@abloatai/cli 0.41.0 → 0.43.0

package/dist/cli.cjs

@@ -3047,23 +3047,28 @@ function readProjectWriteDatabaseUrl(cwd = process.cwd()) {
   return readProjectEnvValue("ABLO_WRITE_DATABASE_URL", cwd);
 }
 function readProjectEnvValue(variable, cwd) {
+  return readProjectEnvVariable(variable, cwd, false)?.value ?? null;
+}
+function readProjectEnvVariable(variable, cwd = process.cwd(), includeProcess = true) {
+  if (includeProcess && process.env[variable]) {
+    return { value: process.env[variable], source: "env" };
+  }
   for (const filename of [".env.local", ".env"]) {
     const path = (0, import_path.resolve)(cwd, filename);
     if (!(0, import_fs2.existsSync)(path)) continue;
     const match = new RegExp(`^${variable}=(.+)$`, "m").exec((0, import_fs2.readFileSync)(path, "utf8"));
-    if (match?.[1]) return match[1].trim().replace(/^["']|["']$/g, "");
+    if (match?.[1]) {
+      return {
+        value: match[1].trim().replace(/^["']|["']$/g, ""),
+        source: filename
+      };
+    }
   }
   return null;
 }
 function readProjectApiKey(cwd = process.cwd()) {
-  if (process.env.ABLO_API_KEY) return { key: process.env.ABLO_API_KEY, source: "env" };
-  for (const name of [".env.local", ".env"]) {
-    const path = (0, import_path.resolve)(cwd, name);
-    if (!(0, import_fs2.existsSync)(path)) continue;
-    const match = /^ABLO_API_KEY=(.+)$/m.exec((0, import_fs2.readFileSync)(path, "utf8"));
-    if (match?.[1]) return { key: match[1].trim().replace(/^["']|["']$/g, ""), source: name };
-  }
-  return null;
+  const found = readProjectEnvVariable("ABLO_API_KEY", cwd);
+  return found ? { key: found.value, source: found.source } : null;
 }
 var import_crypto2, import_fs2, import_path, REPLICATION_URL_VARS, ADMIN_URL_VAR;
 var init_dbRole = __esm({
@@ -3308,43 +3313,16 @@ function getKeyEntry(mode) {
   if (!cfg) return void 0;
   return cfg.profiles[activeProfileName(cfg)]?.[mode];
 }
+function getManagementKeyEntry() {
+  const cfg = readConfig();
+  if (!cfg) return void 0;
+  return cfg.profiles[activeProfileName(cfg)]?.management;
+}
 function modeFromKey(key) {
   if (/^(sk|rk)_test_/.test(key)) return "sandbox";
   if (/^(sk|rk)_live_/.test(key)) return "production";
   return void 0;
 }
-function prefix(key) {
-  return key ? key.slice(0, 12) : null;
-}
-function describeEffectiveKey(activeMode, envKey, storedEntry) {
-  const effectiveKey = envKey ?? storedEntry?.apiKey;
-  const keySource = envKey ? "env" : storedEntry ? "stored" : null;
-  const keyMode = effectiveKey ? modeFromKey(effectiveKey) ?? null : null;
-  const keyMatchesActiveMode = keyMode ? keyMode === activeMode : null;
-  const keyMatchesStoredActiveKey = envKey && storedEntry?.apiKey ? envKey === storedEntry.apiKey : null;
-  let keyMismatch = null;
-  if (keyMode && keyMode !== activeMode) {
-    const sourceLabel = envKey ? "ABLO_API_KEY" : "stored active key";
-    keyMismatch = {
-      code: "key_mode_mismatch",
-      message: `${sourceLabel} is a ${keyMode} key but the CLI mode is ${activeMode}. Requests use ${sourceLabel} (${prefix(effectiveKey)}...), not the active CLI mode.`
-    };
-  } else if (envKey && storedEntry?.apiKey && envKey !== storedEntry.apiKey) {
-    keyMismatch = {
-      code: "env_key_overrides_stored",
-      message: `ABLO_API_KEY (${prefix(envKey)}...) overrides the stored ${activeMode} key (${prefix(storedEntry.apiKey)}...).`
-    };
-  }
-  return {
-    keyPrefix: prefix(effectiveKey),
-    keySource,
-    keyMode,
-    storedKeyPrefix: prefix(storedEntry?.apiKey),
-    keyMatchesActiveMode,
-    keyMatchesStoredActiveKey,
-    keyMismatch
-  };
-}
 function normalizeMode(value) {
   return normalizeStoredMode(value);
 }
@@ -3358,9 +3336,14 @@ function clearCredential() {
   }
   return removed;
 }
-function resolveApiKey(modeOverride) {
+function resolveMutationApiKey(modeOverride) {
   return resolveKey({ purpose: "data", mode: modeOverride }).key;
 }
+function ambientEnvKeyNote(cwd) {
+  const ambient = readProjectApiKey(cwd);
+  if (!ambient || ambient.source === "env") return null;
+  return `Note: ${ambient.source} in this directory holds an ABLO_API_KEY, which this command does not load \u2014 it reads only the process environment and your stored login, so a file cannot silently choose a branch. Export the variable, or pass \`--env-file ` + ambient.source + "` to a connect command, to choose it explicitly.";
+}
 function resolveManagementKey() {
   if (process.env.ABLO_MANAGEMENT_KEY) return process.env.ABLO_MANAGEMENT_KEY;
   const cfg = readConfig();
@@ -3388,7 +3371,7 @@ function resolveOrgManagementKey() {
   return void 0;
 }
 function guardActiveProjectKey() {
-  const { key, source } = resolveEffectiveApiKey();
+  const { key, source } = resolveRuntimeApiKey();
   if (key != null && source != null && source !== "stored") {
     return { ok: true, activeProfile: DEFAULT_PROFILE, available: [] };
   }
@@ -3421,16 +3404,9 @@ function resolveKey(policy) {
   }
   return { key: void 0, source: null };
 }
-function resolveEffectiveApiKey(modeOverride, cwd) {
+function resolveRuntimeApiKey(modeOverride, cwd) {
   return resolveKey({ purpose: "data", mode: modeOverride, scanEnvFiles: true, cwd });
 }
-function resolvePushPlan() {
-  const { key, source } = resolveEffectiveApiKey();
-  if (key != null && source != null && source !== "stored") {
-    return { flow: modeFromKey(key) ?? getMode(), apiKey: key, source };
-  }
-  return { flow: getMode(), apiKey: key, source };
-}
 var import_os2, import_path2, import_fs3, DEFAULT_PROFILE;
 var init_config = __esm({
   "src/config.ts"() {
@@ -3767,13 +3743,14 @@ async function confirmFromServer(opts) {
     const project = projectId ? await nameProject(projectId, identity.accountScope, opts) : null;
     return {
       organizationId: identity.accountScope,
-      environment: keyEnv,
+      environment: identity.branchRoot === void 0 ? keyEnv : identity.branchRoot ? "production" : "sandbox",
       project,
       projectId,
       branchId: identity.branchId ?? null,
       branchRoot: identity.branchRoot
     };
-  } catch {
+  } catch (error) {
+    if (opts.strict) throw error;
     return null;
   }
 }
@@ -4017,6 +3994,7 @@ function parsePushArgs(argv) {
   let force = false;
   let yes = false;
   let dryRun = false;
+  let envFile;
   const renames = [];
   const backfills = [];
   for (let i = 0; i < argv.length; i++) {
@@ -4031,6 +4009,9 @@ function parsePushArgs(argv) {
       case "--url":
         url = argv[++i] ?? url;
         break;
+      case "--env-file":
+        envFile = argv[++i] ?? envFile;
+        break;
       case "--force":
         force = true;
         break;
@@ -4072,7 +4053,18 @@ function parsePushArgs(argv) {
     }
   }
   url = url.replace(/\/+$/, "");
-  return { schemaPath, exportName, url, apiKey: process.env.ABLO_API_KEY, force, renames, backfills, yes, dryRun };
+  return {
+    schemaPath,
+    exportName,
+    url,
+    apiKey: process.env.ABLO_API_KEY,
+    ...envFile ? { envFile } : {},
+    force,
+    renames,
+    backfills,
+    yes,
+    dryRun
+  };
 }
 function publicationGap(value) {
   if (typeof value !== "object" || value === null) return null;
@@ -4173,8 +4165,21 @@ function printPlan(local, remote) {
   console.log("");
 }
 async function confirmPush(args, target) {
-  const env = target.confirmed?.environment ?? target.keyEnv;
-  const isProd = env === "production";
+  const confirmedRoot = target.confirmed?.branchRoot;
+  const legacyEnv = target.keyEnv;
+  if (confirmedRoot === void 0 && legacyEnv === null) {
+    console.error(
+      `  ${import_picocolors5.default.red("\u2717")} Refusing to deploy because the server did not confirm which branch this key targets.`
+    );
+    console.error(
+      import_picocolors5.default.dim(
+        `    Current ${import_picocolors5.default.bold("sk_")} keys do not encode live/test state. Check connectivity with ${import_picocolors5.default.bold("ablo whoami")} and retry; the CLI will not guess for a write.`
+      )
+    );
+    process.exit(1);
+    return;
+  }
+  const isProd = confirmedRoot ?? legacyEnv === "production";
   const tty = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   if (isProd && !args.yes) {
     if (!tty) {
@@ -4197,7 +4202,10 @@ async function confirmPush(args, target) {
     return;
   }
   if (!isProd && !args.yes && tty) {
-    const ok = await ye({ message: `Apply to ${import_picocolors5.default.bold("sandbox")}?` });
+    const branch = target.confirmed?.branchId;
+    const ok = await ye({
+      message: `Apply to development branch${branch ? ` ${import_picocolors5.default.bold(branch)}` : ""}?`
+    });
     if (pD(ok) || !ok) {
       xe("Aborted.");
       process.exit(1);
@@ -4206,8 +4214,7 @@ async function confirmPush(args, target) {
 }
 function printPushTarget(target, schema) {
   const confirmed = target.confirmed;
-  const env = confirmed?.environment ?? target.keyEnv;
-  const envLabel = env === "production" ? import_picocolors5.default.bold("production") : env === "sandbox" ? import_picocolors5.default.bold("sandbox") : import_picocolors5.default.yellow("unknown env");
+  const branchLabel = confirmed?.branchRoot === true ? import_picocolors5.default.bold("production root") : confirmed?.branchId ? `${import_picocolors5.default.bold("branch")} ${import_picocolors5.default.bold(confirmed.branchId)}` : target.keyEnv === "production" ? `${import_picocolors5.default.bold("production root")} ${import_picocolors5.default.yellow("(legacy key; unconfirmed)")}` : target.keyEnv === "sandbox" ? `${import_picocolors5.default.bold("development branch")} ${import_picocolors5.default.yellow("(legacy key; unconfirmed)")}` : import_picocolors5.default.red("unknown branch");
   let projectLabel;
   if (confirmed?.project) {
     const p2 = confirmed.project;
@@ -4220,7 +4227,7 @@ function printPushTarget(target, schema) {
     projectLabel = `${shown} ${import_picocolors5.default.yellow("(unconfirmed \u2014 server did not answer)")}`;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("push")} ${import_picocolors5.default.dim("\u2192")} ${envLabel}`);
+  ${brand("ablo")} ${import_picocolors5.default.dim("push")} ${import_picocolors5.default.dim("\u2192")} ${branchLabel}`);
   if (confirmed?.organizationId) console.log(`  ${import_picocolors5.default.dim("org")}      ${import_picocolors5.default.dim(confirmed.organizationId)}`);
   console.log(`  ${import_picocolors5.default.dim("project")}  ${projectLabel}`);
   console.log(`  ${import_picocolors5.default.dim("target")}   ${import_picocolors5.default.dim(target.url)}`);
@@ -4249,6 +4256,8 @@ function describeKeySource(source) {
       return ".env";
     case "stored":
       return "ablo login";
+    case "explicit-file":
+      return "--env-file";
   }
 }
 async function push(argv) {
@@ -4259,16 +4268,29 @@ async function push(argv) {
     console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
+  if (args.envFile) {
+    try {
+      process.loadEnvFile(args.envFile);
+    } catch (error) {
+      throw new import_errors6.AbloValidationError(
+        `could not load --env-file ${args.envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+    args.apiKey = process.env.ABLO_API_KEY;
+  }
   let keySource = "env";
   if (!args.apiKey) {
-    const resolved = resolveEffectiveApiKey();
-    args.apiKey = resolved.key;
-    keySource = resolved.source ?? "stored";
+    args.apiKey = resolveMutationApiKey();
+    keySource = args.apiKey ? "stored" : "env";
+  } else if (args.envFile) {
+    keySource = "explicit-file";
   }
   if (!args.apiKey) {
+    const ambient = ambientEnvKeyNote();
     console.error(
       import_picocolors5.default.red(`  No API key.`) + import_picocolors5.default.dim(
-        ` Run ${import_picocolors5.default.bold("npx ablo login")} \u2014 or set ${import_picocolors5.default.bold("ABLO_API_KEY")} (${import_picocolors5.default.bold("sk_test_")} = sandbox; ${import_picocolors5.default.bold("sk_live_")} = production).`
+        ` Run ${import_picocolors5.default.bold("ablo login")}, or set ${import_picocolors5.default.bold("ABLO_API_KEY")} to a branch-bound ${import_picocolors5.default.bold("sk_")} credential.` + (ambient ? ` A project env file contains one; select it explicitly with ${import_picocolors5.default.bold("npx ablo push --env-file .env.local")}.` : "")
       )
     );
     process.exit(1);
@@ -4405,19 +4427,19 @@ async function push(argv) {
     } else if (code === "schema_provisioning_forbidden") {
       console.error(
         import_picocolors5.default.dim(
-          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors5.default.bold("npx ablo connect register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
+          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors5.default.bold("npx ablo connect register")}, and pushes to that branch record the schema as metadata only \u2014 no tables are created anywhere.`
         )
       );
     } else if (args.apiKey != null && (0, import_credentialPolicy.classifyCredentialKind)(args.apiKey) === "restricted") {
       console.error(
         import_picocolors5.default.dim(
-          `  Schema pushes need a SECRET key: ${import_picocolors5.default.bold("sk_test_")} (sandbox dev loop) or a dashboard ${import_picocolors5.default.bold("sk_live_")} (production deploy: ${import_picocolors5.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")}).`
