        note: `This is a short-lived credential minted for one signed-in person, and it expires. Pushing a schema needs a secret ${secret} key.`
+      };
+  }
+}
+
+// src/whoami.ts
+init_dbRole();
+init_theme();
+init_target();
+var WHOAMI_USAGE = `  ablo whoami \u2014 show the plane a credential acts on
+
+  Usage
+    npx ablo whoami
+    npx ablo whoami --key-env <NAME>
+    npx ablo whoami --key <VALUE>
+    npx ablo whoami --json
+
+  Credential choice
+    With no flag, uses ABLO_API_KEY, then the active project's stored data key,
+    then the stored login. This command does not load .env files implicitly.
+
+    --key-env reads a named variable from the process, .env.local, or .env
+    without putting its value in shell history or the process list. Prefer it
+    for comparing several keys.
+    --key accepts a value directly for one-off use.
+
+  Output never prints the full credential. Identity is confirmed by the server;
+  an invalid key, unreachable server, or unsupported server fails non-zero.`;
+function parseWhoamiArgs(argv) {
+  let json = false;
+  let key;
+  let keyEnv;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--json":
+        json = true;
+        break;
+      case "--key": {
+        const value = argv[++i];
+        if (!value || value.startsWith("--")) {
+          throw new import_errors13.AbloValidationError("`--key` needs a credential value.", {
+            code: "cli_invalid_arguments"
+          });
+        }
+        key = value;
+        break;
+      }
+      case "--key-env": {
+        const value = argv[++i];
+        if (!value || value.startsWith("--")) {
+          throw new import_errors13.AbloValidationError("`--key-env` needs an environment variable name.", {
+            code: "cli_invalid_arguments"
+          });
+        }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+          throw new import_errors13.AbloValidationError(
+            `\`${value}\` is not a valid environment variable name.`,
+            { code: "cli_invalid_arguments" }
+          );
+        }
+        keyEnv = value;
+        break;
+      }
+      default:
+        throw new import_errors13.AbloValidationError(`unknown whoami flag: ${arg}`, {
+          code: "cli_invalid_arguments"
+        });
+    }
+  }
+  if (key && keyEnv) {
+    throw new import_errors13.AbloValidationError("Choose one credential source: `--key` or `--key-env`.", {
+      code: "cli_invalid_arguments"
+    });
+  }
+  return { json, ...key ? { key } : {}, ...keyEnv ? { keyEnv } : {} };
+}
+function selectWhoamiCredential(args, cwd = process.cwd()) {
+  if (args.key) return { key: args.key, source: "--key", targetSource: "env" };
+  if (args.keyEnv) {
+    const found = readProjectEnvVariable(args.keyEnv, cwd);
+    if (!found) {
+      throw new import_errors13.AbloAuthenticationError(
+        `${args.keyEnv} is not set in the process environment, .env.local, or .env.`,
+        { code: "cli_api_key_missing" }
+      );
+    }
+    return {
+      key: found.value,
+      source: `${found.source}:${args.keyEnv}`,
+      targetSource: "env"
+    };
+  }
+  const dataKey = resolveApiKey();
+  if (dataKey) {
+    return {
+      key: dataKey,
+      source: process.env.ABLO_API_KEY ? "env:ABLO_API_KEY" : "stored data key",
+      targetSource: process.env.ABLO_API_KEY ? "env" : "stored"
+    };
+  }
+  const managementKey = resolveManagementKey();
+  if (managementKey) {
+    return {
+      key: managementKey,
+      source: process.env.ABLO_MANAGEMENT_KEY ? "env:ABLO_MANAGEMENT_KEY" : "stored login",
+      targetSource: process.env.ABLO_MANAGEMENT_KEY ? "env" : "stored"
+    };
+  }
+  const ambient = ambientEnvKeyNote();
+  throw new import_errors13.AbloAuthenticationError(
+    `No credential found. Run \`ablo login\`, set ABLO_API_KEY, or pass \`--key-env <NAME>\`.${ambient ? `
+
+${ambient}` : ""}`,
+    { code: "cli_api_key_missing" }
+  );
+}
+async function whoami(argv) {
+  const args = parseWhoamiArgs(argv);
+  const selected = selectWhoamiCredential(args);
+  const target = await resolveTarget({
+    url: apiBaseUrl(),
+    apiKey: selected.key,
+    keySource: selected.targetSource,
+    strict: true
+  });
+  const confirmed = target.confirmed;
+  if (!confirmed) {
+    throw new import_errors13.AbloAuthenticationError(
+      "The server did not confirm an identity for this credential.",
+      { code: "identity_resolve_failed" }
+    );
+  }
+  const project = confirmed.project;
+  const projectLabel = project ? project.isDefault ? "default" : project.slug : "default";
+  const actsOn = confirmed.branchId ? confirmed.branchRoot ? "production root" : `branch ${confirmed.branchId}` : confirmed.environment ?? "unknown";
+  const capability = credentialCapability(selected.key);
+  if (args.json) {
+    console.log(
+      JSON.stringify(
+        {
+          authenticated: true,
+          key: {
+            prefix: `${selected.key.slice(0, 12)}\u2026`,
+            source: selected.source,
+            kind: capability.kind
+          },
+          organizationId: confirmed.organizationId,
+          project: project ? {
+            id: project.id,
+            slug: projectLabel,
+            name: project.name,
+            default: project.isDefault
+          } : null,
+          environment: confirmed.environment,
+          branchId: confirmed.branchId ?? null,
+          branchRoot: confirmed.branchRoot ?? false
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+  ${brand("ablo")} ${import_picocolors16.default.dim("whoami")}
+`);
+  console.log(
+    `  ${import_picocolors16.default.dim("key")}     ${selected.key.slice(0, 12)}\u2026 ${import_picocolors16.default.dim(`(${selected.source} \xB7 ${capability.label})`)}`
+  );
+  console.log(`  ${import_picocolors16.default.dim("org")}     ${import_picocolors16.default.dim(confirmed.organizationId)}`);
+  console.log(
+    `  ${import_picocolors16.default.dim("project")} ${import_picocolors16.default.bold(projectLabel)}${project ? ` ${import_picocolors16.default.dim(`(${project.id})`)}` : ""}`
+  );
+  console.log(`  ${import_picocolors16.default.dim("acts on")} ${import_picocolors16.default.bold(actsOn)}`);
+  console.log(`
+  ${import_picocolors16.default.green("\u2713")} ${import_picocolors16.default.dim("credential accepted; target confirmed by the server")}
+`);
+}
+
 // src/commands.ts
 var CORE_GROUPS = ["Start", "Every day", "More"];
 var FULL_GROUPS = [
@@ -283786,6 +284121,7 @@ var COMMANDS = [
         { run: "connect apply", does: "Run that setup for you, from a one-time admin URL" },
         { run: "connect check", does: "Confirm your database is ready to share changes with Ablo" },
         { run: "connect scan", does: "List anything Ablo ever set up in your database (read-only)" },
+        { run: "connect locate", does: "See which plane holds a database before connecting it" },
         { run: "connect deregister", does: "Disconnect this project's database \u2014 Ablo stops reading and writing it" }
       ]
     }
@@ -283875,6 +284211,18 @@ var COMMANDS = [
       ]
     }
   },
+  {
+    name: "whoami",
+    usage: WHOAMI_USAGE,
+    full: {
+      group: "See what's happening",
+      rows: [
+        { run: "whoami", does: "Show the server-confirmed plane the active credential acts on" },
+        { run: "whoami --key-env <NAME>", does: "Inspect another key without exposing it in argv" },
+        { run: "whoami --json", does: "Same, machine-readable" }
+      ]
+    }
+  },
   {
     name: "status",
     core: { group: "Every day", does: "See what this key acts on, your pushed schema, and whether writes will work" },
@@ -284003,15 +284351,15 @@ function fullRows(group) {
 }
 
 // src/index.ts
-var import_errors20 = require("@abloatai/transaction/errors");
+var import_errors21 = require("@abloatai/transaction/errors");
 init_push();
 
 // src/generate.ts
 init_cjs_shims();
-var import_errors13 = require("@abloatai/transaction/errors");
+var import_errors14 = require("@abloatai/transaction/errors");
 var import_fs8 = require("fs");
 var import_path6 = require("path");
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 var import_schema7 = require("@abloatai/transaction/schema");
 init_push();
 var DEFAULT_SCHEMA_PATH4 = "ablo/schema.ts";
@@ -284034,7 +284382,7 @@ function parseGenerateArgs(argv) {
         out = argv[++i] ?? out;
         break;
       default:
-        throw new import_errors13.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors14.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, out };
@@ -284044,7 +284392,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -284053,22 +284401,22 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema7.serializeSchema)(schema));
     source = (0, import_schema7.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const abs = (0, import_path6.resolve)(process.cwd(), args.out);
   (0, import_fs8.mkdirSync)((0, import_path6.dirname)(abs), { recursive: true });
   (0, import_fs8.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors16.default.green("\u2713")} Generated types \u2192 ${import_picocolors16.default.bold(args.out)}`);
+  console.log(`  ${import_picocolors17.default.green("\u2713")} Generated types \u2192 ${import_picocolors17.default.bold(args.out)}`);
 }
 
 // src/login.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 init_dist2();
-var import_errors14 = require("@abloatai/transaction/errors");
-var import_wire7 = require("@abloatai/transaction/wire");
+var import_errors15 = require("@abloatai/transaction/errors");
+var import_wire8 = require("@abloatai/transaction/wire");
 init_config();
 init_theme();
 var CLIENT_ID = "ablo-cli";
@@ -284086,20 +284434,21 @@ function openBrowser(url) {
   } catch {
   }
 }
-function parseProjectFlag(argv) {
-  const i = argv.indexOf("--project");
+function parseSlugFlag(argv, flag2) {
+  const i = argv.indexOf(flag2);
   if (i >= 0) {
     const slug = argv[i + 1];
     if (slug && !slug.startsWith("-")) return slug;
   }
-  const eq = argv.find((a) => a.startsWith("--project="));
-  return eq ? eq.slice("--project=".length) || void 0 : void 0;
+  const eq = argv.find((a) => a.startsWith(`${flag2}=`));
+  return eq ? eq.slice(flag2.length + 1) || void 0 : void 0;
 }
 async function deviceLogin(argv, deps = {}) {