+          `  Schema pushes need a branch-bound SECRET ${import_picocolors5.default.bold("sk_")} key. Use ${import_picocolors5.default.bold("ablo dev")} for a development child or ${import_picocolors5.default.bold("ablo push")} with a root-bound key for production.`
         )
       );
     } else {
       console.error(
         import_picocolors5.default.dim(
-          `  This key isn't authorized to push schema (needs ${import_picocolors5.default.bold("schema:push")}). ` + (keySource === "stored" ? `It's your stored ${import_picocolors5.default.bold("ablo login")} sandbox key \u2014 a key in ${import_picocolors5.default.bold(".env.local")} or ${import_picocolors5.default.bold("ABLO_API_KEY")} takes precedence, so put a schema:push key there (sandbox ${import_picocolors5.default.bold("sk_test_")} or production ${import_picocolors5.default.bold("sk_live_")}) and re-push. ` : `Use a schema:push key \u2014 a sandbox ${import_picocolors5.default.bold("sk_test_")} or production ${import_picocolors5.default.bold("sk_live_")}. `) + `Manage keys at https://abloatai.com`
+          `  This key isn't authorized to push schema (needs ${import_picocolors5.default.bold("schema:push")}). ` + (keySource === "stored" ? `The stored login is management-only. Put a branch-bound ${import_picocolors5.default.bold("sk_")} key with ${import_picocolors5.default.bold("schema:push")} in ${import_picocolors5.default.bold(".env.local")} or ${import_picocolors5.default.bold("ABLO_API_KEY")} and retry. ` : `Use a branch-bound ${import_picocolors5.default.bold("sk_")} key with ${import_picocolors5.default.bold("schema:push")}. `) + `Manage keys at https://abloatai.com`
         )
       );
     }
@@ -4426,7 +4448,7 @@ async function push(argv) {
   }
   process.exit(1);
 }
-var import_picocolors5, import_errors6, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, import_schema2, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT;
+var import_picocolors5, import_errors6, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, import_schema2, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT, PUSH_USAGE;
 var init_push = __esm({
   "src/push.ts"() {
     "use strict";
@@ -4447,6 +4469,26 @@ var init_push = __esm({
     import_schema2 = require("@abloatai/transaction/coordination/schema");
     DEFAULT_SCHEMA_PATH = "ablo/schema.ts";
     DEFAULT_EXPORT = "schema";
+    PUSH_USAGE = `  ablo push \u2014 upload a schema to one confirmed branch
+
+  Usage:
+    npx ablo push
+    npx ablo push --env-file .env.production --yes
+    npx ablo push --dry-run
+
+  Credential:
+    ABLO_API_KEY          Branch-bound sk_ key from the process environment
+    --env-file <path>     Explicitly load ABLO_API_KEY from a dotenv file
+
+  Safety:
+    --yes, -y             Confirm non-interactively (required for the production root)
+    --dry-run, --plan     Show target and schema diff without applying
+    --force               Allow destructive schema changes
+    --rename old:new      Record a model rename
+    --backfill m.f=value  Seed existing rows for a new required field
+
+  The server confirms the key's project and branch. Current keys do not encode
+  live/test state, and push never guesses a branch from their spelling.`;
   }
 });
 
@@ -4971,8 +5013,8 @@ __export(disconnect_exports, {
 function planeLabel(target) {
   const confirmed = target.confirmed;
   const project = confirmed?.project?.name ?? confirmed?.project?.slug ?? confirmed?.projectId ?? "the default project";
-  const env = confirmed?.environment ?? target.keyEnv ?? "unknown environment";
-  return { project, env };
+  const branch = confirmed?.branchRoot === true ? "production root" : confirmed?.branchId ? `branch ${confirmed.branchId}` : target.keyEnv === "production" ? "production root (legacy key; unconfirmed)" : target.keyEnv === "sandbox" ? "development branch (legacy key; unconfirmed)" : "unknown branch";
+  return { project, branch };
 }
 async function deregisterDataSource(opts) {
   try {
@@ -4989,7 +5031,7 @@ async function deregisterDataSource(opts) {
     if (err instanceof import_errors8.AbloError && err.code === "entity_not_found") return { removed: false };
     if (err instanceof import_errors8.AbloError && err.code === "forbidden") {
       throw new import_errors8.AbloPermissionError(
-        `${err.message}. Disconnecting needs a secret key (sk_\u2026) \u2014 run \`ablo login\` to store one.`,
+        `${err.message}. Disconnecting needs a branch-bound secret key (sk_\u2026).`,
         {
           code: "forbidden",
           ...err.requestId !== void 0 ? { requestId: err.requestId } : {}
@@ -4999,7 +5041,7 @@ async function deregisterDataSource(opts) {
     throw err;
   }
 }
-function renderDisconnected(response, project, envLabel) {
+function renderDisconnected(response, project, branchLabel) {
   const parts = [];
   if (response.cleared.direct) parts.push("the direct database registration");
   if (response.cleared.endpoints > 0) {
@@ -5010,7 +5052,7 @@ function renderDisconnected(response, project, envLabel) {
   const what = parts.length > 0 ? parts.join(" and ") : "the data source";
   console.log(
     `
-  ${import_picocolors8.default.green("\u2713")} Disconnected ${what} for ${import_picocolors8.default.bold(project)} in ${envLabel}. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.
+  ${import_picocolors8.default.green("\u2713")} Disconnected ${what} for ${import_picocolors8.default.bold(project)} on ${branchLabel}. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.
 `
   );
   const slot = response.replication_slot;
@@ -5019,14 +5061,27 @@ function renderDisconnected(response, project, envLabel) {
       `  ${import_picocolors8.default.yellow("!")} ${slot.warning ?? `The replication slot ${import_picocolors8.default.bold(slot.slot)} is still on your database and still holding your write-ahead log. Remove it yourself \u2014 nothing will release it now.`}`
     );
     if (slot.detail) console.log(import_picocolors8.default.dim(`      ${slot.detail}`));
-    if (slot.remove_with) console.log(`      ${import_picocolors8.default.bold(slot.remove_with)}`);
+    console.log(
+      import_picocolors8.default.dim(
+        `      Moving this database to another branch? Keep the roles and slot; run ${import_picocolors8.default.bold("ablo connect rotate --env-file .env.local --yes")} to re-key and reuse them.`
+      )
+    );
+    if (slot.remove_with) {
+      console.log(import_picocolors8.default.dim("      Not reconnecting this database? Remove the unused slot in your SQL editor:"));
+      console.log(`      ${import_picocolors8.default.bold(slot.remove_with)}`);
+    }
     console.log();
   }
 }
 async function disconnect(argv) {
   let skipConfirm = false;
-  for (const arg of argv) {
+  let envFile;
+  let keyEnv;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
     if (arg === "--yes" || arg === "-y") skipConfirm = true;
+    else if (arg === "--env-file") envFile = argv[++i];
+    else if (arg === "--key-env") keyEnv = argv[++i];
     else if (arg === "--help" || arg === "-h") {
       console.log(DISCONNECT_USAGE);
       return;
@@ -5042,19 +5097,39 @@ async function disconnect(argv) {
   ${brand("ablo")} ${import_picocolors8.default.dim("connect deregister")}  ${import_picocolors8.default.dim("remove this project's data source")}
 `
   );
-  const resolved = resolveEffectiveApiKey();
+  if (envFile) {
+    try {
+      process.loadEnvFile(envFile);
+    } catch (error) {
+      throw new import_errors8.AbloValidationError(
+        `could not load --env-file ${envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+  }
+  const selected = keyEnv ? readProjectEnvVariable(keyEnv) : null;
+  if (keyEnv && !selected) {
+    throw new import_errors8.AbloAuthenticationError(
+      `No value named ${keyEnv} was found in the process environment, .env.local, or .env.`,
+      { code: "cli_api_key_missing" }
+    );
+  }
+  const resolved = selected ? { key: selected.value, source: selected.source } : {
+    key: resolveMutationApiKey(),
+    source: envFile ? "explicit-file" : process.env.ABLO_API_KEY ? "env" : "stored"
+  };
   const apiKey = resolved.key;
   const keySource = resolved.source ?? "stored";
   if (!apiKey) {
     throw new import_errors8.AbloAuthenticationError(
-      "Disconnecting needs an API key, and none was found. Run `ablo login` (or set ABLO_API_KEY), then re-run `ablo connect deregister`.",
+      "Disconnecting needs a branch-bound sk_ key. Set ABLO_API_KEY, pass `--env-file .env.local`, or select a named recovery key with `--key-env <NAME>`.",
       { code: "cli_api_key_missing" }
     );
   }
   const apiUrl3 = apiBaseUrl();
   const target = await resolveTarget({ url: apiUrl3, apiKey, keySource });
-  const { project, env } = planeLabel(target);
-  const envLabel = env === "production" ? import_picocolors8.default.yellow(env) : import_picocolors8.default.dim(env);
+  const { project, branch } = planeLabel(target);
+  const branchLabel = target.confirmed?.branchRoot ? import_picocolors8.default.yellow(branch) : import_picocolors8.default.dim(branch);
   const divergence = describeMismatches(target.mismatches);
   if (divergence) console.log(`  ${import_picocolors8.default.yellow("\u26A0")}  ${divergence}
 `);
@@ -5066,7 +5141,7 @@ async function disconnect(argv) {
       );
     }
     const proceed = await ye({
-      message: `Disconnect the data source for ${import_picocolors8.default.bold(project)} in ${envLabel}?`,
+      message: `Disconnect the data source for ${import_picocolors8.default.bold(project)} on ${branchLabel}?`,
       initialValue: true
     });
     if (pD(proceed) || !proceed) {
@@ -5077,11 +5152,11 @@ async function disconnect(argv) {
   }
   const outcome = await deregisterDataSource({ apiKey });
   if (!outcome.removed) {
-    console.log(import_picocolors8.default.dim(`  No data source registered for ${project} in ${env}.
+    console.log(import_picocolors8.default.dim(`  No data source registered for ${project} on ${branch}.
 `));
     return;
   }
-  renderDisconnected(outcome.response, project, envLabel);
+  renderDisconnected(outcome.response, project, branchLabel);
 }
 var import_picocolors8, import_errors8, import_wire4, DISCONNECT_USAGE;
 var init_disconnect = __esm({
@@ -5093,6 +5168,7 @@ var init_disconnect = __esm({
     import_errors8 = require("@abloatai/transaction/errors");
     import_wire4 = require("@abloatai/transaction/wire");
     init_config();
+    init_dbRole();
     init_controlPlane();
     init_theme();
     init_target();
@@ -5101,9 +5177,10 @@ var init_disconnect = __esm({
   Usage
     npx ablo connect deregister          Remove the active project's data source (confirms first)
     npx ablo connect deregister --yes    Skip the confirmation
+    npx ablo connect deregister --key-env OLD_KEY_NAME --yes
 
-  Acts on one plane \u2014 the active project (${import_picocolors8.default.bold("ablo projects use")}) in the key's
-  environment (its ${import_picocolors8.default.bold("sk_test_")}/${import_picocolors8.default.bold("sk_live_")} prefix), shown before it runs. Removes the registration and
+  Acts on exactly the server-confirmed project and branch bound to the key, shown
+  before it runs. Removes the registration and
   Ablo's replication state for that plane, so Ablo stops reading and writing the
   database. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.`;
   }
@@ -5600,7 +5677,8 @@ function rotateWithoutConnection(input) {
     return "Ablo did not accept this API key, so it cannot be told about a new password. Rotate changes the password in your database first, so running it with a key Ablo refuses would leave the database on a password nobody holds.";
   }
   if (!input.known || input.planeHasConnection) return null;
-  return "This plane has no connected database, so there is no credential to re-key. Rotate changes the password in your database before Ablo can be told about it, so running it here would leave the database on a password Ablo never receives.";
+  if (input.existingRoles.length > 0) return null;
+  return "This plane has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
 }
 async function locateExistingConnection(input) {
   const result = await tryControlPlane({
@@ -5678,7 +5756,7 @@ async function executePlan(sql, steps, rebuildPlaintext) {
 async function runConnectApply(args) {
   const rotating = args.rotate;
   const verb = rotating ? "connect rotate" : "connect apply";
-  const adminUrl = args.url ?? readProjectAdminDatabaseUrl();
+  let adminUrl = args.url ?? readProjectAdminDatabaseUrl();
   if (!adminUrl) {
     throw new import_errors9.AbloValidationError(
       "No admin connection string. Pass --url <admin-conn> (or set DATABASE_URL) and re-run.",
@@ -5692,15 +5770,22 @@ async function runConnectApply(args) {
     target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
   } catch {
   }
-  const apiKey = resolveApiKey();
+  const apiKey = resolveMutationApiKey();
   if (!apiKey) {
     const loggedIn = resolveManagementKey() !== void 0;
+    const ambient = ambientEnvKeyNote();
+    const retry = `npx ablo connect ${rotating ? "rotate" : "apply"} --env-file .env.local --yes`;
     throw new import_errors9.AbloAuthenticationError(
-      loggedIn ? `You are logged in, but this project has no ${getMode()} data key.
+      loggedIn ? `You are logged in, but connect needs a branch-bound runtime key.
+
+Logging in stores an mk_ management credential; it can manage branches but cannot read, write, or register a database. Set ABLO_API_KEY to the sk_ key for the exact branch this database should join. The server confirms whether that branch is the production root or a development child; the CLI does not infer it from the key spelling.${ambient ? `
 
-The key is looked for in ABLO_API_KEY, then in the credential stored for the active project in the active mode (${getMode()}). Logging in stores a management credential, which administers the project but cannot register a database \u2014 and a key for another mode is never used implicitly, so registering against production takes an explicit production key.
+${ambient}
 
-Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the plane this database should join (its sk_live_ key for production).` : "Not logged in, and no ABLO_API_KEY is set. Run `ablo login` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.",
+Use it explicitly with:
+  ${retry}` : ""}` : `Not logged in, and no ABLO_API_KEY is set. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -5715,23 +5800,39 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
   );
   const pooledAdmin = detectPooler(adminUrl);
   if (pooledAdmin?.confidence === "host") {
-    console.error(
-      `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(target)} is a connection pooler, not the database.
+    if (pooledAdmin.direct) {
+      adminUrl = pooledAdmin.direct;
+      const pooledLabel = target;
+      try {
+        const parsed = new URL(adminUrl);
+        target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+      } catch {
+      }
+      console.log(
+        `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(pooledLabel)} is a connection pooler, so this run uses the direct host:
+    ${import_picocolors11.default.bold(target)}
+` + import_picocolors11.default.dim(
+          `    A pooler terminates the session, so replication cannot run over it. Your app
+    keeps the pooled URL; the setup needs the database itself.
 `
-    );
-    console.error(
-      import_picocolors11.default.dim(
-        `    A pooler terminates the session, so replication cannot run over it. Setting up
-    through it creates roles that Ablo then cannot use to stream.
+        )
+      );
+    } else {
+      console.error(
+        `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(target)} is a connection pooler, not the database.
 `
-      )
-    );
-    console.error(
-      pooledAdmin.direct ? `    Re-run against the direct host: ${import_picocolors11.default.bold(pooledAdmin.direct)}
-` : `    Re-run against the direct database host, not the pooled one.
+      );
+      console.error(
+        import_picocolors11.default.dim(
+          `    A pooler terminates the session, so replication cannot run over it. Setting up
+    through it creates roles that Ablo then cannot use to stream.
 `
-    );
-    process.exit(1);
+        )
+      );
+      console.error(`    Re-run against the direct database host, not the pooled one.
+`);
+      process.exit(1);
+    }
   }
   if (pooledAdmin?.confidence === "port") {
     console.log(
@@ -5771,31 +5872,31 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
 `);
     console.error(
       import_picocolors11.default.dim(`    Your database is untouched.
-`) + `  To move it here, disconnect it there first with ${import_picocolors11.default.cyan("ablo connect deregister")}.
-`
+`) + `  To move it here, disconnect it there first with ${import_picocolors11.default.cyan("ablo connect deregister")}
+` + import_picocolors11.default.dim(`  (run with a key for that plane). Match the project id to a name with `) + import_picocolors11.default.bold("ablo projects list --json") + import_picocolors11.default.dim(".") + "\n"
     );
     process.exit(1);
   }
+  let rotatePlane = null;
   if (rotating) {
     const state = await fetchDataSourceState(apiBaseUrl(), apiKey).catch(
       () => ({ kind: "unknown", detail: "unreachable" })
     );
-    const refusal = rotateWithoutConnection({
-      rotating,
+    rotatePlane = {
       planeHasConnection: state.kind === "connected",
       known: state.kind !== "unknown",
       // 401/403 is Ablo answering and declining the key, not a network failure.
       keyRejected: state.kind === "unknown" && /HTTP 40[13]/.test(state.detail)
-    });
-    if (refusal) {
-      console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
+    };
+    if (rotatePlane.keyRejected) {
+      const refusal = rotateWithoutConnection({ rotating, ...rotatePlane, existingRoles: [] });
+      if (refusal) {
+        console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
 `);
-      console.error(
-        import_picocolors11.default.dim(`    Your database is untouched.
-`) + `  Connect it instead:  ${import_picocolors11.default.cyan("npx ablo connect apply")}
-`
-      );
-      process.exit(1);
+        console.error(import_picocolors11.default.dim(`    Your database is untouched.
+`));
+        process.exit(1);
+      }
     }
   }
   const admin = src_default(adminUrl, {
@@ -5855,9 +5956,21 @@ Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the
   const pubReconcile = reconcilePublicationPlan(existingPublication, tables);
   const role = args.role && args.role.length > 0 ? args.role : import_footprint.ABLO_REPLICATION_ROLE;
   const writeRole = args.writeRole && args.writeRole.length > 0 ? args.writeRole : import_footprint.ABLO_WRITE_ROLE;
+  const existingRoles = await presentRoles(admin, [role, writeRole]).catch(() => []);
+  if (rotatePlane) {
+    const refusal = rotateWithoutConnection({ rotating, ...rotatePlane, existingRoles });
+    if (refusal) {
+      await admin.end({ timeout: 2 });
+      console.error(`  ${import_picocolors11.default.yellow("!")} ${refusal}
+`);
+      console.error(import_picocolors11.default.dim(`    Your database is untouched.
+`));
+      process.exit(1);
+    }
+  }
   const blocker = reapplyBlocker({
     rotating,
-    existingRoles: await presentRoles(admin, [role, writeRole]).catch(() => [])
+    existingRoles
   });
   if (blocker) {
     await admin.end({ timeout: 2 });
@@ -6077,9 +6190,11 @@ function parseConnectArgs(argv) {
   let apply = false;
   let rotate = false;
   let url;
+  let envFile;
   let yes = false;
   let showSql = false;
   let scan = false;
+  let locate = false;
   let manual = false;
   let tables = [];
   let role = import_footprint.ABLO_REPLICATION_ROLE;
@@ -6104,9 +6219,12 @@ function parseConnectArgs(argv) {
       case "scan":
         scan = true;
         break;
+      case "locate":
+        locate = true;
+        break;
       default:
         throw new import_errors10.AbloValidationError(
-          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan)`,
+          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan, locate)`,
           { code: "cli_invalid_arguments" }
         );
     }
@@ -6118,6 +6236,9 @@ function parseConnectArgs(argv) {
       case "--url":
         url = argv[++i] ?? url;
         break;
+      case "--env-file":
+        envFile = argv[++i] ?? envFile;
+        break;
       case "--yes":
       case "-y":
         yes = true;
@@ -6165,9 +6286,11 @@ function parseConnectArgs(argv) {
     apply,
     rotate,
     url,
+    envFile,
     yes,
     showSql,
     scan,
+    locate,
     tables,
     role,
     writeRole,
@@ -6463,10 +6586,13 @@ async function runCheck() {
   ${brand("ablo")} ${import_picocolors12.default.dim("connect check")}  ${import_picocolors12.default.dim("direct-write + WAL readiness")}
 `
   );
-  const apiKey = resolveApiKey();
+  const apiKey = resolveRuntimeApiKey().key;
   if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      "No API key found. Run `ablo login` (or set ABLO_API_KEY), then re-run `ablo connect check`.",
+      `No branch-bound runtime key found. Set ABLO_API_KEY to the sk_ key for the branch to check, or pass \`--env-file .env.local\` explicitly.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -6529,10 +6655,13 @@ async function runCheck() {
 async function runRegister(args) {
   const dbUrl = requireScopedUrl("replication", "register");
   const writeDbUrl = requireScopedUrl("write", "register");
-  const apiKey = resolveApiKey();
+  const apiKey = resolveMutationApiKey();
   if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      "Not logged in. Run `ablo login` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.",
+      `No branch-bound runtime key found. Set ABLO_API_KEY to the sk_ key for the branch to register, or pass \`--env-file .env.local\` explicitly.${ambient ? `
+
+${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
     );
   }
@@ -6633,6 +6762,62 @@ async function runScan() {
   }
   process.exit(retired.length > 0 ? 1 : 0);
 }
+async function runLocate(args) {
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which plane holds this database")}
+`
+  );
+  const url = args.url ?? readProjectAdminDatabaseUrl();
+  if (!url) {
+    throw new import_errors10.AbloValidationError(
+      "Locating needs a connection string to identify the database. Pass --url <conn> (or set DATABASE_URL) and re-run.",
+      { code: "cli_database_url_missing" }
+    );
+  }
+  const apiKey = resolveRuntimeApiKey().key;
+  if (!apiKey) {
+    const ambient = ambientEnvKeyNote();
+    throw new import_errors10.AbloAuthenticationError(
+      `No branch-bound runtime key found. Set ABLO_API_KEY to a key that can inspect this project, or pass \`--env-file .env.local\` explicitly.${ambient ? `
+
+${ambient}` : ""}`,
+      { code: "cli_api_key_missing" }
+    );
+  }
+  let label = "this database";
+  try {
+    const parsed = new URL(url);
+    label = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
+  } catch {
+  }
+  const answer = await requestControlPlane({
+    path: "/v1/datasources/locate",
+    method: "POST",
+    apiKey,
+    body: { connectionString: url },
+    responseSchema: import_wire7.datasourceLocationResponseSchema
+  });
+  if (!answer.held) {
+    console.log(
+      `  ${import_picocolors12.default.green("\u2713")} No plane holds ${import_picocolors12.default.bold(label)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
+`
+    );
+    return;
+  }
+  console.log(
+    `  ${import_picocolors12.default.yellow("!")} ${import_picocolors12.default.bold(label)} is connected to ${answer.held.project ? `project ${import_picocolors12.default.bold(answer.held.project)}, ` : ""}branch ${import_picocolors12.default.bold(answer.held.branch)}.
+`
+  );
+  console.log(
+    import_picocolors12.default.dim(
+      `    Ablo streams a database from one plane at a time. To move it, disconnect it there
+    first \u2014 run `
+    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that plane, then connect here.
+`) + import_picocolors12.default.dim(`    Confirm a candidate key first with `) + import_picocolors12.default.bold("ablo whoami --key-env <NAME>") + import_picocolors12.default.dim(`.