   const openUrl = deps.openUrl ?? openBrowser;
   Ie(`${brand("ablo")} login`);
-  const requested = parseProjectFlag(argv) ?? getActiveProject()?.slug;
+  const requested = parseSlugFlag(argv, "--project") ?? getActiveProject()?.slug;
   const targetProject = requested === DEFAULT_PROFILE ? void 0 : requested;
+  const targetOrg = parseSlugFlag(argv, "--org");
   const interactive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   let account = "login";
   if (interactive) {
@@ -284126,11 +284475,11 @@ async function deviceLogin(argv, deps = {}) {
     process.exit(1);
   }
   const code = await codeRes.json();
-  const approvePath = `/cli?user_code=${code.user_code}`;
+  const approvePath = `/cli?user_code=${code.user_code}${targetOrg ? `&org=${encodeURIComponent(targetOrg)}` : ""}`;
   const url = account === "signup" ? `${DASHBOARD_URL}/signup?next=${encodeURIComponent(approvePath)}` : `${DASHBOARD_URL}${approvePath}`;
-  Me(`${import_picocolors17.default.bold(code.user_code)}
+  Me(`${import_picocolors18.default.bold(code.user_code)}
 
-${import_picocolors17.default.dim(url)}`, "Approve in your browser");
+${import_picocolors18.default.dim(url)}`, "Approve in your browser");
   openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -284200,7 +284549,7 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
   }
   if (!provRes.ok) {
     s.stop("Could not provision a key.");
-    const err = (0, import_errors14.translateHttpError)(
+    const err = (0, import_errors15.translateHttpError)(
       provRes.status,
       await provRes.json().catch(() => null),
       provRes.headers.get("x-request-id") ?? void 0
@@ -284208,30 +284557,36 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
     M2.error(err.message);
     if (err.code === "entity_not_found" && targetProject) {
       M2.error(
-        `If that isn't the account you meant, run ${import_picocolors17.default.bold("npx ablo logout")} and sign in again. Otherwise create it with ${import_picocolors17.default.bold(`npx ablo projects create ${targetProject}`)}.`
+        `If that isn't the account you meant, run ${import_picocolors18.default.bold("npx ablo logout")} and sign in again. Otherwise create it with ${import_picocolors18.default.bold(`npx ablo projects create ${targetProject}`)}.`
       );
     } else {
       M2.error(
-        `The browser approval succeeded but the credential handoff failed. Try ${import_picocolors17.default.bold("npx ablo login")} again.`
+        `The browser approval succeeded but the credential handoff failed. Try ${import_picocolors18.default.bold("npx ablo login")} again.`
       );
     }
     process.exit(1);
   }
-  const parsedProv = import_wire7.provisionKeyResponseSchema.safeParse(
+  const parsedProv = import_wire8.provisionKeyResponseSchema.safeParse(
     await provRes.json().catch(() => null)
   );
   if (!parsedProv.success) {
     s.stop("Could not provision a key.");
     M2.error("The key handoff returned something this version does not recognize.");
-    M2.error(`Try again, or upgrade with ${import_picocolors17.default.bold("npm i -g @abloatai/ablo")}.`);
+    M2.error(`Try again, or upgrade with ${import_picocolors18.default.bold("npm i -g @abloatai/ablo")}.`);
     process.exit(1);
   }
   const prov = parsedProv.data;
   const entry = (k3) => ({
     apiKey: k3.apiKey,
     ...prov.organizationId ? { organizationId: prov.organizationId } : {},
+    ...prov.organizationSlug ? { organizationSlug: prov.organizationSlug } : {},
     ...k3.expiresAt ? { expiresAt: k3.expiresAt } : {}
   });
+  if (targetOrg && prov.organizationSlug && prov.organizationSlug !== targetOrg) {
+    M2.warn(
+      `The approval chose ${import_picocolors18.default.bold(prov.organizationSlug)}, not ${import_picocolors18.default.bold(targetOrg)}. The credential is scoped to ${import_picocolors18.default.bold(prov.organizationSlug)}.`
+    );
+  }
   const profileName = prov.project?.slug ?? DEFAULT_PROFILE;
   const path = setProfileKeys(
     profileName,
@@ -284241,9 +284596,10 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
   s.stop(`Saved project credential to ${path}`);
-  const where = prov.project ? ` ${import_picocolors17.default.dim(`(project ${prov.project.slug})`)}` : "";
+  const orgLabel = prov.organizationSlug ? ` to ${import_picocolors18.default.bold(prov.organizationSlug)}` : "";
+  const where = prov.project ? ` ${import_picocolors18.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
-    `${import_picocolors17.default.green("\u2713")} Logged in${where}. Run ${import_picocolors17.default.bold("npx ablo dev")} to create or resume your Git branch and start with an expiring runtime key.`
+    `${import_picocolors18.default.green("\u2713")} Logged in${orgLabel}${where}. Run ${import_picocolors18.default.bold("npx ablo dev")} to create or resume your Git branch and start with an expiring runtime key.`
   );
 }
 async function login(argv = [], deps = {}) {
@@ -284252,14 +284608,14 @@ async function login(argv = [], deps = {}) {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors17.default.green("\u2713")} Logged out ${import_picocolors17.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors18.default.green("\u2713")} Logged out ${import_picocolors18.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors17.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors18.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_MANAGEMENT_KEY) {
     console.log(
-      import_picocolors17.default.dim(
-        `  Note: ${import_picocolors17.default.bold("ABLO_MANAGEMENT_KEY")} is still set in this shell and takes precedence.`
+      import_picocolors18.default.dim(
+        `  Note: ${import_picocolors18.default.bold("ABLO_MANAGEMENT_KEY")} is still set in this shell and takes precedence.`
       )
     );
   }
@@ -284271,46 +284627,9 @@ init_projects();
 
 // src/status.ts
 init_cjs_shims();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 init_config();
 init_target();
-
-// src/credentialCapability.ts
-init_cjs_shims();
-var import_credentialPolicy3 = require("@abloatai/transaction/auth/credentialPolicy");
-init_config();
-function secretCounterpart(key) {
-  return modeFromKey(key) === "production" ? "sk_live_" : "sk_test_";
-}
-function credentialCapability(key) {
-  const kind = key ? (0, import_credentialPolicy3.classifyCredentialKind)(key) : null;
-  if (!key || kind === null) return { kind, label: "", note: null };
-  const secret = `${secretCounterpart(key)}\u2026`;
-  switch (kind) {
-    case "secret":
-      return { kind, label: "", note: null };
-    case "restricted":
-      return {
-        kind,
-        label: "scoped",
-        note: `A scoped key does exactly what it was minted for. The production key \`ablo login\` stores is for observing your live plane with \`ablo status\` and \`ablo logs\`; authoring schema there takes a secret ${secret} key from the dashboard.`
-      };
-    case "publishable":
-      return {
-        kind,
-        label: "read-only",
-        note: `This is the key that is safe to ship in a browser bundle, and it reads. Work from a terminal wants a secret ${secret} key.`
-      };
-    case "ephemeral":
-      return {
-        kind,
-        label: "session key",
-        note: `This is a short-lived credential minted for one signed-in person, and it expires. Pushing a schema needs a secret ${secret} key.`
-      };
-  }
-}
-
-// src/status.ts
 init_theme();
 init_controlPlane();
 var import_schema8 = require("@abloatai/transaction/coordination/schema");
@@ -284318,9 +284637,9 @@ init_readiness();
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
   if (Number.isNaN(ms)) return "";
-  if (ms <= 0) return import_picocolors18.default.red("expired");
+  if (ms <= 0) return import_picocolors19.default.red("expired");
   const days = Math.floor(ms / (24 * 60 * 60 * 1e3));
-  return import_picocolors18.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
+  return import_picocolors19.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
 }
 async function ping(apiUrl3) {
   const ctrl = new AbortController();
@@ -284341,40 +284660,42 @@ function formatConflict(conflict) {
   const parts = import_schema8.participantKindSchema.options.flatMap((k3) => conflict[k3] ? [`${k3}:${conflict[k3]}`] : []);
   return parts.length ? `{${parts.join(",")}}` : "";
 }
-function printTargetLines(target, localProject, storedOrganizationId) {
+function printTargetLines(target, localProject, storedOrganizationId, storedOrganizationSlug) {
   const confirmed = target?.confirmed ?? null;
   const org = confirmed?.organizationId ?? storedOrganizationId;
   if (org) {
-    const suffix = confirmed?.organizationId ? "" : ` ${import_picocolors18.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors18.default.dim("org")}     ${import_picocolors18.default.dim(org)}${suffix}`);
+    const suffix = confirmed?.organizationId ? "" : ` ${import_picocolors19.default.yellow("(unconfirmed)")}`;
+    const slug = org === storedOrganizationId ? storedOrganizationSlug : void 0;
+    const label = slug ? `${import_picocolors19.default.bold(slug)} ${import_picocolors19.default.dim(`(${org})`)}` : import_picocolors19.default.dim(org);
+    console.log(`  ${import_picocolors19.default.dim("org")}     ${label}${suffix}`);
   } else {
     console.log(
-      `  ${import_picocolors18.default.dim("org")}     ${import_picocolors18.default.yellow("unknown")} ${import_picocolors18.default.dim("(the server did not confirm one for this key)")}`
+      `  ${import_picocolors19.default.dim("org")}     ${import_picocolors19.default.yellow("unknown")} ${import_picocolors19.default.dim("(the server did not confirm one for this key)")}`
     );
   }
   let projectLine;
   if (confirmed?.project) {
     const p2 = confirmed.project;
-    projectLine = p2.isDefault ? `${import_picocolors18.default.bold("default")} ${import_picocolors18.default.dim("(org-default)")}` : `${import_picocolors18.default.bold(p2.slug)} ${import_picocolors18.default.dim(`(${p2.id})`)}`;
+    projectLine = p2.isDefault ? `${import_picocolors19.default.bold("default")} ${import_picocolors19.default.dim("(org-default)")}` : `${import_picocolors19.default.bold(p2.slug)} ${import_picocolors19.default.dim(`(${p2.id})`)}`;
   } else if (confirmed) {