+`) + import_picocolors12.default.dim(`    Match the project id to a name with `) + import_picocolors12.default.bold("ablo projects list --json") + import_picocolors12.default.dim(".") + "\n"
+  );
+}
 async function connect(argv) {
   if (argv[0] === "deregister") {
     const { disconnect: disconnect2 } = await Promise.resolve().then(() => (init_disconnect(), disconnect_exports));
@@ -6640,6 +6825,16 @@ async function connect(argv) {
     return;
   }
   const args = parseConnectArgs(argv);
+  if (args.envFile) {
+    try {
+      process.loadEnvFile(args.envFile);
+    } catch (error) {
+      throw new import_errors10.AbloValidationError(
+        `could not load --env-file ${args.envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+  }
   if (args.apply || args.rotate) {
     const { runConnectApply: runConnectApply2 } = await Promise.resolve().then(() => (init_connectApply(), connectApply_exports));
     await runConnectApply2(args);
@@ -6657,6 +6852,10 @@ async function connect(argv) {
     await runScan();
     return;
   }
+  if (args.locate) {
+    await runLocate(args);
+    return;
+  }
   const credentialReachable = (args.url ?? readProjectAdminDatabaseUrl()) != null;
   const canConfirm = process.stdout.isTTY || args.yes;
   if (!args.manual && credentialReachable && canConfirm) {
@@ -6666,7 +6865,7 @@ async function connect(argv) {
   }
   printConnectRecipe(args);
 }
-var import_errors10, import_picocolors12, import_footprint2, FOOTPRINT_LOOKUP, CONNECT_USAGE;
+var import_errors10, import_picocolors12, import_footprint2, import_wire7, FOOTPRINT_LOOKUP, CONNECT_USAGE;
 var init_connect = __esm({
   "src/connect.ts"() {
     "use strict";
@@ -6678,6 +6877,7 @@ var init_connect = __esm({
     init_dbRole();
     init_config();
     init_controlPlane();
+    import_wire7 = require("@abloatai/transaction/wire");
     init_theme();
     init_remoteValidation();
     init_connectSetup();
@@ -6701,6 +6901,7 @@ var init_connect = __esm({
     npx ablo connect check                Confirm the connected database is ready, from Ablo's side (needs only ABLO_API_KEY)
     npx ablo connect rotate               New passwords for both logins, then re-register
     npx ablo connect scan                 List anything Ablo ever set up in your database (read-only, never drops)
+    npx ablo connect locate               See which plane holds this database (read-only; nothing is changed)
 
   Running it: bare \`ablo connect\` sets everything up for you \u2014 creating the two
   scoped logins, sharing your tables, and registering \u2014 whenever it finds a
@@ -6711,6 +6912,7 @@ var init_connect = __esm({
 
   Modifiers:
     --url <admin-conn>   Admin connection used once to set up (else DATABASE_URL); never stored
+    --env-file <path>    Explicitly load DATABASE_URL and ABLO_API_KEY from this file
     --tables a,b,c       Publish only these tables (default: all tables)
     --role <name>        Name the replication role (default: ablo_replicator)
     --write-role <name>  Name the DML role (default: ablo_writer)
@@ -12601,8 +12803,8 @@ var require_typescript = __commonJS({
       function createGetCanonicalFileName(useCaseSensitiveFileNames2) {
         return useCaseSensitiveFileNames2 ? identity : toFileNameLowerCase;
       }
-      function patternText({ prefix: prefix2, suffix }) {
-        return `${prefix2}*${suffix}`;
+      function patternText({ prefix, suffix }) {
+        return `${prefix}*${suffix}`;
       }
       function matchedText(pattern, candidate) {
         Debug.assert(isPatternMatch(pattern, candidate));
@@ -12621,17 +12823,17 @@ var require_typescript = __commonJS({
         }
         return matchedValue;
       }
-      function startsWith(str, prefix2, ignoreCase) {
-        return ignoreCase ? equateStringsCaseInsensitive(str.slice(0, prefix2.length), prefix2) : str.lastIndexOf(prefix2, 0) === 0;
+      function startsWith(str, prefix, ignoreCase) {
+        return ignoreCase ? equateStringsCaseInsensitive(str.slice(0, prefix.length), prefix) : str.lastIndexOf(prefix, 0) === 0;
       }
-      function removePrefix(str, prefix2) {
-        return startsWith(str, prefix2) ? str.substr(prefix2.length) : str;
+      function removePrefix(str, prefix) {
+        return startsWith(str, prefix) ? str.substr(prefix.length) : str;
       }
-      function tryRemovePrefix(str, prefix2, getCanonicalFileName = identity) {
-        return startsWith(getCanonicalFileName(str), getCanonicalFileName(prefix2)) ? str.substring(prefix2.length) : void 0;
+      function tryRemovePrefix(str, prefix, getCanonicalFileName = identity) {
+        return startsWith(getCanonicalFileName(str), getCanonicalFileName(prefix)) ? str.substring(prefix.length) : void 0;
       }
-      function isPatternMatch({ prefix: prefix2, suffix }, candidate) {
-        return candidate.length >= prefix2.length + suffix.length && startsWith(candidate, prefix2) && endsWith(candidate, suffix);
+      function isPatternMatch({ prefix, suffix }, candidate) {
+        return candidate.length >= prefix.length + suffix.length && startsWith(candidate, prefix) && endsWith(candidate, suffix);
       }
       function and(f, g2) {
         return (arg) => f(arg) && g2(arg);
@@ -18405,8 +18607,8 @@ ${lanes.join("\n")}
         );
         const firstComponent = pathComponents2[0];
         if (isAbsolutePathAnUrl && isRootedDiskPath(firstComponent)) {
-          const prefix2 = firstComponent.charAt(0) === directorySeparator ? "file://" : "file:///";
-          pathComponents2[0] = prefix2 + firstComponent;
+          const prefix = firstComponent.charAt(0) === directorySeparator ? "file://" : "file:///";
+          pathComponents2[0] = prefix + firstComponent;
         }
         return getPathFromPathComponents(pathComponents2);
       }
@@ -35422,12 +35624,12 @@ ${lanes.join("\n")}
           node.symbol = void 0;
           return node;
         }
-        function createBaseGeneratedIdentifier(text, autoGenerateFlags, prefix2, suffix) {
+        function createBaseGeneratedIdentifier(text, autoGenerateFlags, prefix, suffix) {
           const node = createBaseIdentifier(escapeLeadingUnderscores(text));
           setIdentifierAutoGenerate(node, {
             flags: autoGenerateFlags,
             id: nextAutoGenerateId,
-            prefix: prefix2,
+            prefix,
             suffix
           });
           nextAutoGenerateId++;
@@ -35450,10 +35652,10 @@ ${lanes.join("\n")}
           }
           return node;
         }
-        function createTempVariable(recordTempVariable, reservedInNestedScopes, prefix2, suffix) {
+        function createTempVariable(recordTempVariable, reservedInNestedScopes, prefix, suffix) {
           let flags2 = 1;
           if (reservedInNestedScopes) flags2 |= 8;
-          const name = createBaseGeneratedIdentifier("", flags2, prefix2, suffix);
+          const name = createBaseGeneratedIdentifier("", flags2, prefix, suffix);
           if (recordTempVariable) {
             recordTempVariable(name);
           }
@@ -35471,23 +35673,23 @@ ${lanes.join("\n")}
             void 0
           );
         }
-        function createUniqueName(text, flags2 = 0, prefix2, suffix) {
+        function createUniqueName(text, flags2 = 0, prefix, suffix) {
           Debug.assert(!(flags2 & 7), "Argument out of range: flags");
           Debug.assert((flags2 & (16 | 32)) !== 32, "GeneratedIdentifierFlags.FileLevel cannot be set without also setting GeneratedIdentifierFlags.Optimistic");
-          return createBaseGeneratedIdentifier(text, 3 | flags2, prefix2, suffix);
+          return createBaseGeneratedIdentifier(text, 3 | flags2, prefix, suffix);
         }
-        function getGeneratedNameForNode(node, flags2 = 0, prefix2, suffix) {
+        function getGeneratedNameForNode(node, flags2 = 0, prefix, suffix) {
           Debug.assert(!(flags2 & 7), "Argument out of range: flags");
           const text = !node ? "" : isMemberName(node) ? formatGeneratedName(
             /*privateName*/
             false,
-            prefix2,
+            prefix,
             node,
             suffix,
             idText
           ) : `generated@${getNodeId(node)}`;
-          if (prefix2 || suffix) flags2 |= 16;
-          const name = createBaseGeneratedIdentifier(text, 4 | flags2, prefix2, suffix);
+          if (prefix || suffix) flags2 |= 16;
+          const name = createBaseGeneratedIdentifier(text, 4 | flags2, prefix, suffix);
           name.original = node;
           return name;
         }
@@ -35504,33 +35706,33 @@ ${lanes.join("\n")}
           if (!startsWith(text, "#")) Debug.fail("First character of private identifier must be #: " + text);
           return createBasePrivateIdentifier(escapeLeadingUnderscores(text));
         }
-        function createBaseGeneratedPrivateIdentifier(text, autoGenerateFlags, prefix2, suffix) {
+        function createBaseGeneratedPrivateIdentifier(text, autoGenerateFlags, prefix, suffix) {
           const node = createBasePrivateIdentifier(escapeLeadingUnderscores(text));
           setIdentifierAutoGenerate(node, {
             flags: autoGenerateFlags,
             id: nextAutoGenerateId,
-            prefix: prefix2,
+            prefix,
             suffix
           });
           nextAutoGenerateId++;
           return node;
         }
-        function createUniquePrivateName(text, prefix2, suffix) {
+        function createUniquePrivateName(text, prefix, suffix) {
           if (text && !startsWith(text, "#")) Debug.fail("First character of private identifier must be #: " + text);
           const autoGenerateFlags = 8 | (text ? 3 : 1);
-          return createBaseGeneratedPrivateIdentifier(text ?? "", autoGenerateFlags, prefix2, suffix);
+          return createBaseGeneratedPrivateIdentifier(text ?? "", autoGenerateFlags, prefix, suffix);
         }
-        function getGeneratedPrivateNameForNode(node, prefix2, suffix) {
+        function getGeneratedPrivateNameForNode(node, prefix, suffix) {
           const text = isMemberName(node) ? formatGeneratedName(
             /*privateName*/
             true,
-            prefix2,
+            prefix,
             node,
             suffix,
             idText
           ) : `#generated@${getNodeId(node)}`;
-          const flags2 = prefix2 || suffix ? 16 : 0;
-          const name = createBaseGeneratedPrivateIdentifier(text, 4 | flags2, prefix2, suffix);
+          const flags2 = prefix || suffix ? 16 : 0;
+          const name = createBaseGeneratedPrivateIdentifier(text, 4 | flags2, prefix, suffix);
           name.original = node;
           return name;
         }
@@ -40332,13 +40534,13 @@ ${lanes.join("\n")}
             [expr]
           );
         }
-        function createSetFunctionNameHelper(f, name, prefix2) {
+        function createSetFunctionNameHelper(f, name, prefix) {
           context.requestEmitHelper(setFunctionNameHelper);
           return context.factory.createCallExpression(
             getUnscopedHelperName("__setFunctionName"),
             /*typeArguments*/
             void 0,
-            prefix2 ? [f, name, context.factory.createStringLiteral(prefix2)] : [f, name]
+            prefix ? [f, name, context.factory.createStringLiteral(prefix)] : [f, name]
           );
         }
         function createValuesHelper(expression) {
@@ -42675,11 +42877,11 @@ ${lanes.join("\n")}
       function formatIdentifierWorker(node, generateName) {
         return isGeneratedPrivateIdentifier(node) ? generateName(node).slice(1) : isGeneratedIdentifier(node) ? generateName(node) : isPrivateIdentifier(node) ? node.escapedText.slice(1) : idText(node);
       }
-      function formatGeneratedName(privateName, prefix2, baseName, suffix, generateName) {
-        prefix2 = formatGeneratedNamePart(prefix2, generateName);
+      function formatGeneratedName(privateName, prefix, baseName, suffix, generateName) {
+        prefix = formatGeneratedNamePart(prefix, generateName);
         suffix = formatGeneratedNamePart(suffix, generateName);
         baseName = formatIdentifier(baseName, generateName);
-        return `${privateName ? "#" : ""}${prefix2}${baseName}${suffix}`;
+        return `${privateName ? "#" : ""}${prefix}${baseName}${suffix}`;
       }
       function createAccessorPropertyBackingField(factory2, node, modifiers, initializer) {
         return factory2.updatePropertyDeclaration(
@@ -62754,11 +62956,11 @@ ${lanes.join("\n")}
               candidates.push({ ending: void 0, value: relativeToBaseUrl });
             }
             if (indexOfStar !== -1) {
-              const prefix2 = pattern.substring(0, indexOfStar);
+              const prefix = pattern.substring(0, indexOfStar);
               const suffix = pattern.substring(indexOfStar + 1);
               for (const { ending, value } of candidates) {
-                if (value.length >= prefix2.length + suffix.length && startsWith(value, prefix2) && endsWith(value, suffix) && validateEnding({ ending, value })) {
-                  const matchedStar = value.substring(prefix2.length, value.length - suffix.length);
+                if (value.length >= prefix.length + suffix.length && startsWith(value, prefix) && endsWith(value, suffix) && validateEnding({ ending, value })) {
+                  const matchedStar = value.substring(prefix.length, value.length - suffix.length);
                   if (!pathIsRelative(matchedStar)) {
                     return replaceFirstStar(key, matchedStar);
                   }
@@ -82457,9 +82659,9 @@ ${lanes.join("\n")}
                     }
                     secondaryRootErrors.unshift([mappedMsg, args[0], args[1]]);
                   } else {
-                    const prefix2 = msg.code === Diagnostics.Construct_signature_return_types_0_and_1_are_incompatible.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "new " : "";
+                    const prefix = msg.code === Diagnostics.Construct_signature_return_types_0_and_1_are_incompatible.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "new " : "";
                     const params = msg.code === Diagnostics.Call_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "" : "...";
-                    path = `${prefix2}${path}(${params})`;
+                    path = `${prefix}${path}(${params})`;
                   }
                   break;
                 }
@@ -117301,13 +117503,13 @@ ${lanes.join("\n")}
         }
         function createHoistedVariableForClass(name, node, suffix) {
           const { className } = getPrivateIdentifierEnvironment().data;
-          const prefix2 = className ? { prefix: "_", node: className, suffix: "_" } : "_";
-          const identifier = typeof name === "object" ? factory2.getGeneratedNameForNode(name, 16 | 8, prefix2, suffix) : typeof name === "string" ? factory2.createUniqueName(name, 16, prefix2, suffix) : factory2.createTempVariable(
+          const prefix = className ? { prefix: "_", node: className, suffix: "_" } : "_";
+          const identifier = typeof name === "object" ? factory2.getGeneratedNameForNode(name, 16 | 8, prefix, suffix) : typeof name === "string" ? factory2.createUniqueName(name, 16, prefix, suffix) : factory2.createTempVariable(
             /*recordTempVariable*/
             void 0,
             /*reservedInNestedScopes*/
             true,
-            prefix2,
+            prefix,
             suffix
           );
           if (resolver.hasNodeCheckFlag(
@@ -118380,7 +118582,7 @@ ${lanes.join("\n")}
           if (!decoratorExpressions) {
             return void 0;
           }
-          const prefix2 = getClassMemberPrefix(node, member);
+          const prefix = getClassMemberPrefix(node, member);
           const memberName = getExpressionForPropertyName(
             member,
             /*generateNameForComputedPropertyName*/
@@ -118393,7 +118595,7 @@ ${lanes.join("\n")}
           const descriptor = isPropertyDeclaration(member) && !hasAccessorModifier(member) ? factory2.createVoidZero() : factory2.createNull();
           const helper = emitHelpers().createDecorateHelper(
             decoratorExpressions,
-            prefix2,
+            prefix,
             memberName,
             descriptor
           );
@@ -120296,13 +120498,13 @@ ${lanes.join("\n")}
             3072
             /* NoComments */
           );
-          const prefix2 = kind === "get" || kind === "set" ? kind : void 0;
+          const prefix = kind === "get" || kind === "set" ? kind : void 0;
           const functionName = factory2.createStringLiteralFromNode(
             name,
             /*isSingleQuote*/
             void 0
           );
-          const namedFunction = emitHelpers().createSetFunctionNameHelper(func, functionName, prefix2);
+          const namedFunction = emitHelpers().createSetFunctionNameHelper(func, functionName, prefix);
           const method = factory2.createPropertyAssignment(factory2.createIdentifier(kind), namedFunction);
           setOriginalNode(method, original);
           setSourceMapRange(method, moveRangePastDecorators(original));
@@ -141082,9 +141284,9 @@ ${lanes.join("\n")}
             emitExpression(node, parenthesizerRule);
           }
         }
-        function emitNodeWithPrefix(prefix2, prefixWriter, node, emit2) {
+        function emitNodeWithPrefix(prefix, prefixWriter, node, emit2) {
           if (node) {
-            prefixWriter(prefix2);
+            prefixWriter(prefix);
             emit2(node);
           }
         }
@@ -141822,10 +142024,10 @@ ${lanes.join("\n")}
             return autoGeneratedIdToGeneratedName[autoGenerateId] || (autoGeneratedIdToGeneratedName[autoGenerateId] = makeName(name));
           }
         }
-        function generateNameCached(node, privateName, flags, prefix2, suffix) {
+        function generateNameCached(node, privateName, flags, prefix, suffix) {
           const nodeId = getNodeId(node);
           const cache = privateName ? nodeIdToGeneratedPrivateName : nodeIdToGeneratedName;
-          return cache[nodeId] || (cache[nodeId] = generateNameForNode(node, privateName, flags ?? 0, formatGeneratedNamePart(prefix2, generateName), formatGeneratedNamePart(suffix)));
+          return cache[nodeId] || (cache[nodeId] = generateNameForNode(node, privateName, flags ?? 0, formatGeneratedNamePart(prefix, generateName), formatGeneratedNamePart(suffix)));
         }
         function isUniqueName(name, privateName) {
           return isFileLevelUniqueNameInCurrentFile(name, privateName) && !isReservedName(name, privateName) && !generatedNames.has(name);
@@ -141892,15 +142094,15 @@ ${lanes.join("\n")}
               break;
           }
         }
-        function makeTempVariableName(flags, reservedInNestedScopes, privateName, prefix2, suffix) {
-          if (prefix2.length > 0 && prefix2.charCodeAt(0) === 35) {
-            prefix2 = prefix2.slice(1);
+        function makeTempVariableName(flags, reservedInNestedScopes, privateName, prefix, suffix) {
+          if (prefix.length > 0 && prefix.charCodeAt(0) === 35) {
+            prefix = prefix.slice(1);
           }
-          const key = formatGeneratedName(privateName, prefix2, "", suffix);
+          const key = formatGeneratedName(privateName, prefix, "", suffix);
           let tempFlags2 = getTempFlags(key);
           if (flags && !(tempFlags2 & flags)) {
             const name = flags === 268435456 ? "_i" : "_n";
-            const fullName = formatGeneratedName(privateName, prefix2, name, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, name, suffix);
             if (isUniqueName(fullName, privateName)) {
               tempFlags2 |= flags;
               if (privateName) {
@@ -141917,7 +142119,7 @@ ${lanes.join("\n")}
             tempFlags2++;
             if (count !== 8 && count !== 13) {
               const name = count < 26 ? "_" + String.fromCharCode(97 + count) : "_" + (count - 26);
-              const fullName = formatGeneratedName(privateName, prefix2, name, suffix);
+              const fullName = formatGeneratedName(privateName, prefix, name, suffix);
               if (isUniqueName(fullName, privateName)) {
                 if (privateName) {
                   reservePrivateNameInNestedScopes(fullName);
@@ -141930,15 +142132,15 @@ ${lanes.join("\n")}
             }
           }
         }
-        function makeUniqueName2(baseName, checkFn = isUniqueName, optimistic, scoped, privateName, prefix2, suffix) {
+        function makeUniqueName2(baseName, checkFn = isUniqueName, optimistic, scoped, privateName, prefix, suffix) {
           if (baseName.length > 0 && baseName.charCodeAt(0) === 35) {
             baseName = baseName.slice(1);
           }
-          if (prefix2.length > 0 && prefix2.charCodeAt(0) === 35) {
-            prefix2 = prefix2.slice(1);
+          if (prefix.length > 0 && prefix.charCodeAt(0) === 35) {
+            prefix = prefix.slice(1);
           }
           if (optimistic) {
-            const fullName = formatGeneratedName(privateName, prefix2, baseName, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, baseName, suffix);
             if (checkFn(fullName, privateName)) {
               if (privateName) {
                 reservePrivateNameInNestedScopes(fullName);
@@ -141955,7 +142157,7 @@ ${lanes.join("\n")}
           }
           let i = 1;
           while (true) {
-            const fullName = formatGeneratedName(privateName, prefix2, baseName + i, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, baseName + i, suffix);
             if (checkFn(fullName, privateName)) {
               if (privateName) {
                 reservePrivateNameInNestedScopes(fullName);
@@ -142052,7 +142254,7 @@ ${lanes.join("\n")}
             ""
           );
         }
-        function generateNameForMethodOrAccessor(node, privateName, prefix2, suffix) {
+        function generateNameForMethodOrAccessor(node, privateName, prefix, suffix) {
           if (isIdentifier2(node.name)) {
             return generateNameCached(node.name, privateName);
           }
@@ -142061,11 +142263,11 @@ ${lanes.join("\n")}
             /*reservedInNestedScopes*/
             false,
             privateName,
-            prefix2,
+            prefix,
             suffix
           );
         }
-        function generateNameForNode(node, privateName, flags, prefix2, suffix) {
+        function generateNameForNode(node, privateName, flags, prefix, suffix) {
           switch (node.kind) {
             case 80:
             case 81:
@@ -142075,20 +142277,20 @@ ${lanes.join("\n")}
                 !!(flags & 16),
                 !!(flags & 8),
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
             case 267:
             case 266:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForModuleOrEnum(node);
             case 272:
             case 278:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForImportOrExportDeclaration(node);
             case 262:
             case 263: {
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               const name = node.name;
               if (name && !isGeneratedIdentifier(name)) {
                 return generateNameForNode(
@@ -142096,29 +142298,29 @@ ${lanes.join("\n")}
                   /*privateName*/
                   false,
                   flags,
-                  prefix2,
+                  prefix,
                   suffix
                 );
               }
               return generateNameForExportDefault();
             }
             case 277:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForExportDefault();
             case 231:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForClassExpression();
             case 174:
             case 177:
             case 178:
-              return generateNameForMethodOrAccessor(node, privateName, prefix2, suffix);
+              return generateNameForMethodOrAccessor(node, privateName, prefix, suffix);
             case 167:
               return makeTempVariableName(
                 0,
                 /*reservedInNestedScopes*/
                 true,
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
             default:
@@ -142127,18 +142329,18 @@ ${lanes.join("\n")}
                 /*reservedInNestedScopes*/
                 false,
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
           }
         }
         function makeName(name) {
           const autoGenerate = name.emitNode.autoGenerate;
-          const prefix2 = formatGeneratedNamePart(autoGenerate.prefix, generateName);
+          const prefix = formatGeneratedNamePart(autoGenerate.prefix, generateName);
           const suffix = formatGeneratedNamePart(autoGenerate.suffix);
           switch (autoGenerate.flags & 7) {
             case 1:
-              return makeTempVariableName(0, !!(autoGenerate.flags & 8), isPrivateIdentifier(name), prefix2, suffix);
+              return makeTempVariableName(0, !!(autoGenerate.flags & 8), isPrivateIdentifier(name), prefix, suffix);
             case 2:
               Debug.assertNode(name, isIdentifier2);
               return makeTempVariableName(
@@ -142146,7 +142348,7 @@ ${lanes.join("\n")}
                 !!(autoGenerate.flags & 8),
                 /*privateName*/
                 false,
-                prefix2,
+                prefix,
                 suffix
               );
             case 3:
@@ -142156,7 +142358,7 @@ ${lanes.join("\n")}
                 !!(autoGenerate.flags & 16),
                 !!(autoGenerate.flags & 8),
                 isPrivateIdentifier(name),
-                prefix2,
+                prefix,
                 suffix
               );
           }
@@ -158712,8 +158914,8 @@ ${lanes.join("\n")}
       }
       function buildLinkParts(link, checker) {
         var _a;
-        const prefix2 = isJSDocLink(link) ? "link" : isJSDocLinkCode(link) ? "linkcode" : "linkplain";
-        const parts = [linkPart(`{@${prefix2} `)];
+        const prefix = isJSDocLink(link) ? "link" : isJSDocLinkCode(link) ? "linkcode" : "linkplain";
+        const parts = [linkPart(`{@${prefix} `)];
         if (!link.name) {
           if (link.text) {
             parts.push(linkTextPart(link.text));
@@ -160186,9 +160388,9 @@ ${lanes.join("\n")}
           let token = 0;
           let lastNonTriviaToken = 0;
           const templateStack = [];
-          const { prefix: prefix2, pushTemplate } = getPrefixFromLexState(lexState);
-          text = prefix2 + text;
-          const offset = prefix2.length;
+          const { prefix, pushTemplate } = getPrefixFromLexState(lexState);
+          text = prefix + text;
+          const offset = prefix.length;
           if (pushTemplate) {
             templateStack.push(
               16
@@ -169346,11 +169548,11 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           if (decls && decls.some((d3) => d3.parent === scopeDecl)) {
             return factory.createIdentifier(symbol.name);
           }
-          const prefix2 = tryReplaceWithQualifiedNameOrPropertyAccess(symbol.parent, scopeDecl, isTypeNode2);
-          if (prefix2 === void 0) {
+          const prefix = tryReplaceWithQualifiedNameOrPropertyAccess(symbol.parent, scopeDecl, isTypeNode2);
+          if (prefix === void 0) {
             return void 0;
           }
-          return isTypeNode2 ? factory.createQualifiedName(prefix2, factory.createIdentifier(symbol.name)) : factory.createPropertyAccessExpression(prefix2, symbol.name);
+          return isTypeNode2 ? factory.createQualifiedName(prefix, factory.createIdentifier(symbol.name)) : factory.createPropertyAccessExpression(prefix, symbol.name);
         }
       }
       function getExtractableParent(node) {
@@ -170665,13 +170867,13 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         if (textChangeRange) {
           if (version2 !== sourceFile.version) {
             let newText;
-            const prefix2 = textChangeRange.span.start !== 0 ? sourceFile.text.substr(0, textChangeRange.span.start) : "";
+            const prefix = textChangeRange.span.start !== 0 ? sourceFile.text.substr(0, textChangeRange.span.start) : "";
             const suffix = textSpanEnd(textChangeRange.span) !== sourceFile.text.length ? sourceFile.text.substr(textSpanEnd(textChangeRange.span)) : "";
             if (textChangeRange.newLength === 0) {
-              newText = prefix2 && suffix ? prefix2 + suffix : prefix2 || suffix;
+              newText = prefix && suffix ? prefix + suffix : prefix || suffix;
             } else {
               const changedText = scriptSnapshot.getText(textChangeRange.span.start, textChangeRange.span.start + textChangeRange.newLength);
-              newText = prefix2 && suffix ? prefix2 + changedText + suffix : prefix2 ? prefix2 + changedText : changedText + suffix;
+              newText = prefix && suffix ? prefix + changedText + suffix : prefix ? prefix + changedText : changedText + suffix;
             }
             const newSourceFile = updateSourceFile(sourceFile, newText, textChangeRange, aggressiveChecks);
             setSourceFileFields(newSourceFile, scriptSnapshot, version2);