-    projectLine = `${import_picocolors18.default.bold("default")} ${import_picocolors18.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors19.default.bold("default")} ${import_picocolors19.default.dim("(org-default)")}`;
   } else if (localProject) {
-    projectLine = `${import_picocolors18.default.bold(localProject.slug)} ${import_picocolors18.default.dim(`(${localProject.id})`)} ${import_picocolors18.default.yellow("(unconfirmed)")}`;
+    projectLine = `${import_picocolors19.default.bold(localProject.slug)} ${import_picocolors19.default.dim(`(${localProject.id})`)} ${import_picocolors19.default.yellow("(unconfirmed)")}`;
   } else {
-    projectLine = `${import_picocolors18.default.bold("default")} ${target ? import_picocolors18.default.yellow("(unconfirmed)") : import_picocolors18.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors19.default.bold("default")} ${target ? import_picocolors19.default.yellow("(unconfirmed)") : import_picocolors19.default.dim("(org-default)")}`;
   }
-  console.log(`  ${import_picocolors18.default.dim("project")} ${projectLine}`);
+  console.log(`  ${import_picocolors19.default.dim("project")} ${projectLine}`);
   const branch = confirmed?.branchId ?? null;
   const env = confirmed?.environment ?? target?.keyEnv ?? null;
   if (branch) {
     const label = confirmed?.branchRoot ? "production root" : `branch ${branch}`;
-    console.log(`  ${import_picocolors18.default.dim("acts on")} ${import_picocolors18.default.bold(label)}`);
+    console.log(`  ${import_picocolors19.default.dim("acts on")} ${import_picocolors19.default.bold(label)}`);
   } else if (env) {
-    const suffix = confirmed ? "" : ` ${import_picocolors18.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors18.default.dim("acts on")} ${import_picocolors18.default.bold(env)}${suffix}`);
+    const suffix = confirmed ? "" : ` ${import_picocolors19.default.yellow("(unconfirmed)")}`;
+    console.log(`  ${import_picocolors19.default.dim("acts on")} ${import_picocolors19.default.bold(env)}${suffix}`);
   }
   const divergence = describeMismatches(target?.mismatches ?? []);
-  if (divergence) console.log(`    ${import_picocolors18.default.yellow(`\u26A0 ${divergence}`)}`);
+  if (divergence) console.log(`    ${import_picocolors19.default.yellow(`\u26A0 ${divergence}`)}`);
 }
 async function status(args = []) {
   const apiUrl3 = apiBaseUrl();
@@ -284463,23 +284784,28 @@ async function status(args = []) {
     return;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors18.default.dim("status")}
+  ${brand("ablo")} ${import_picocolors19.default.dim("status")}
 `);
   if (effective.key && effective.source && effective.source !== "stored") {
     const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
     console.log(
-      `  ${import_picocolors18.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors18.default.dim(`(${label} \u2014 overrides stored)`)}`
+      `  ${import_picocolors19.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors19.default.dim(`(${label} \u2014 overrides stored)`)}`
     );
   } else if (!cfg) {
-    console.log(`  ${import_picocolors18.default.yellow("!")} Not logged in \u2014 run ${import_picocolors18.default.bold("ablo login")}.`);
+    console.log(`  ${import_picocolors19.default.yellow("!")} Not logged in \u2014 run ${import_picocolors19.default.bold("ablo login")}.`);
   }
   const activeEntry = getKeyEntry(mode);
   const key = describeEffectiveKey(mode, process.env.ABLO_API_KEY, activeEntry);
   if (key.keyMismatch) {
-    console.log(`    ${import_picocolors18.default.yellow(`! ${key.keyMismatch.message}`)}`);
+    console.log(`    ${import_picocolors19.default.yellow(`! ${key.keyMismatch.message}`)}`);
   }
   const activeProject = getActiveProject();
-  printTargetLines(target, activeProject, activeEntry?.organizationId);
+  printTargetLines(
+    target,
+    activeProject,
+    activeEntry?.organizationId,
+    activeEntry?.organizationSlug
+  );
   for (const { key: m2, label } of [
     { key: "sandbox", label: "management" },
     { key: "production", label: "observer" }
@@ -284490,68 +284816,68 @@ async function status(args = []) {
         credentialCapability(entry.apiKey).label,
         entry.expiresAt ? expiryLabel(entry.expiresAt) : ""
       ].filter(Boolean);
-      const trail = facts.length ? ` ${import_picocolors18.default.dim("\xB7")} ${facts.join(import_picocolors18.default.dim(" \xB7 "))}` : "";
+      const trail = facts.length ? ` ${import_picocolors19.default.dim("\xB7")} ${facts.join(import_picocolors19.default.dim(" \xB7 "))}` : "";
       console.log(
-        `  ${import_picocolors18.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors18.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
+        `  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors19.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
       );
     } else {
-      console.log(`  ${import_picocolors18.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors18.default.dim("\u2014 no key")}`);
+      console.log(`  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors19.default.dim("\u2014 no key")}`);
     }
   }
   const plan = resolvePushPlan();
   console.log(
-    `  ${import_picocolors18.default.dim("push")}    ${plan.apiKey ? `${import_picocolors18.default.bold(plan.flow)} ${import_picocolors18.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors18.default.bold(plan.flow)} ${import_picocolors18.default.yellow("\u2014 no credential")} ${import_picocolors18.default.dim(`(run ${import_picocolors18.default.bold("ablo login")} or set ${import_picocolors18.default.bold("ABLO_API_KEY")})`)}`}`
+    `  ${import_picocolors19.default.dim("push")}    ${plan.apiKey ? `${import_picocolors19.default.bold(plan.flow)} ${import_picocolors19.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors19.default.bold(plan.flow)} ${import_picocolors19.default.yellow("\u2014 no credential")} ${import_picocolors19.default.dim(`(run ${import_picocolors19.default.bold("ablo login")} or set ${import_picocolors19.default.bold("ABLO_API_KEY")})`)}`}`
   );
   const capability = credentialCapability(effective.key);
-  if (capability.note) console.log(`    ${import_picocolors18.default.dim(capability.note)}`);
-  process.stdout.write(`  ${import_picocolors18.default.dim("api")}     ${apiUrl3}  `);
+  if (capability.note) console.log(`    ${import_picocolors19.default.dim(capability.note)}`);
+  process.stdout.write(`  ${import_picocolors19.default.dim("api")}     ${apiUrl3}  `);
   const reachable = await ping(apiUrl3);
-  console.log(reachable ? import_picocolors18.default.green("reachable") : import_picocolors18.default.red("unreachable"));
+  console.log(reachable ? import_picocolors19.default.green("reachable") : import_picocolors19.default.red("unreachable"));
   const introspectKey = effective.key;
   const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, introspectKey) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
   if (dataSource.kind === "connected") {
     const how = [...new Set(dataSource.connections)].join(" + ");
     const pooled = detectPoolerIn(dataSource.hosts);
     const unreachable = validation && !validation.ok ? validation.message : void 0;
-    console.log(`  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.green("\u2713")} ${import_picocolors18.default.dim(`database connected to this plane (${how})`)}`);
+    console.log(`  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim(`database connected to this plane (${how})`)}`);
     if (pooled) {
       console.log(
-        `          ${import_picocolors18.default.yellow("\u26A0")} ${import_picocolors18.default.dim(
+        `          ${import_picocolors19.default.yellow("\u26A0")} ${import_picocolors19.default.dim(
           `${pooled.host} is a connection pooler` + (pooled.direct ? `; register the direct host instead: ${pooled.direct}` : "; register the direct host instead")
         )}`
       );
     }
     if (unreachable) {
-      console.log(`          ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.dim(`Ablo could not reach it \u2014 ${unreachable}`)}`);
+      console.log(`          ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.dim(`Ablo could not reach it \u2014 ${unreachable}`)}`);
     }
   } else if (dataSource.kind === "none") {
     console.log(
-      `  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.red("\u2717 no database connected to this plane")} ${import_picocolors18.default.dim("\u2014 writes are held")}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 no database connected to this plane")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
     );
   } else if (reachable) {
-    console.log(`  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`);
+    console.log(`  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`);
   }
   const pushed = reachable ? await fetchPushedSchema(apiUrl3, introspectKey) : null;
   if (reachable) {
     if (pushed?.active) {
-      const when = pushed.pushedAt ? ` ${import_picocolors18.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
-      const ver = pushed.version != null ? ` ${import_picocolors18.default.dim(`(rev ${pushed.version})`)}` : "";
-      const hashLabel = pushed.hash ? ` ${import_picocolors18.default.dim(`hash ${pushed.hash}`)}` : "";
-      console.log(`  ${import_picocolors18.default.dim("schema")}  ${import_picocolors18.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
+      const when = pushed.pushedAt ? ` ${import_picocolors19.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
+      const ver = pushed.version != null ? ` ${import_picocolors19.default.dim(`(rev ${pushed.version})`)}` : "";
+      const hashLabel = pushed.hash ? ` ${import_picocolors19.default.dim(`hash ${pushed.hash}`)}` : "";
+      console.log(`  ${import_picocolors19.default.dim("schema")}  ${import_picocolors19.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
       for (const m2 of pushed.models) {
-        const tn = m2.typename === m2.key ? import_picocolors18.default.dim(`typename=${m2.typename}`) : import_picocolors18.default.yellow(`typename=${m2.typename}`);
+        const tn = m2.typename === m2.key ? import_picocolors19.default.dim(`typename=${m2.typename}`) : import_picocolors19.default.yellow(`typename=${m2.typename}`);