@@ -172801,8 +173003,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           const end = pos + 6;
           const typeChecker = program.getTypeChecker();
           const symbol = typeChecker.getSymbolAtLocation(node.parent);
-          const prefix2 = symbol ? `${typeChecker.symbolToString(symbol, node.parent)} ` : "";
-          return { text: `${prefix2}static {}`, pos, end };
+          const prefix = symbol ? `${typeChecker.symbolToString(symbol, node.parent)} ` : "";
+          return { text: `${prefix}static {}`, pos, end };
         }
         const declName = isAssignedExpression(node) ? node.parent.name : Debug.checkDefined(getNameOfDeclaration(node), "Expected call hierarchy item to have a name");
         let text = isIdentifier2(declName) ? idText(declName) : isStringOrNumericLiteralLike(declName) ? declName.text : isComputedPropertyName(declName) ? isStringOrNumericLiteralLike(declName.expression) ? declName.expression.text : void 0 : void 0;
@@ -176148,18 +176350,18 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         const commentNode = node.parent;
         const { leftSibling, rightSibling } = getLeftAndRightSiblings(node);
         let pos = commentNode.getStart();
-        let prefix2 = "";
+        let prefix = "";
         if (!leftSibling && commentNode.comment) {
           pos = findEndOfTextBetween(commentNode, commentNode.getStart(), node.getStart());
-          prefix2 = `${newLine} */${newLine}`;
+          prefix = `${newLine} */${newLine}`;
         }
         if (leftSibling) {
           if (fixAll && isJSDocTypedefTag(leftSibling)) {
             pos = node.getStart();
-            prefix2 = "";
+            prefix = "";
           } else {
             pos = findEndOfTextBetween(commentNode, leftSibling.getStart(), node.getStart());
-            prefix2 = `${newLine} */${newLine}`;
+            prefix = `${newLine} */${newLine}`;
           }
         }
         let end = commentNode.getEnd();
@@ -176173,7 +176375,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             suffix = `${newLine}/**${newLine} * `;
           }
         }
-        changes.replaceRange(sourceFile, { pos, end }, declaration, { prefix: prefix2, suffix });
+        changes.replaceRange(sourceFile, { pos, end }, declaration, { prefix, suffix });
       }
       function getLeftAndRightSiblings(typedefNode) {
         const commentNode = typedefNode.parent;
@@ -180591,9 +180793,9 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
               result.push(createDeleteFix(deletion, [Diagnostics.Remove_unused_declaration_for_Colon_0, name.getText(sourceFile)]));
             }
           }
-          const prefix2 = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode, sourceFile, token));
-          if (prefix2.length) {
-            result.push(createCodeFixAction(fixName3, prefix2, [Diagnostics.Prefix_0_with_an_underscore, token.getText(sourceFile)], fixIdPrefix, Diagnostics.Prefix_all_unused_declarations_with_where_possible));
+          const prefix = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode, sourceFile, token));
+          if (prefix.length) {
+            result.push(createCodeFixAction(fixName3, prefix, [Diagnostics.Prefix_0_with_an_underscore, token.getText(sourceFile)], fixIdPrefix, Diagnostics.Prefix_all_unused_declarations_with_where_possible));
           }
           return result;
         },
@@ -190294,9 +190496,9 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         function getDirectoryMatches(directoryName) {
           return mapDefined(tryGetDirectories(host, directoryName), (dir) => dir === "node_modules" ? void 0 : directoryResult(dir));
         }
-        function trimPrefixAndSuffix(path, prefix2) {
+        function trimPrefixAndSuffix(path, prefix) {
           return firstDefined(matchingSuffixes, (suffix) => {
-            const inner = withoutStartAndEnd(normalizePath(path), prefix2, suffix);
+            const inner = withoutStartAndEnd(normalizePath(path), prefix, suffix);
             return inner === void 0 ? void 0 : removeLeadingDirectorySeparator(inner);
           });
         }
@@ -190329,7 +190531,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         if (!match) {
           return void 0;
         }
-        const [, prefix2, kind, toComplete] = match;
+        const [, prefix, kind, toComplete] = match;
         const scriptPath = getDirectoryPath(sourceFile.path);
         const names = kind === "path" ? getCompletionEntriesForDirectoryFragment(
           toComplete,
@@ -190342,7 +190544,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           true,
           sourceFile.path
         ) : kind === "types" ? getCompletionEntriesFromTypings(program, host, moduleSpecifierResolutionHost, scriptPath, getFragmentDirectory(toComplete), getExtensionOptions(compilerOptions, 1, sourceFile)) : Debug.fail();
-        return addReplacementSpans(toComplete, range.pos + prefix2.length, arrayFrom(names.values()));
+        return addReplacementSpans(toComplete, range.pos + prefix.length, arrayFrom(names.values()));
       }
       function getCompletionEntriesFromTypings(program, host, moduleSpecifierResolutionHost, scriptPath, fragmentDirectory, extensionOptions, result = createNameAndKindSet()) {
         const options = program.getCompilerOptions();
@@ -196693,8 +196895,8 @@ ${content}
       ), spacePart()];
       function getSignatureHelpItem(candidateSignature, callTargetDisplayParts, isTypeParameterList, checker, enclosingDeclaration, sourceFile) {
         const infos = (isTypeParameterList ? itemInfoForTypeParameters : itemInfoForParameters)(candidateSignature, checker, enclosingDeclaration, sourceFile);
-        return map(infos, ({ isVariadic, parameters, prefix: prefix2, suffix }) => {
-          const prefixDisplayParts = [...callTargetDisplayParts, ...prefix2];
+        return map(infos, ({ isVariadic, parameters, prefix, suffix }) => {
+          const prefixDisplayParts = [...callTargetDisplayParts, ...prefix];
           const suffixDisplayParts = [...suffix, ...returnTypeToDisplayParts(candidateSignature, enclosingDeclaration, checker)];
           const documentation = candidateSignature.getDocumentationComment(checker);
           const tags = candidateSignature.getJsDocTags();
@@ -198781,11 +198983,11 @@ ${options.prefix}` : "\n" : options.prefix
           const noIndent = options.indentation !== void 0 || getLineStartPositionForPosition(pos, targetSourceFile) === pos ? text : text.replace(/^\s+/, "");
           return (options.prefix || "") + noIndent + (!options.suffix || endsWith(noIndent, options.suffix) ? "" : options.suffix);
         }
-        function getFormattedTextOfNode(nodeIn, targetSourceFile, sourceFile, pos, { indentation, prefix: prefix2, delta }, newLineCharacter, formatContext, validate) {
+        function getFormattedTextOfNode(nodeIn, targetSourceFile, sourceFile, pos, { indentation, prefix, delta }, newLineCharacter, formatContext, validate) {
           const { node, text } = getNonformattedText(nodeIn, targetSourceFile, newLineCharacter);
           if (validate) validate(node, text);
           const formatOptions = getFormatCodeSettingsForWriting(formatContext, targetSourceFile);
-          const initialIndentation = indentation !== void 0 ? indentation : ts_formatting_exports.SmartIndenter.getIndentation(pos, sourceFile, formatOptions, prefix2 === newLineCharacter || getLineStartPositionForPosition(pos, targetSourceFile) === pos);
+          const initialIndentation = indentation !== void 0 ? indentation : ts_formatting_exports.SmartIndenter.getIndentation(pos, sourceFile, formatOptions, prefix === newLineCharacter || getLineStartPositionForPosition(pos, targetSourceFile) === pos);
           if (delta === void 0) {
             delta = ts_formatting_exports.SmartIndenter.shouldIndentChildNode(formatOptions, nodeIn) ? formatOptions.indentSize || 0 : 0;
           }
@@ -216510,9 +216712,9 @@ Project '${project.projectName}' (${ProjectKind[project.projectKind]}) ${counter
           );
           if (completions === void 0) return void 0;
           if (kind === "completions-full") return completions;
-          const prefix2 = args.prefix || "";
+          const prefix = args.prefix || "";
           const entries = mapDefined(completions.entries, (entry) => {
-            if (completions.isMemberCompletion || startsWith(entry.name.toLowerCase(), prefix2.toLowerCase())) {
+            if (completions.isMemberCompletion || startsWith(entry.name.toLowerCase(), prefix.toLowerCase())) {
               const convertedSpan = entry.replacementSpan ? toProtocolTextSpan(entry.replacementSpan, scriptInfo) : void 0;
               return {
                 ...entry,
@@ -221457,15 +221659,15 @@ var require_to_regex_range = __commonJS({
       }
       return tokens;
     }
-    function filterPatterns(arr, comparison, prefix2, intersection, options) {
+    function filterPatterns(arr, comparison, prefix, intersection, options) {
       let result = [];
       for (let ele of arr) {
         let { string } = ele;
         if (!intersection && !contains(comparison, "string", string)) {
-          result.push(prefix2 + string);
+          result.push(prefix + string);
         }
         if (intersection && contains(comparison, "string", string)) {
-          result.push(prefix2 + string);
+          result.push(prefix + string);
         }
       }
       return result;
@@ -221576,7 +221778,7 @@ var require_fill_range = __commonJS({
     var toSequence = (parts, options, maxLen) => {
       parts.negatives.sort((a, b4) => a < b4 ? -1 : a > b4 ? 1 : 0);
       parts.positives.sort((a, b4) => a < b4 ? -1 : a > b4 ? 1 : 0);
-      let prefix2 = options.capture ? "" : "?:";
+      let prefix = options.capture ? "" : "?:";
       let positives = "";
       let negatives = "";
       let result;
@@ -221584,7 +221786,7 @@ var require_fill_range = __commonJS({
         positives = parts.positives.map((v2) => toMaxLen(String(v2), maxLen)).join("|");
       }
       if (parts.negatives.length) {
-        negatives = `-(${prefix2}${parts.negatives.map((v2) => toMaxLen(String(v2), maxLen)).join("|")})`;
+        negatives = `-(${prefix}${parts.negatives.map((v2) => toMaxLen(String(v2), maxLen)).join("|")})`;
       }
       if (positives && negatives) {
         result = `${positives}|${negatives}`;
@@ -221592,7 +221794,7 @@ var require_fill_range = __commonJS({
         result = positives || negatives;
       }
       if (options.wrap) {
-        return `(${prefix2}${result})`;
+        return `(${prefix}${result})`;
       }
       return result;
     };
@@ -221608,8 +221810,8 @@ var require_fill_range = __commonJS({
     var toRegex = (start, end, options) => {
       if (Array.isArray(start)) {
         let wrap = options.wrap === true;
-        let prefix2 = options.capture ? "" : "?:";
-        return wrap ? `(${prefix2}${start.join("|")})` : start.join("|");
+        let prefix = options.capture ? "" : "?:";
+        return wrap ? `(${prefix}${start.join("|")})` : start.join("|");
       }
       return toRegexRange(start, end, options);
     };
@@ -221731,20 +221933,20 @@ var require_compile = __commonJS({
         const invalidBlock = utils.isInvalidBrace(parent);
         const invalidNode = node.invalid === true && options.escapeInvalid === true;
         const invalid = invalidBlock === true || invalidNode === true;
-        const prefix2 = options.escapeInvalid === true ? "\\" : "";
+        const prefix = options.escapeInvalid === true ? "\\" : "";
         let output = "";
         if (node.isOpen === true) {
-          return prefix2 + node.value;
+          return prefix + node.value;
         }
         if (node.isClose === true) {
-          console.log("node.isClose", prefix2, node.value);
-          return prefix2 + node.value;
+          console.log("node.isClose", prefix, node.value);
+          return prefix + node.value;
         }
         if (node.type === "open") {
-          return invalid ? prefix2 + node.value : "(";
+          return invalid ? prefix + node.value : "(";
         }
         if (node.type === "close") {
-          return invalid ? prefix2 + node.value : ")";
+          return invalid ? prefix + node.value : ")";
         }
         if (node.type === "comma") {
           return node.prev.type === "comma" ? "" : invalid ? node.value : "|";
@@ -222780,10 +222982,10 @@ var require_scan = __commonJS({
         isGlob = false;
       }
       let base = str;
-      let prefix2 = "";
+      let prefix = "";
       let glob = "";
       if (start > 0) {
-        prefix2 = str.slice(0, start);
+        prefix = str.slice(0, start);
         str = str.slice(start);
         lastIndex -= start;
       }
@@ -222808,7 +223010,7 @@ var require_scan = __commonJS({
         }
       }
       const state = {
-        prefix: prefix2,
+        prefix,
         input,
         start,
         base,
@@ -222837,7 +223039,7 @@ var require_scan = __commonJS({
           if (opts.tokens) {
             if (idx === 0 && start !== 0) {
               tokens[idx].isPrefix = true;
-              tokens[idx].value = prefix2;
+              tokens[idx].value = prefix;
             } else {
               tokens[idx].value = value;
             }
@@ -227055,8 +227257,8 @@ ${nodeLocation}` : message2;
       errors.ArgumentTypeError = ArgumentTypeError;
       class PathNotFoundError extends BaseError {
         path;
-        constructor(path2, prefix2 = "Path") {
-          super(`${prefix2} not found: ${path2}`);
+        constructor(path2, prefix = "Path") {
+          super(`${prefix} not found: ${path2}`);
           this.path = path2;
         }
         code = "ENOENT";
@@ -282702,7 +282904,7 @@ Node text: ${this.#forgottenText}`;
 // src/index.ts
 init_cjs_shims();
 init_dist2();
-var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_picocolors28 = __toESM(require_picocolors(), 1);
 var import_fs13 = require("fs");
 var import_path8 = require("path");
 var import_child_process3 = require("child_process");
@@ -283374,32 +283576,26 @@ function parseDevArgs(argv) {
     url,
     apiKey: process.env.ABLO_API_KEY,
     watch: watchEnabled,
-    planeLabel: "sandbox"
+    planeLabel: "branch"
   };
 }
 function classifyKey(apiKey) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors15.default.bold("npx ablo login")}, or set ${import_picocolors15.default.bold("ABLO_API_KEY")}: ${import_picocolors15.default.bold("sk_test_")} runs the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, ${import_picocolors15.default.bold("sk_live_")} deploys production with ${import_picocolors15.default.bold("npx ablo push")}.`