         const conflict = formatConflict(m2.conflict);
-        const conflictStr2 = conflict ? `  ${import_picocolors18.default.dim(`conflict=${conflict}`)}` : "";
-        console.log(`          ${import_picocolors18.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
+        const conflictStr2 = conflict ? `  ${import_picocolors19.default.dim(`conflict=${conflict}`)}` : "";
+        console.log(`          ${import_picocolors19.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
       }
     } else if (pushed && !pushed.active) {
-      console.log(`  ${import_picocolors18.default.dim("schema")}  ${import_picocolors18.default.yellow("none pushed")} ${import_picocolors18.default.dim(`(run ${import_picocolors18.default.bold("ablo push")} or ${import_picocolors18.default.bold("ablo dev")})`)}`);
+      console.log(`  ${import_picocolors19.default.dim("schema")}  ${import_picocolors19.default.yellow("none pushed")} ${import_picocolors19.default.dim(`(run ${import_picocolors19.default.bold("ablo push")} or ${import_picocolors19.default.bold("ablo dev")})`)}`);
     }
   }
   const drift = schemaDrift(await readLocalSchemaHash(), pushed?.hash);
   if (drift) {
     console.log(
-      `  ${import_picocolors18.default.dim("drift")}   ${import_picocolors18.default.red("\u2717 local schema differs from the server")} ` + import_picocolors18.default.dim(`(local ${drift.local}, server ${drift.server})`)
+      `  ${import_picocolors19.default.dim("drift")}   ${import_picocolors19.default.red("\u2717 local schema differs from the server")} ` + import_picocolors19.default.dim(`(local ${drift.local}, server ${drift.server})`)
     );
   }
   const found = blockers({
@@ -284563,33 +284889,33 @@ async function status(args = []) {
   });
   console.log();
   if (found.length > 0) {
-    console.log(`  ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.bold("writes would fail right now")}`);
+    console.log(`  ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.bold("writes would fail right now")}`);
     for (const b4 of found) {
-      console.log(`    ${import_picocolors18.default.dim("\xB7")} ${b4.problem}`);
-      console.log(`      ${import_picocolors18.default.dim(b4.fix)}`);
+      console.log(`    ${import_picocolors19.default.dim("\xB7")} ${b4.problem}`);
+      console.log(`      ${import_picocolors19.default.dim(b4.fix)}`);
     }
   } else if (dataSource.kind === "unknown") {
     console.log(
-      `  ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
+      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
     );
   } else {
-    console.log(`  ${import_picocolors18.default.green("\u2713")} ${import_picocolors18.default.dim("ready \u2014 a write should succeed")}`);
+    console.log(`  ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim("ready \u2014 a write should succeed")}`);
   }
   console.log();
 }
 
 // src/doctor.ts
 init_cjs_shims();
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 init_theme();
 init_controlPlane();
 init_config();
 init_target();
 init_readiness();
 function render(check2) {
-  const mark = check2.state === "ok" ? import_picocolors19.default.green("\u2713") : check2.state === "fail" ? import_picocolors19.default.red("\u2717") : import_picocolors19.default.dim("\u2013");
-  console.log(`  ${mark} ${check2.label.padEnd(10)} ${check2.state === "fail" ? check2.detail : import_picocolors19.default.dim(check2.detail)}`);
-  if (check2.fix) console.log(`    ${" ".repeat(11)}${import_picocolors19.default.dim(`\u2192 ${check2.fix}`)}`);
+  const mark = check2.state === "ok" ? import_picocolors20.default.green("\u2713") : check2.state === "fail" ? import_picocolors20.default.red("\u2717") : import_picocolors20.default.dim("\u2013");
+  console.log(`  ${mark} ${check2.label.padEnd(10)} ${check2.state === "fail" ? check2.detail : import_picocolors20.default.dim(check2.detail)}`);
+  if (check2.fix) console.log(`    ${" ".repeat(11)}${import_picocolors20.default.dim(`\u2192 ${check2.fix}`)}`);
 }
 async function ping2(apiUrl3) {
   const ctrl = new AbortController();
@@ -284607,7 +284933,7 @@ async function ping2(apiUrl3) {
 }
 async function doctor() {
   console.log(`
-  ${brand("ablo")} ${import_picocolors19.default.dim("doctor")}
+  ${brand("ablo")} ${import_picocolors20.default.dim("doctor")}
 `);
   const apiUrl3 = apiBaseUrl();
   const effective = resolveEffectiveApiKey();
@@ -284722,15 +285048,15 @@ async function doctor() {
   console.log();
   if (failed > 0) {
     console.log(
-      `  ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.bold(`${failed} problem${failed === 1 ? "" : "s"}`)}` + import_picocolors19.default.dim(skipped > 0 ? `, ${skipped} check${skipped === 1 ? "" : "s"} skipped` : "")
+      `  ${import_picocolors20.default.red("\u2717")} ${import_picocolors20.default.bold(`${failed} problem${failed === 1 ? "" : "s"}`)}` + import_picocolors20.default.dim(skipped > 0 ? `, ${skipped} check${skipped === 1 ? "" : "s"} skipped` : "")
     );
-    console.log(import_picocolors19.default.dim("    Fix them in the order above \u2014 an earlier one often explains a later one."));
+    console.log(import_picocolors20.default.dim("    Fix them in the order above \u2014 an earlier one often explains a later one."));
   } else if (skipped > 0) {
     console.log(
-      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`nothing is blocking a write, but ${skipped} check${skipped === 1 ? "" : "s"} could not be run`)}`
+      `  ${import_picocolors20.default.yellow("?")} ${import_picocolors20.default.dim(`nothing is blocking a write, but ${skipped} check${skipped === 1 ? "" : "s"} could not be run`)}`
     );
   } else {
-    console.log(`  ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim("everything checks out \u2014 a write should succeed")}`);
+    console.log(`  ${import_picocolors20.default.green("\u2713")} ${import_picocolors20.default.dim("everything checks out \u2014 a write should succeed")}`);
   }
   console.log();
   if (blocking.length > 0 || failed > 0) process.exitCode = 1;
@@ -284738,9 +285064,9 @@ async function doctor() {
 
 // src/logs.ts
 init_cjs_shims();
-var import_errors15 = require("@abloatai/transaction/errors");
-var import_wire8 = require("@abloatai/transaction/wire");
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_errors16 = require("@abloatai/transaction/errors");
+var import_wire9 = require("@abloatai/transaction/wire");
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 init_config();
 init_theme();
 init_controlPlane();
@@ -284783,12 +285109,12 @@ function parseLogsArgs(argv) {
       case "--mode": {
         const raw = argv[++i];
         const m2 = normalizeMode(raw);
-        if (!m2) throw new import_errors15.AbloValidationError(`--mode expects "sandbox" or "production", got "${raw}"`, { code: "cli_invalid_arguments" });
+        if (!m2) throw new import_errors16.AbloValidationError(`--mode expects "sandbox" or "production", got "${raw}"`, { code: "cli_invalid_arguments" });
         args.mode = m2;
         break;
       }
       default:
-        throw new import_errors15.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors16.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return args;
@@ -284807,10 +285133,10 @@ function resolveSince(since) {
 var sleep2 = (ms) => new Promise((r2) => setTimeout(r2, ms));
 function colorOp(op) {
   const label = op.padEnd(6);
-  if (op === "create") return import_picocolors20.default.green(label);
-  if (op === "update") return import_picocolors20.default.yellow(label);
-  if (op === "delete") return import_picocolors20.default.red(label);
-  return import_picocolors20.default.dim(label);
+  if (op === "create") return import_picocolors21.default.green(label);
+  if (op === "update") return import_picocolors21.default.yellow(label);
+  if (op === "delete") return import_picocolors21.default.red(label);
+  return import_picocolors21.default.dim(label);
 }
 function render2(e2, json) {
   if (json) {
@@ -284819,21 +285145,21 @@ function render2(e2, json) {
     return;
   }
   const t = new Date(e2.at).toLocaleTimeString();
-  const actor = e2.actor ? import_picocolors20.default.dim(`  ${e2.actor}`) : "";
-  console.log(`  ${import_picocolors20.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors20.default.bold(e2.model)} ${import_picocolors20.default.dim(e2.recordId)}${actor}`);
+  const actor = e2.actor ? import_picocolors21.default.dim(`  ${e2.actor}`) : "";
+  console.log(`  ${import_picocolors21.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors21.default.bold(e2.model)} ${import_picocolors21.default.dim(e2.recordId)}${actor}`);
 }
 async function logs(argv) {
   let args;
   try {
     args = parseLogsArgs(argv);
   } catch (err) {
-    console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const apiKey = resolveApiKey(args.mode);
   if (!apiKey) {
     console.error(
-      import_picocolors20.default.red(`  No API key.`) + import_picocolors20.default.dim(` Run ${import_picocolors20.default.bold("ablo login")} or set ${import_picocolors20.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors21.default.red(`  No API key.`) + import_picocolors21.default.dim(` Run ${import_picocolors21.default.bold("ablo login")} or set ${import_picocolors21.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
@@ -284847,18 +285173,18 @@ async function logs(argv) {
     if (!res) return null;
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
-      console.error(import_picocolors20.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
+      console.error(import_picocolors21.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
       process.exit(1);
     }
     const json = await res.json();
     return {
       events: json.data ?? json.events ?? [],
-      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire8.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire8.formatFeedCursor)(import_wire8.FEED_CURSOR_START))
+      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire9.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire9.formatFeedCursor)(import_wire9.FEED_CURSOR_START))
     };
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors20.default.dim("logs")} ${import_picocolors20.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors21.default.dim("logs")} ${import_picocolors21.default.dim(`(${args.mode ?? "active"} mode)`)}
 `);
   }
   const initial = await fetchPage({
@@ -284868,13 +285194,13 @@ async function logs(argv) {
     ...args.op ? { op: args.op } : {}
   });
   if (!initial) {
-    console.error(import_picocolors20.default.red(`  Couldn't reach ${baseUrl2}.`));
+    console.error(import_picocolors21.default.red(`  Couldn't reach ${baseUrl2}.`));
     process.exit(1);
   }
   for (const e2 of initial.events) render2(e2, args.json);
   let cursor = initial.cursor;
   if (!args.follow) return;
-  if (!args.json) console.log(`  ${import_picocolors20.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
+  if (!args.json) console.log(`  ${import_picocolors21.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
 `);
   for (; ; ) {
     await sleep2(1500);
@@ -284885,16 +285211,16 @@ async function logs(argv) {
     });
     if (!page) continue;
     for (const e2 of page.events) render2(e2, args.json);
-    const prev = (0, import_wire8.parseFeedCursor)(cursor);
-    const next = (0, import_wire8.parseFeedCursor)(page.cursor);
-    if (prev && next && (0, import_wire8.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
+    const prev = (0, import_wire9.parseFeedCursor)(cursor);
+    const next = (0, import_wire9.parseFeedCursor)(page.cursor);
+    if (prev && next && (0, import_wire9.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
   }
 }
 
 // src/webhooks.ts
 init_cjs_shims();
 var import_fs9 = require("fs");
-var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 var import_credentialPolicy4 = require("@abloatai/transaction/auth/credentialPolicy");
 init_config();
 init_theme();
@@ -284927,12 +285253,12 @@ function requireKey3(mode) {
   const apiKey = resolveApiKey(mode);
   if (!apiKey) {
     console.error(
-      import_picocolors21.default.red("  No API key.") + import_picocolors21.default.dim(` Run ${import_picocolors21.default.bold("ablo login")} or set ${import_picocolors21.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors22.default.red("  No API key.") + import_picocolors22.default.dim(` Run ${import_picocolors22.default.bold("ablo login")} or set ${import_picocolors22.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
   if ((0, import_credentialPolicy4.classifyCredentialKind)(apiKey) !== "secret") {
-    console.error(import_picocolors21.default.red("  Managing webhooks requires a secret key ") + import_picocolors21.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors22.default.red("  Managing webhooks requires a secret key ") + import_picocolors22.default.dim("(sk_test_ / sk_live_)."));
     process.exit(1);
   }
   return apiKey;
@@ -284948,12 +285274,12 @@ async function api(apiKey, method, path, body) {
     ...body ? { body: JSON.stringify(body) } : {}
   }).catch(() => null);
   if (!res) {
-    console.error(import_picocolors21.default.red(`  Couldn't reach ${baseUrl()}.`));
+    console.error(import_picocolors22.default.red(`  Couldn't reach ${baseUrl()}.`));
     process.exit(1);
   }
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    console.error(import_picocolors21.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
+    console.error(import_picocolors22.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
     process.exit(1);
   }
   return await res.json();
@@ -284975,11 +285301,11 @@ ${line}
   return file;
 }
 function printEndpoint(e2) {
-  const dot = e2.status === "enabled" ? import_picocolors21.default.green("\u25CF") : import_picocolors21.default.red("\u25CF");
-  const health = e2.last_error ? import_picocolors21.default.red(` last error: ${e2.last_error}`) : "";
-  console.log(`  ${dot} ${import_picocolors21.default.bold(e2.id)}  ${e2.url}`);
+  const dot = e2.status === "enabled" ? import_picocolors22.default.green("\u25CF") : import_picocolors22.default.red("\u25CF");
+  const health = e2.last_error ? import_picocolors22.default.red(` last error: ${e2.last_error}`) : "";
+  console.log(`  ${dot} ${import_picocolors22.default.bold(e2.id)}  ${e2.url}`);
   console.log(
-    import_picocolors21.default.dim(
+    import_picocolors22.default.dim(
       `      ${e2.status} \xB7 ${e2.environment} \xB7 events ${e2.enabled_events.join(",")} \xB7 cursor ${e2.cursor ?? "\u2014"}${health}`
     )
   );
@@ -284991,7 +285317,7 @@ async function webhooks(argv) {
   if (sub === "create") {
     const url = positional(rest);
     if (!url) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
@@ -285003,8 +285329,8 @@ async function webhooks(argv) {
     });
     const file = writeSecretToEnv(created.secret);
     console.log(`
-  ${import_picocolors21.default.green("\u2713")} Registered ${import_picocolors21.default.bold(created.id)} \u2192 ${created.url}`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Wrote ${import_picocolors21.default.bold(ENV_KEY)} to ${import_picocolors21.default.bold(file)} ${import_picocolors21.default.dim("(shown once)")}
+  ${import_picocolors22.default.green("\u2713")} Registered ${import_picocolors22.default.bold(created.id)} \u2192 ${created.url}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Wrote ${import_picocolors22.default.bold(ENV_KEY)} to ${import_picocolors22.default.bold(file)} ${import_picocolors22.default.dim("(shown once)")}
 `);
     return;
   }
@@ -285012,7 +285338,7 @@ async function webhooks(argv) {
     const apiKey = requireKey3(mode);
     const { data } = await api(apiKey, "GET", "");
     if (data.length === 0) {
-      console.log(import_picocolors21.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
+      console.log(import_picocolors22.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
       return;
     }
     console.log();
@@ -285023,40 +285349,40 @@ async function webhooks(argv) {
   if (sub === "roll") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     const rolled = await api(apiKey, "POST", `/${id}/roll_secret`);
     const file = writeSecretToEnv(rolled.secret);
     console.log(`
-  ${import_picocolors21.default.green("\u2713")} Rolled secret for ${import_picocolors21.default.bold(id)} \u2192 ${import_picocolors21.default.bold(file)} ${import_picocolors21.default.dim("(old secret now invalid)")}
+  ${import_picocolors22.default.green("\u2713")} Rolled secret for ${import_picocolors22.default.bold(id)} \u2192 ${import_picocolors22.default.bold(file)} ${import_picocolors22.default.dim("(old secret now invalid)")}
 `);
     return;
   }
   if (sub === "enable") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     const e2 = await api(apiKey, "POST", `/${id}/enable`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Re-enabled ${import_picocolors21.default.bold(e2.id)}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Re-enabled ${import_picocolors22.default.bold(e2.id)}`);
     return;
   }
   if (sub === "rm" || sub === "delete") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     await api(apiKey, "DELETE", `/${id}`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Removed ${import_picocolors21.default.bold(id)}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Removed ${import_picocolors22.default.bold(id)}`);
     return;
   }
-  console.log(`  ${import_picocolors21.default.bold("Usage:")}`);
+  console.log(`  ${import_picocolors22.default.bold("Usage:")}`);
   console.log(`    ${brand("ablo webhooks create <url>")}   Register an endpoint; writes ${ENV_KEY}`);
   console.log(`    ${brand("ablo webhooks list")}           List endpoints + delivery health`);
   console.log(`    ${brand("ablo webhooks roll <id>")}       Mint a fresh signing secret`);
@@ -285067,8 +285393,8 @@ async function webhooks(argv) {
 
 // src/check.ts
 init_cjs_shims();
-var import_errors16 = require("@abloatai/transaction/errors");
-var import_picocolors22 = __toESM(require_picocolors(), 1);
+var import_errors17 = require("@abloatai/transaction/errors");
+var import_picocolors23 = __toESM(require_picocolors(), 1);
 init_src();
 var import_schema9 = require("@abloatai/transaction/schema");
 init_push();
@@ -285215,7 +285541,7 @@ function parseCheckArgs(argv) {
         appSchema = argv[++i] ?? appSchema;
         break;
       default:
-        throw new import_errors16.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors17.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, appSchema };
@@ -285229,22 +285555,22 @@ function hostOf(connectionString) {
 }
 async function reportReadSubject(dbUrl) {
   const host = hostOf(dbUrl);
-  console.log(`  ${import_picocolors22.default.dim("reading")} ${import_picocolors22.default.bold(host ?? "your database")}`);
+  console.log(`  ${import_picocolors23.default.dim("reading")} ${import_picocolors23.default.bold(host ?? "your database")}`);
   const effective = resolveEffectiveApiKey();
   const state = await fetchDataSourceState(apiBaseUrl(), effective.key);
   if (state.kind === "unknown") {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("?")} ${import_picocolors22.default.dim(`couldn't ask which database Ablo reads (${state.detail})`)}
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("?")} ${import_picocolors23.default.dim(`couldn't ask which database Ablo reads (${state.detail})`)}
 `
     );
     return;
   }
   if (state.kind === "none") {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
     );
     console.log(
-      `           ${import_picocolors22.default.dim(`Connect it with ${import_picocolors22.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}
+      `           ${import_picocolors23.default.dim(`Connect it with ${import_picocolors23.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}
 `
     );
     return;
@@ -285252,15 +285578,15 @@ async function reportReadSubject(dbUrl) {
   const registered = [...new Set(state.hosts)];
   if (host && registered.length > 0 && !registered.includes(host)) {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("!")} Ablo reads ${import_picocolors22.default.bold(registered.join(", "))}`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} Ablo reads ${import_picocolors23.default.bold(registered.join(", "))}`
     );
     console.log(
-      `           ${import_picocolors22.default.dim("If that is this database under a pooled hostname, this is fine \u2014 otherwise the report below describes a database Ablo never reads.")}