-    };
-  }
-  if (apiKey.startsWith("sk_test_")) return { ok: true };
-  if (apiKey.startsWith("sk_live_")) {
-    return {
-      ok: false,
-      reason: `A ${import_picocolors15.default.bold("sk_live_")} key deploys production schema in one reviewed step: ${import_picocolors15.default.bold("npx ablo push")}. The ${import_picocolors15.default.bold("--watch")} loop runs on a ${import_picocolors15.default.bold("sk_test_")} key, which reaches the same API and the same schema over its own rows.`
+      reason: `No API key. Run ${import_picocolors15.default.bold("npx ablo login")}, or set a branch-bound ${import_picocolors15.default.bold("ABLO_API_KEY")}. ${import_picocolors15.default.bold("npx ablo dev")} prepares a development branch.`
     };
   }
+  if ((0, import_credentialPolicy2.classifyCredentialKind)(apiKey) === "secret") return { ok: true };
   if ((0, import_credentialPolicy2.classifyCredentialKind)(apiKey) === "restricted") {
     return {
       ok: false,
-      reason: `Authoring schema needs a secret key. ${import_picocolors15.default.bold("sk_test_")} runs the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, ${import_picocolors15.default.bold("sk_live_")} deploys production with ${import_picocolors15.default.bold("npx ablo push")}. A restricted ${import_picocolors15.default.bold("rk_")} key carries only the scopes it was minted with.`
+      reason: `Authoring schema needs a branch-bound secret ${import_picocolors15.default.bold("sk_")} key. ${import_picocolors15.default.bold("npx ablo dev")} prepares a development branch. A restricted ${import_picocolors15.default.bold("rk_")} key carries only the scopes it was minted with.`
     };
   }
   return {
     ok: false,
-    reason: `${import_picocolors15.default.bold("ABLO_API_KEY")} is not an Ablo key. Expected ${import_picocolors15.default.bold("sk_test_\u2026")} for the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, or ${import_picocolors15.default.bold("sk_live_\u2026")} for a production deploy with ${import_picocolors15.default.bold("npx ablo push")}.`
+    reason: `${import_picocolors15.default.bold("ABLO_API_KEY")} is not a secret Ablo key. Expected a branch-bound ${import_picocolors15.default.bold("sk_\u2026")} credential. Run ${import_picocolors15.default.bold("npx ablo dev")} to prepare a development branch.`
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
@@ -283494,7 +283690,7 @@ async function runPush(schema, args) {
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors15.default.bold("sandbox")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
@@ -283520,7 +283716,7 @@ async function dev(argv, runtime = {}) {
     process.exit(1);
   }
   if (runtime.apiKey) args.apiKey = runtime.apiKey;
-  else if (!args.apiKey) args.apiKey = resolveEffectiveApiKey("sandbox").key;
+  else if (!args.apiKey) args.apiKey = resolveRuntimeApiKey("sandbox").key;
   if (runtime.branch) args.planeLabel = runtime.branch.slug;
   const key = classifyKey(args.apiKey);
   if (!key.ok) {
@@ -283549,7 +283745,7 @@ async function dev(argv, runtime = {}) {
   console.log(`  ${import_picocolors15.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
-  s.start("Pushing schema definition (sandbox)");
+  s.start("Pushing schema definition (development branch)");
   const first = await runPush(schema, args);
   s.stop(first.message, first.ok ? 0 : 1);
   if (!first.ok) process.exit(1);
@@ -283574,7 +283770,7 @@ async function dev(argv, runtime = {}) {
   ${import_picocolors15.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
     console.log(`  ${import_picocolors15.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
-  console.log(`  Your app is wired for ${runtime.branch ? `branch ${runtime.branch.slug}` : "the sandbox"}.`);
+  console.log(`  Your app is wired for ${runtime.branch ? `branch ${runtime.branch.slug}` : "this branch"}.`);
   if (!args.watch) return;
   const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
   console.log(`  ${import_picocolors15.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
@@ -283736,7 +283932,226 @@ async function runBranchDev(argv, dependencies = {}) {
   });
 }
 
+// src/whoami.ts
+init_cjs_shims();
+var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_errors13 = require("@abloatai/transaction/errors");
+init_config();
+init_controlPlane();
+
+// src/credentialCapability.ts
+init_cjs_shims();
+var import_credentialPolicy3 = require("@abloatai/transaction/auth/credentialPolicy");
+function secretCounterpart(key) {
+  void key;
+  return "sk_";
+}
+function credentialCapability(key) {
+  const kind = key ? (0, import_credentialPolicy3.classifyCredentialKind)(key) : null;
+  if (!key || kind === null) return { kind, label: "", note: null };
+  const secret = `${secretCounterpart(key)}\u2026`;
+  switch (kind) {
+    case "secret":
+      return { kind, label: "", note: null };
+    case "restricted":
+      return {
+        kind,
+        label: "scoped",
+        note: `A scoped key does exactly what it was minted for. Authoring schema requires a branch-bound secret ${secret} key with schema:push.`
+      };
+    case "publishable":
+      return {
+        kind,
+        label: "read-only",
+        note: `This is the key that is safe to ship in a browser bundle, and it reads. Work from a terminal wants a secret ${secret} key.`
+      };
+    case "ephemeral":
+      return {
+        kind,
+        label: "session key",
+        note: `This is a short-lived credential minted for one signed-in person, and it expires. Pushing a schema needs a secret ${secret} key.`
+      };
+  }
+}
+
+// src/whoami.ts
+init_dbRole();
+init_theme();
+init_target();
+var WHOAMI_USAGE = `  ablo whoami \u2014 show the plane a credential acts on
+
+  Usage
+    npx ablo whoami
+    npx ablo whoami --key-env <NAME>
+    npx ablo whoami --key <VALUE>
+    npx ablo whoami --json
+
+  Credential choice
+    With no flag, uses ABLO_API_KEY, then the active project's stored data key,
+    then the stored login. This command does not load .env files implicitly.
+
+    --key-env reads a named variable from the process, .env.local, or .env
+    without putting its value in shell history or the process list. Prefer it
+    for comparing several keys.
+    --key accepts a value directly for one-off use.
+
+  Output never prints the full credential. Identity is confirmed by the server;
+  an invalid key, unreachable server, or unsupported server fails non-zero.`;
+function parseWhoamiArgs(argv) {
+  let json = false;
+  let key;
+  let keyEnv;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--json":
+        json = true;
+        break;
+      case "--key": {
+        const value = argv[++i];
+        if (!value || value.startsWith("--")) {
+          throw new import_errors13.AbloValidationError("`--key` needs a credential value.", {
+            code: "cli_invalid_arguments"
+          });
+        }
+        key = value;
+        break;
+      }
+      case "--key-env": {
+        const value = argv[++i];
+        if (!value || value.startsWith("--")) {
+          throw new import_errors13.AbloValidationError("`--key-env` needs an environment variable name.", {
+            code: "cli_invalid_arguments"
+          });
+        }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+          throw new import_errors13.AbloValidationError(
+            `\`${value}\` is not a valid environment variable name.`,
+            { code: "cli_invalid_arguments" }
+          );
+        }
+        keyEnv = value;
+        break;
+      }
+      default:
+        throw new import_errors13.AbloValidationError(`unknown whoami flag: ${arg}`, {
+          code: "cli_invalid_arguments"
+        });
+    }
+  }
+  if (key && keyEnv) {
+    throw new import_errors13.AbloValidationError("Choose one credential source: `--key` or `--key-env`.", {
+      code: "cli_invalid_arguments"
+    });
+  }
+  return { json, ...key ? { key } : {}, ...keyEnv ? { keyEnv } : {} };
+}
+function selectWhoamiCredential(args, cwd = process.cwd()) {
+  if (args.key) return { key: args.key, source: "--key", targetSource: "env" };
+  if (args.keyEnv) {
+    const found = readProjectEnvVariable(args.keyEnv, cwd);
+    if (!found) {
+      throw new import_errors13.AbloAuthenticationError(
+        `${args.keyEnv} is not set in the process environment, .env.local, or .env.`,
+        { code: "cli_api_key_missing" }
+      );
+    }
+    return {
+      key: found.value,
+      source: `${found.source}:${args.keyEnv}`,
+      targetSource: "env"
+    };
+  }
+  const runtimeKey = resolveRuntimeApiKey();
+  const dataKey = runtimeKey.key;
+  if (dataKey) {
+    return {
+      key: dataKey,
+      source: runtimeKey.source === "stored" ? "stored data key" : `${runtimeKey.source ?? "env"}:ABLO_API_KEY`,
+      targetSource: runtimeKey.source ?? "stored"
+    };
+  }
+  const managementKey = resolveManagementKey();
+  if (managementKey) {
+    return {
+      key: managementKey,
+      source: process.env.ABLO_MANAGEMENT_KEY ? "env:ABLO_MANAGEMENT_KEY" : "stored login",
+      targetSource: process.env.ABLO_MANAGEMENT_KEY ? "env" : "stored"
+    };
+  }
+  const ambient = ambientEnvKeyNote();
+  throw new import_errors13.AbloAuthenticationError(
+    `No credential found. Run \`ablo login\`, set ABLO_API_KEY, or pass \`--key-env <NAME>\`.${ambient ? `
+
+${ambient}` : ""}`,
+    { code: "cli_api_key_missing" }
+  );
+}
+async function whoami(argv) {
+  const args = parseWhoamiArgs(argv);
+  const selected = selectWhoamiCredential(args);
+  const target = await resolveTarget({
+    url: apiBaseUrl(),
+    apiKey: selected.key,
+    keySource: selected.targetSource,
+    strict: true
+  });
+  const confirmed = target.confirmed;
+  if (!confirmed) {
+    throw new import_errors13.AbloAuthenticationError(
+      "The server did not confirm an identity for this credential.",
+      { code: "identity_resolve_failed" }
+    );
+  }
+  const project = confirmed.project;
+  const projectLabel = project ? project.isDefault ? "default" : project.slug : "default";
+  const actsOn = confirmed.branchId ? confirmed.branchRoot ? "production root" : `branch ${confirmed.branchId}` : confirmed.environment ?? "unknown";
+  const capability = credentialCapability(selected.key);
+  if (args.json) {
+    console.log(
+      JSON.stringify(
+        {
+          authenticated: true,
+          key: {
+            prefix: `${selected.key.slice(0, 12)}\u2026`,
+            source: selected.source,
+            kind: capability.kind
+          },
+          organizationId: confirmed.organizationId,
+          project: project ? {
+            id: project.id,
+            slug: projectLabel,
+            name: project.name,
+            default: project.isDefault
+          } : null,
+          environment: confirmed.environment,
+          branchId: confirmed.branchId ?? null,
+          branchRoot: confirmed.branchRoot ?? false
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+  ${brand("ablo")} ${import_picocolors16.default.dim("whoami")}
+`);
+  console.log(
+    `  ${import_picocolors16.default.dim("key")}     ${selected.key.slice(0, 12)}\u2026 ${import_picocolors16.default.dim(`(${selected.source} \xB7 ${capability.label})`)}`
+  );
+  console.log(`  ${import_picocolors16.default.dim("org")}     ${import_picocolors16.default.dim(confirmed.organizationId)}`);
+  console.log(
+    `  ${import_picocolors16.default.dim("project")} ${import_picocolors16.default.bold(projectLabel)}${project ? ` ${import_picocolors16.default.dim(`(${project.id})`)}` : ""}`
+  );
+  console.log(`  ${import_picocolors16.default.dim("acts on")} ${import_picocolors16.default.bold(actsOn)}`);
+  console.log(`
+  ${import_picocolors16.default.green("\u2713")} ${import_picocolors16.default.dim("credential accepted; target confirmed by the server")}
+`);
+}
+
 // src/commands.ts
+init_push();
 var CORE_GROUPS = ["Start", "Every day", "More"];
 var FULL_GROUPS = [
   "Set up",
@@ -283786,6 +284201,7 @@ var COMMANDS = [
         { run: "connect apply", does: "Run that setup for you, from a one-time admin URL" },
         { run: "connect check", does: "Confirm your database is ready to share changes with Ablo" },
         { run: "connect scan", does: "List anything Ablo ever set up in your database (read-only)" },
+        { run: "connect locate", does: "See which plane holds a database before connecting it" },
         { run: "connect deregister", does: "Disconnect this project's database \u2014 Ablo stops reading and writing it" }
       ]
     }
@@ -283834,6 +284250,7 @@ var COMMANDS = [
   },
   {
     name: "push",
+    usage: PUSH_USAGE,
     core: { group: "Every day", does: "Upload your schema \u2014 schema only; your rows stay in your database" },
     full: {
       group: "Your schema",
@@ -283875,6 +284292,18 @@ var COMMANDS = [
       ]
     }
   },
+  {
+    name: "whoami",
+    usage: WHOAMI_USAGE,
+    full: {
+      group: "See what's happening",
+      rows: [
+        { run: "whoami", does: "Show the server-confirmed plane the active credential acts on" },
+        { run: "whoami --key-env <NAME>", does: "Inspect another key without exposing it in argv" },
+        { run: "whoami --json", does: "Same, machine-readable" }
+      ]
+    }
+  },
   {
     name: "status",
     core: { group: "Every day", does: "See what this key acts on, your pushed schema, and whether writes will work" },
@@ -283913,7 +284342,7 @@ var COMMANDS = [
         { run: "branch check [id|slug]", does: "CI alias for branch status" },
         { run: "branch create <slug>", does: "Create a child of the production root" },
         { run: "branch ensure <slug> --credential", does: "Resolve a branch and mint its expiring CI key" },
-        { run: "branch credential <id>", does: "Mint an expiring branch-bound test key" },
+        { run: "branch credential <id>", does: "Mint an expiring branch-bound runtime key" },
         { run: "branch delete <id>", does: "Delete a non-root branch" }
       ]
     }
@@ -284003,15 +284432,15 @@ function fullRows(group) {
 }
 
 // src/index.ts
-var import_errors20 = require("@abloatai/transaction/errors");
+var import_errors21 = require("@abloatai/transaction/errors");
 init_push();
 
 // src/generate.ts
 init_cjs_shims();
-var import_errors13 = require("@abloatai/transaction/errors");
+var import_errors14 = require("@abloatai/transaction/errors");