+      `           ${import_picocolors23.default.dim("If that is this database under a pooled hostname, this is fine \u2014 otherwise the report below describes a database Ablo never reads.")}
 `
     );
     return;
   }
-  console.log(`  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.green("\u2713")} ${import_picocolors22.default.dim("reads this database")}
+  console.log(`  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.green("\u2713")} ${import_picocolors23.default.dim("reads this database")}
 `);
 }
 async function check(argv) {
@@ -285268,20 +285594,20 @@ async function check(argv) {
   try {
     args = parseCheckArgs(argv);
   } catch (err) {
-    console.error(import_picocolors22.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors23.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = readProjectAdminDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors22.default.red(`  No database.`) + import_picocolors22.default.dim(` Set ${import_picocolors22.default.bold(ADMIN_URL_VAR)} to the Postgres you want Ablo to adopt.`)
+      import_picocolors23.default.red(`  No database.`) + import_picocolors23.default.dim(` Set ${import_picocolors23.default.bold(ADMIN_URL_VAR)} to the Postgres you want Ablo to adopt.`)
     );
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const schemaJson = JSON.parse((0, import_schema9.serializeSchema)(schema));
   console.log(`
-  ${brand("ablo")} ${import_picocolors22.default.dim("check")}  ${import_picocolors22.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors23.default.dim("check")}  ${import_picocolors23.default.dim(`schema "${args.appSchema}"`)}
 `);
   await reportReadSubject(dbUrl);
   const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
@@ -285293,7 +285619,7 @@ async function check(argv) {
       [args.appSchema]
     );
   } catch (err) {
-    console.error(import_picocolors22.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors23.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -285315,7 +285641,7 @@ async function check(argv) {
     declaredTables.add(table);
     const present = colsByTable.get(table);
     if (!present) {
-      console.log(`  ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} table ${import_picocolors22.default.bold(table)} ${import_picocolors22.default.red("not found")}`);
+      console.log(`  ${import_picocolors23.default.red("\u2717")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} table ${import_picocolors23.default.bold(table)} ${import_picocolors23.default.red("not found")}`);
       errors++;
       continue;
     }
@@ -285337,26 +285663,26 @@ async function check(argv) {
       if (!present.has(col)) problems.push(`missing column "${col}" (field ${fieldName})`);
     }
     if (problems.length > 0) {
-      console.log(`  ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} ${table}`);
-      for (const p2 of problems) console.log(`      ${import_picocolors22.default.red("\u2022")} ${p2}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors22.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors23.default.red("\u2717")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} ${table}`);
+      for (const p2 of problems) console.log(`      ${import_picocolors23.default.red("\u2022")} ${p2}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors23.default.yellow("\u2022")} ${w2}`);
       errors++;
     } else if (warns.length > 0) {
-      console.log(`  ${import_picocolors22.default.yellow("!")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} ${table}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors22.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors23.default.yellow("!")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} ${table}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors23.default.yellow("\u2022")} ${w2}`);
       warnings++;
     } else {
-      console.log(`  ${import_picocolors22.default.green("\u2713")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
+      console.log(`  ${import_picocolors23.default.green("\u2713")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
     }
   }
   const modelCount = Object.keys(schemaJson.models).length;
   const ignored = [...colsByTable.keys()].filter((t) => !declaredTables.has(t)).length;
   console.log(
     `
-  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors22.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors22.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors22.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
+  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors23.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors23.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors23.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
   );
   if (ignored > 0) {
-    console.log(`  ${import_picocolors22.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
+    console.log(`  ${import_picocolors23.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
   }
   console.log();
   process.exit(errors > 0 ? 1 : 0);
@@ -285367,7 +285693,7 @@ init_dbRole();
 
 // src/upgrade.ts
 init_cjs_shims();
-var import_picocolors23 = __toESM(require_picocolors(), 1);
+var import_picocolors24 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -285445,7 +285771,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors23.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors24.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -285519,39 +285845,39 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors23.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors24.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors23.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors24.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors23.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors23.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors23.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors23.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors24.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors24.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors24.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors24.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors23.default.bold(import_picocolors23.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors24.default.bold(import_picocolors24.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors23.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors23.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors23.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors24.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors24.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors24.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors23.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors24.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors23.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors24.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/pull.ts
 init_cjs_shims();
-var import_errors17 = require("@abloatai/transaction/errors");
-var import_picocolors24 = __toESM(require_picocolors(), 1);
+var import_errors18 = require("@abloatai/transaction/errors");
+var import_picocolors25 = __toESM(require_picocolors(), 1);
 init_src();
 var import_fs10 = require("fs");
 init_theme();
@@ -285579,7 +285905,7 @@ function parsePullArgs(argv) {
         force = true;
         break;
       default:
-        throw new import_errors17.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors18.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { out, appSchema, importPath, force };
@@ -285649,56 +285975,56 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors24.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors25.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = readProjectAdminDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors24.default.red(`  No database.`) + import_picocolors24.default.dim(` Set ${import_picocolors24.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
+      import_picocolors25.default.red(`  No database.`) + import_picocolors25.default.dim(` Set ${import_picocolors25.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
     );
     process.exit(1);
   }
   if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors24.default.red(`  ${args.out} already exists.`) + import_picocolors24.default.dim(` Re-run with ${import_picocolors24.default.bold("--force")} to overwrite.`)
+      import_picocolors25.default.red(`  ${args.out} already exists.`) + import_picocolors25.default.dim(` Re-run with ${import_picocolors25.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors24.default.dim("pull")}  ${import_picocolors24.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors25.default.dim("pull")}  ${import_picocolors25.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors24.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors25.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors24.default.yellow(`  No adoptable tables found`) + import_picocolors24.default.dim(` (a model needs an ${import_picocolors24.default.bold("id")} + ${import_picocolors24.default.bold("organization_id")} column).`)
+      import_picocolors25.default.yellow(`  No adoptable tables found`) + import_picocolors25.default.dim(` (a model needs an ${import_picocolors25.default.bold("id")} + ${import_picocolors25.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors24.default.green("\u2713")} wrote ${import_picocolors24.default.bold(args.out)} ${import_picocolors24.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors24.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors25.default.green("\u2713")} wrote ${import_picocolors25.default.bold(args.out)} ${import_picocolors25.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors25.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors24.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors24.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors25.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors25.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors24.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors24.default.bold("ablo check")}.
+  ${import_picocolors25.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors25.default.bold("ablo check")}.
 `
   );
 }
 
 // src/prismaPull.ts
 init_cjs_shims();
-var import_errors18 = require("@abloatai/transaction/errors");
-var import_picocolors25 = __toESM(require_picocolors(), 1);
+var import_errors19 = require("@abloatai/transaction/errors");
+var import_picocolors26 = __toESM(require_picocolors(), 1);
 var import_fs11 = require("fs");
 init_theme();
 var DEFAULT_SCHEMA = "prisma/schema.prisma";
@@ -285895,7 +286221,7 @@ function parsePrismaPullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors18.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors19.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -285906,56 +286232,56 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors25.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!(0, import_fs11.existsSync)(args.schema)) {
     console.error(
-      import_picocolors25.default.red(`  No Prisma schema at ${import_picocolors25.default.bold(args.schema)}.`) + import_picocolors25.default.dim(` Pass a path: ${import_picocolors25.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors26.default.red(`  No Prisma schema at ${import_picocolors26.default.bold(args.schema)}.`) + import_picocolors26.default.dim(` Pass a path: ${import_picocolors26.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
   if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors25.default.red(`  ${args.out} already exists.`) + import_picocolors25.default.dim(` Re-run with ${import_picocolors25.default.bold("--force")} to overwrite.`)
+      import_picocolors26.default.red(`  ${args.out} already exists.`) + import_picocolors26.default.dim(` Re-run with ${import_picocolors26.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors25.default.dim("pull prisma")}  ${import_picocolors25.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors26.default.dim("pull prisma")}  ${import_picocolors26.default.dim(args.schema)}
 `);
   let result;
   try {
     const src = (0, import_fs11.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors25.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors26.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors25.default.yellow(`  No adoptable models found`) + import_picocolors25.default.dim(` (a model needs an ${import_picocolors25.default.bold("id")} + ${import_picocolors25.default.bold("organizationId")} / ${import_picocolors25.default.bold("organization_id")}).`)
+      import_picocolors26.default.yellow(`  No adoptable models found`) + import_picocolors26.default.dim(` (a model needs an ${import_picocolors26.default.bold("id")} + ${import_picocolors26.default.bold("organizationId")} / ${import_picocolors26.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
   (0, import_fs11.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors25.default.green("\u2713")} wrote ${import_picocolors25.default.bold(args.out)} ${import_picocolors25.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors25.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors26.default.green("\u2713")} wrote ${import_picocolors26.default.bold(args.out)} ${import_picocolors26.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors26.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors25.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors25.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors26.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors26.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors25.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors25.default.bold("ablo check")}.
+  ${import_picocolors26.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors26.default.bold("ablo check")}.
 `
   );
 }
 
 // src/drizzlePull.ts
 init_cjs_shims();
-var import_picocolors26 = __toESM(require_picocolors(), 1);
-var import_errors19 = require("@abloatai/transaction/errors");
+var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_errors20 = require("@abloatai/transaction/errors");
 var import_fs12 = require("fs");
 var import_path7 = require("path");
 init_theme();
@@ -286062,7 +286388,7 @@ function parseDrizzlePullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors19.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors20.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -286079,27 +286405,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors27.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors26.default.red(`  No Drizzle schema given.`) + import_picocolors26.default.dim(` Pass the module: ${import_picocolors26.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors27.default.red(`  No Drizzle schema given.`) + import_picocolors27.default.dim(` Pass the module: ${import_picocolors27.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
   if (!(0, import_fs12.existsSync)(args.schema)) {
-    console.error(import_picocolors26.default.red(`  No file at ${import_picocolors26.default.bold(args.schema)}.`));
+    console.error(import_picocolors27.default.red(`  No file at ${import_picocolors27.default.bold(args.schema)}.`));
     process.exit(1);
   }
   if ((0, import_fs12.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors26.default.red(`  ${args.out} already exists.`) + import_picocolors26.default.dim(` Re-run with ${import_picocolors26.default.bold("--force")} to overwrite.`)
+      import_picocolors27.default.red(`  ${args.out} already exists.`) + import_picocolors27.default.dim(` Re-run with ${import_picocolors27.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors26.default.dim("pull drizzle")}  ${import_picocolors26.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors27.default.dim("pull drizzle")}  ${import_picocolors27.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -286107,26 +286433,26 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors26.default.dim(` (install ${import_picocolors26.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors26.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors27.default.dim(` (install ${import_picocolors27.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors27.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors26.default.yellow(`  No adoptable tables found`) + import_picocolors26.default.dim(` (a table needs an ${import_picocolors26.default.bold("id")} + ${import_picocolors26.default.bold("organization_id")} column).`)
+      import_picocolors27.default.yellow(`  No adoptable tables found`) + import_picocolors27.default.dim(` (a table needs an ${import_picocolors27.default.bold("id")} + ${import_picocolors27.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs12.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors26.default.green("\u2713")} wrote ${import_picocolors26.default.bold(args.out)} ${import_picocolors26.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors26.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors27.default.green("\u2713")} wrote ${import_picocolors27.default.bold(args.out)} ${import_picocolors27.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors27.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors26.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors26.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors27.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors27.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors26.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors26.default.bold("ablo check")}.
+  ${import_picocolors27.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors27.default.bold("ablo check")}.
 `
   );
 }
@@ -286212,7 +286538,7 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
 
 // src/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors27.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors28.default.dim("sync engine")}
 `;
 var HANDLERS = {
   init: (argv) => init([...argv]),
@@ -286221,6 +286547,7 @@ var HANDLERS = {
   projects: (argv) => projects([...argv]),
   branch: (argv) => branches([...argv]),
   status: (argv) => status([...argv]),
+  whoami: (argv) => whoami([...argv]),
   doctor: () => doctor(),
   logs: (argv) => logs([...argv]),
   webhooks: (argv) => webhooks([...argv]),
@@ -286239,7 +286566,7 @@ async function runDev(argv) {
   const devArgs = [...argv];
   const oneShot = devArgs.includes("--no-watch");
   console.log(
-    import_picocolors27.default.dim(
+    import_picocolors28.default.dim(
       oneShot ? "  `ablo dev --no-watch` prepares this Git branch and pushes once." : "  `ablo dev` prepares this Git branch and watches the schema."
     )
   );
@@ -286260,13 +286587,13 @@ async function runPush2(argv) {
   const guard = guardActiveProjectKey();
   if (!guard.ok && guard.available.length > 0 && !rest.includes("--url")) {
     console.error(
-      `  ${import_picocolors27.default.yellow("\u26A0")} active project ${import_picocolors27.default.bold(guard.activeProfile)} has no stored key ${import_picocolors27.default.dim(
+      `  ${import_picocolors28.default.yellow("\u26A0")} active project ${import_picocolors28.default.bold(guard.activeProfile)} has no stored key ${import_picocolors28.default.dim(
         `(you have keys for: ${guard.available.join(", ")})`
       )}`
     );
     const loginCmd = guard.activeProfile === "default" ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
     console.error(
-      import_picocolors27.default.dim(`    Mint one with ${import_picocolors27.default.bold(loginCmd)}, or switch with ${import_picocolors27.default.bold("ablo projects use <slug>")}.`)
+      import_picocolors28.default.dim(`    Mint one with ${import_picocolors28.default.bold(loginCmd)}, or switch with ${import_picocolors28.default.bold("ablo projects use <slug>")}.`)
     );
     process.exitCode = 1;
     return;
@@ -286277,7 +286604,7 @@ async function runPush2(argv) {
 }
 function runRenamedSchema(argv) {
   const forwarded = argv.slice(1).join(" ");
-  console.error(`  ${import_picocolors27.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
+  console.error(`  ${import_picocolors28.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
   console.error(`    Run \`ablo push${forwarded ? " " + forwarded : ""}\` instead.`);
   process.exitCode = 1;
 }
@@ -286287,7 +286614,7 @@ async function main() {
   const argv = process.argv.slice(3);
   if (!command && raw !== void 0 && raw !== "help" && !raw.startsWith("-")) {
     const suggestion = suggestCommand(raw);
-    throw new import_errors20.AbloValidationError(
+    throw new import_errors21.AbloValidationError(
       `\`${raw}\` isn't an ablo command.` + (suggestion ? ` Did you mean \`ablo ${suggestion}\`?` : " Run `ablo help --all` to see every command."),
       { code: "cli_invalid_arguments" }
     );
@@ -286318,7 +286645,7 @@ function printCoreHelp() {
   const width = Math.max(...rows.map((r2) => r2.run.length)) + 4;
   console.log(LOGO);
   for (const group of CORE_GROUPS) {
-    console.log(`  ${import_picocolors27.default.bold(group)}`);
+    console.log(`  ${import_picocolors28.default.bold(group)}`);
     const printed = group === "More" ? [...coreRows(group), ...extra] : coreRows(group);
     for (const row of printed) console.log(`    npx ablo ${row.run.padEnd(width)}${row.does}`);
     console.log();
@@ -286327,7 +286654,7 @@ function printCoreHelp() {
 }
 function printSchemaReminder() {
   console.log(
-    import_picocolors27.default.dim(`  Edit ${import_picocolors27.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors27.default.yellow("server_execute_unknown_model") + import_picocolors27.default.dim(".")
+    import_picocolors28.default.dim(`  Edit ${import_picocolors28.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors28.default.yellow("server_execute_unknown_model") + import_picocolors28.default.dim(".")
   );
   console.log();
 }
@@ -286337,7 +286664,7 @@ function printFullHelp() {
   ) + 2;
   console.log(LOGO);
   for (const group of FULL_GROUPS) {
-    console.log(`  ${import_picocolors27.default.bold(group)}`);
+    console.log(`  ${import_picocolors28.default.bold(group)}`);
     for (const row of fullRows(group)) {
       console.log(row.does === void 0 ? `    ${" ".repeat(9)}${row.run}` : `    npx ablo ${row.run.padEnd(width)}${row.does}`);
     }
@@ -286392,7 +286719,7 @@ async function ensureInitProject(opts) {
   const ensured = await ensureProject(slug);
   if (ensured) {
     console.log(
-      `  ${import_picocolors27.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors27.default.bold(ensured.slug)} ${import_picocolors27.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
+      `  ${import_picocolors28.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors28.default.bold(ensured.slug)} ${import_picocolors28.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
     );
   }
 }
@@ -286434,7 +286761,7 @@ async function chooseBool(flagValue, fallback, interactive, prompt) {
 async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors27.default.dim("sync engine")}`);
+  Ie(`${brand("ablo")} ${import_picocolors28.default.dim("sync engine")}`);
   if (!(0, import_fs13.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
@@ -286512,7 +286839,7 @@ async function init(args = []) {
   if (pullExisting) {
     const dbUrl = readProjectAdminDatabaseUrl();
     if (!dbUrl) {
-      schemaNote = import_picocolors27.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
+      schemaNote = import_picocolors28.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -286522,12 +286849,12 @@ async function init(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors27.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors28.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors27.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors28.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors27.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors28.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
@@ -286551,9 +286878,9 @@ async function init(args = []) {
     const existing = (0, import_fs13.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
       (0, import_fs13.writeFileSync)(envFile, existing + "\n" + envBody);
-      created.push(`${envFile} ${import_picocolors27.default.dim("(appended)")}`);
+      created.push(`${envFile} ${import_picocolors28.default.dim("(appended)")}`);
     } else {
-      created.push(`${envFile} ${import_picocolors27.default.dim("(already configured)")}`);
+      created.push(`${envFile} ${import_picocolors28.default.dim("(already configured)")}`);
     }
   }
   if (agent) {
@@ -286569,17 +286896,17 @@ async function init(args = []) {
     }
     const providersPath = (0, import_path8.join)(layout.appBase, "providers.tsx");
     (0, import_fs13.writeFileSync)(providersPath, generateProviders());
-    created.push(`${providersPath} ${import_picocolors27.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    created.push(`${providersPath} ${import_picocolors28.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
     const sessionDir = (0, import_path8.join)(layout.appBase, "api", "ablo-session");
     (0, import_fs13.mkdirSync)(sessionDir, { recursive: true });
     (0, import_fs13.writeFileSync)((0, import_path8.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors27.default.dim("(wire your auth)")}`);
+    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors28.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
     (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
-  Me(created.map((f) => `${import_picocolors27.default.green("\u2713")} ${f}`).join("\n"), "Created");
+  Me(created.map((f) => `${import_picocolors28.default.green("\u2713")} ${f}`).join("\n"), "Created");
   const pm = detectPackageManager();
   if (opts.install) {
     const s = Y2();
@@ -286588,46 +286915,46 @@ async function init(args = []) {
       (0, import_child_process3.execSync)(`${pm} add @abloatai/ablo`, { stdio: "ignore" });
       s.stop("Installed @abloatai/ablo");
     } catch {
-      s.stop(`${import_picocolors27.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors27.default.bold(`${pm} install @abloatai/ablo`)}`);
+      s.stop(`${import_picocolors28.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors28.default.bold(`${pm} install @abloatai/ablo`)}`);
     }
   }
   const steps = [
-    `Run ${import_picocolors27.default.bold("npx ablo login")} to authorize branch management`,
-    `Set ${import_picocolors27.default.bold("DATABASE_URL")} in ${import_picocolors27.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors27.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Run ${import_picocolors28.default.bold("npx ablo login")} to authorize branch management`,
+    `Set ${import_picocolors28.default.bold("DATABASE_URL")} in ${import_picocolors28.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors28.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "replication" ? [
-      `Connect your database \u2014 ${import_picocolors27.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
-      `Verify it \u2014 ${import_picocolors27.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
-      `Register it \u2014 ${import_picocolors27.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
+      `Connect your database \u2014 ${import_picocolors28.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
+      `Verify it \u2014 ${import_picocolors28.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
+      `Register it \u2014 ${import_picocolors28.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
     ] : [
-      `Provision your DB: ${import_picocolors27.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors27.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors27.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors28.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors28.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors28.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors27.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors27.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors27.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors28.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors28.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors28.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
-    `Run ${import_picocolors27.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors28.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors27.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
-      `Run ${import_picocolors27.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors28.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
+      `Run ${import_picocolors28.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
   const existingKey = resolveManagementKey();
   if (existingKey) {
     await ensureInitProject(opts);
-    Se(`Already authorized ${import_picocolors27.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors27.default.bold("npx ablo dev")} next. ${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+    Se(`Already authorized ${import_picocolors28.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors28.default.bold("npx ablo dev")} next. ${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
     return;
   }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       await ensureInitProject(opts);
       return;
     }
   }
-  Se(`Run ${import_picocolors27.default.bold("npx ablo login")} when ready. ${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors28.default.bold("npx ablo login")} when ready. ${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
 }
 function generateSchema() {
   return `import { defineSchema, model, relation, z } from '@abloatai/ablo/schema';