 var import_fs8 = require("fs");
 var import_path6 = require("path");
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 var import_schema7 = require("@abloatai/transaction/schema");
 init_push();
 var DEFAULT_SCHEMA_PATH4 = "ablo/schema.ts";
@@ -284034,7 +284463,7 @@ function parseGenerateArgs(argv) {
         out = argv[++i] ?? out;
         break;
       default:
-        throw new import_errors13.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors14.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, out };
@@ -284044,7 +284473,7 @@ async function generate(argv) {
   try {
     args = parseGenerateArgs(argv);
   } catch (err) {
-    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   let source;
@@ -284053,22 +284482,22 @@ async function generate(argv) {
     const schemaJson = JSON.parse((0, import_schema7.serializeSchema)(schema));
     source = (0, import_schema7.generateTypes)(schemaJson);
   } catch (err) {
-    console.error(import_picocolors16.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors17.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const abs = (0, import_path6.resolve)(process.cwd(), args.out);
   (0, import_fs8.mkdirSync)((0, import_path6.dirname)(abs), { recursive: true });
   (0, import_fs8.writeFileSync)(abs, source);
-  console.log(`  ${import_picocolors16.default.green("\u2713")} Generated types \u2192 ${import_picocolors16.default.bold(args.out)}`);
+  console.log(`  ${import_picocolors17.default.green("\u2713")} Generated types \u2192 ${import_picocolors17.default.bold(args.out)}`);
 }
 
 // src/login.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 init_dist2();
-var import_errors14 = require("@abloatai/transaction/errors");
-var import_wire7 = require("@abloatai/transaction/wire");
+var import_errors15 = require("@abloatai/transaction/errors");
+var import_wire8 = require("@abloatai/transaction/wire");
 init_config();
 init_theme();
 var CLIENT_ID = "ablo-cli";
@@ -284086,20 +284515,21 @@ function openBrowser(url) {
   } catch {
   }
 }
-function parseProjectFlag(argv) {
-  const i = argv.indexOf("--project");
+function parseSlugFlag(argv, flag2) {
+  const i = argv.indexOf(flag2);
   if (i >= 0) {
     const slug = argv[i + 1];
     if (slug && !slug.startsWith("-")) return slug;
   }
-  const eq = argv.find((a) => a.startsWith("--project="));
-  return eq ? eq.slice("--project=".length) || void 0 : void 0;
+  const eq = argv.find((a) => a.startsWith(`${flag2}=`));
+  return eq ? eq.slice(flag2.length + 1) || void 0 : void 0;
 }
 async function deviceLogin(argv, deps = {}) {
   const openUrl = deps.openUrl ?? openBrowser;
   Ie(`${brand("ablo")} login`);
-  const requested = parseProjectFlag(argv) ?? getActiveProject()?.slug;
+  const requested = parseSlugFlag(argv, "--project") ?? getActiveProject()?.slug;
   const targetProject = requested === DEFAULT_PROFILE ? void 0 : requested;
+  const targetOrg = parseSlugFlag(argv, "--org");
   const interactive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   let account = "login";
   if (interactive) {
@@ -284126,11 +284556,11 @@ async function deviceLogin(argv, deps = {}) {
     process.exit(1);
   }
   const code = await codeRes.json();
-  const approvePath = `/cli?user_code=${code.user_code}`;
+  const approvePath = `/cli?user_code=${code.user_code}${targetOrg ? `&org=${encodeURIComponent(targetOrg)}` : ""}`;
   const url = account === "signup" ? `${DASHBOARD_URL}/signup?next=${encodeURIComponent(approvePath)}` : `${DASHBOARD_URL}${approvePath}`;
-  Me(`${import_picocolors17.default.bold(code.user_code)}
+  Me(`${import_picocolors18.default.bold(code.user_code)}
 
-${import_picocolors17.default.dim(url)}`, "Approve in your browser");
+${import_picocolors18.default.dim(url)}`, "Approve in your browser");
   openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
@@ -284200,7 +284630,7 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
   }
   if (!provRes.ok) {
     s.stop("Could not provision a key.");
-    const err = (0, import_errors14.translateHttpError)(
+    const err = (0, import_errors15.translateHttpError)(
       provRes.status,
       await provRes.json().catch(() => null),
       provRes.headers.get("x-request-id") ?? void 0
@@ -284208,30 +284638,36 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
     M2.error(err.message);
     if (err.code === "entity_not_found" && targetProject) {
       M2.error(
-        `If that isn't the account you meant, run ${import_picocolors17.default.bold("npx ablo logout")} and sign in again. Otherwise create it with ${import_picocolors17.default.bold(`npx ablo projects create ${targetProject}`)}.`
+        `If that isn't the account you meant, run ${import_picocolors18.default.bold("npx ablo logout")} and sign in again. Otherwise create it with ${import_picocolors18.default.bold(`npx ablo projects create ${targetProject}`)}.`
       );
     } else {
       M2.error(
-        `The browser approval succeeded but the credential handoff failed. Try ${import_picocolors17.default.bold("npx ablo login")} again.`
+        `The browser approval succeeded but the credential handoff failed. Try ${import_picocolors18.default.bold("npx ablo login")} again.`
       );
     }
     process.exit(1);
   }
-  const parsedProv = import_wire7.provisionKeyResponseSchema.safeParse(
+  const parsedProv = import_wire8.provisionKeyResponseSchema.safeParse(
     await provRes.json().catch(() => null)
   );
   if (!parsedProv.success) {
     s.stop("Could not provision a key.");
     M2.error("The key handoff returned something this version does not recognize.");
-    M2.error(`Try again, or upgrade with ${import_picocolors17.default.bold("npm i -g @abloatai/ablo")}.`);
+    M2.error(`Try again, or upgrade with ${import_picocolors18.default.bold("npm i -g @abloatai/ablo")}.`);
     process.exit(1);
   }
   const prov = parsedProv.data;
   const entry = (k3) => ({
     apiKey: k3.apiKey,
     ...prov.organizationId ? { organizationId: prov.organizationId } : {},
+    ...prov.organizationSlug ? { organizationSlug: prov.organizationSlug } : {},
     ...k3.expiresAt ? { expiresAt: k3.expiresAt } : {}
   });
+  if (targetOrg && prov.organizationSlug && prov.organizationSlug !== targetOrg) {
+    M2.warn(
+      `The approval chose ${import_picocolors18.default.bold(prov.organizationSlug)}, not ${import_picocolors18.default.bold(targetOrg)}. The credential is scoped to ${import_picocolors18.default.bold(prov.organizationSlug)}.`
+    );
+  }
   const profileName = prov.project?.slug ?? DEFAULT_PROFILE;
   const path = setProfileKeys(
     profileName,
@@ -284241,9 +284677,10 @@ ${import_picocolors17.default.dim(url)}`, "Approve in your browser");
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
   s.stop(`Saved project credential to ${path}`);
-  const where = prov.project ? ` ${import_picocolors17.default.dim(`(project ${prov.project.slug})`)}` : "";
+  const orgLabel = prov.organizationSlug ? ` to ${import_picocolors18.default.bold(prov.organizationSlug)}` : "";
+  const where = prov.project ? ` ${import_picocolors18.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
-    `${import_picocolors17.default.green("\u2713")} Logged in${where}. Run ${import_picocolors17.default.bold("npx ablo dev")} to create or resume your Git branch and start with an expiring runtime key.`
+    `${import_picocolors18.default.green("\u2713")} Logged in${orgLabel}${where}. Run ${import_picocolors18.default.bold("npx ablo dev")} to create or resume your Git branch and start with an expiring runtime key.`
   );
 }
 async function login(argv = [], deps = {}) {
@@ -284252,14 +284689,14 @@ async function login(argv = [], deps = {}) {
 function logout() {
   const removed = clearCredential();
   if (removed) {
-    console.log(`  ${import_picocolors17.default.green("\u2713")} Logged out ${import_picocolors17.default.dim(`(credentials removed from ${configDir()})`)}`);
+    console.log(`  ${import_picocolors18.default.green("\u2713")} Logged out ${import_picocolors18.default.dim(`(credentials removed from ${configDir()})`)}`);
   } else {
-    console.log(`  ${import_picocolors17.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
+    console.log(`  ${import_picocolors18.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
   if (process.env.ABLO_MANAGEMENT_KEY) {
     console.log(
-      import_picocolors17.default.dim(
-        `  Note: ${import_picocolors17.default.bold("ABLO_MANAGEMENT_KEY")} is still set in this shell and takes precedence.`
+      import_picocolors18.default.dim(
+        `  Note: ${import_picocolors18.default.bold("ABLO_MANAGEMENT_KEY")} is still set in this shell and takes precedence.`
       )
     );
   }
@@ -284271,46 +284708,9 @@ init_projects();
 
 // src/status.ts
 init_cjs_shims();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 init_config();
 init_target();
-
-// src/credentialCapability.ts
-init_cjs_shims();
-var import_credentialPolicy3 = require("@abloatai/transaction/auth/credentialPolicy");
-init_config();
-function secretCounterpart(key) {
-  return modeFromKey(key) === "production" ? "sk_live_" : "sk_test_";
-}
-function credentialCapability(key) {
-  const kind = key ? (0, import_credentialPolicy3.classifyCredentialKind)(key) : null;
-  if (!key || kind === null) return { kind, label: "", note: null };
-  const secret = `${secretCounterpart(key)}\u2026`;
-  switch (kind) {
-    case "secret":
-      return { kind, label: "", note: null };
-    case "restricted":
-      return {
-        kind,
-        label: "scoped",
-        note: `A scoped key does exactly what it was minted for. The production key \`ablo login\` stores is for observing your live plane with \`ablo status\` and \`ablo logs\`; authoring schema there takes a secret ${secret} key from the dashboard.`
-      };
-    case "publishable":
-      return {
-        kind,
-        label: "read-only",
-        note: `This is the key that is safe to ship in a browser bundle, and it reads. Work from a terminal wants a secret ${secret} key.`
-      };
-    case "ephemeral":
-      return {
-        kind,
-        label: "session key",
-        note: `This is a short-lived credential minted for one signed-in person, and it expires. Pushing a schema needs a secret ${secret} key.`
-      };
-  }
-}
-
-// src/status.ts
 init_theme();
 init_controlPlane();
 var import_schema8 = require("@abloatai/transaction/coordination/schema");
@@ -284318,9 +284718,9 @@ init_readiness();
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
   if (Number.isNaN(ms)) return "";
-  if (ms <= 0) return import_picocolors18.default.red("expired");
+  if (ms <= 0) return import_picocolors19.default.red("expired");
   const days = Math.floor(ms / (24 * 60 * 60 * 1e3));
-  return import_picocolors18.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
+  return import_picocolors19.default.dim(days > 0 ? `expires in ${days}d` : "expires <1d");
 }
 async function ping(apiUrl3) {
   const ctrl = new AbortController();
@@ -284341,55 +284741,55 @@ function formatConflict(conflict) {
   const parts = import_schema8.participantKindSchema.options.flatMap((k3) => conflict[k3] ? [`${k3}:${conflict[k3]}`] : []);
   return parts.length ? `{${parts.join(",")}}` : "";
 }
-function printTargetLines(target, localProject, storedOrganizationId) {
+function printTargetLines(target, localProject, storedOrganizationId, storedOrganizationSlug) {
   const confirmed = target?.confirmed ?? null;
   const org = confirmed?.organizationId ?? storedOrganizationId;
   if (org) {
-    const suffix = confirmed?.organizationId ? "" : ` ${import_picocolors18.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors18.default.dim("org")}     ${import_picocolors18.default.dim(org)}${suffix}`);
+    const suffix = confirmed?.organizationId ? "" : ` ${import_picocolors19.default.yellow("(unconfirmed)")}`;
+    const slug = org === storedOrganizationId ? storedOrganizationSlug : void 0;
+    const label = slug ? `${import_picocolors19.default.bold(slug)} ${import_picocolors19.default.dim(`(${org})`)}` : import_picocolors19.default.dim(org);
+    console.log(`  ${import_picocolors19.default.dim("org")}     ${label}${suffix}`);
   } else {
     console.log(
-      `  ${import_picocolors18.default.dim("org")}     ${import_picocolors18.default.yellow("unknown")} ${import_picocolors18.default.dim("(the server did not confirm one for this key)")}`
+      `  ${import_picocolors19.default.dim("org")}     ${import_picocolors19.default.yellow("unknown")} ${import_picocolors19.default.dim("(the server did not confirm one for this key)")}`
     );
   }
   let projectLine;
   if (confirmed?.project) {
     const p2 = confirmed.project;
-    projectLine = p2.isDefault ? `${import_picocolors18.default.bold("default")} ${import_picocolors18.default.dim("(org-default)")}` : `${import_picocolors18.default.bold(p2.slug)} ${import_picocolors18.default.dim(`(${p2.id})`)}`;
+    projectLine = p2.isDefault ? `${import_picocolors19.default.bold("default")} ${import_picocolors19.default.dim("(org-default)")}` : `${import_picocolors19.default.bold(p2.slug)} ${import_picocolors19.default.dim(`(${p2.id})`)}`;
   } else if (confirmed) {
-    projectLine = `${import_picocolors18.default.bold("default")} ${import_picocolors18.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors19.default.bold("default")} ${import_picocolors19.default.dim("(org-default)")}`;
   } else if (localProject) {
-    projectLine = `${import_picocolors18.default.bold(localProject.slug)} ${import_picocolors18.default.dim(`(${localProject.id})`)} ${import_picocolors18.default.yellow("(unconfirmed)")}`;
+    projectLine = `${import_picocolors19.default.bold(localProject.slug)} ${import_picocolors19.default.dim(`(${localProject.id})`)} ${import_picocolors19.default.yellow("(unconfirmed)")}`;
   } else {
-    projectLine = `${import_picocolors18.default.bold("default")} ${target ? import_picocolors18.default.yellow("(unconfirmed)") : import_picocolors18.default.dim("(org-default)")}`;
+    projectLine = `${import_picocolors19.default.bold("default")} ${target ? import_picocolors19.default.yellow("(unconfirmed)") : import_picocolors19.default.dim("(org-default)")}`;
   }
-  console.log(`  ${import_picocolors18.default.dim("project")} ${projectLine}`);
+  console.log(`  ${import_picocolors19.default.dim("project")} ${projectLine}`);
   const branch = confirmed?.branchId ?? null;
   const env = confirmed?.environment ?? target?.keyEnv ?? null;
   if (branch) {
     const label = confirmed?.branchRoot ? "production root" : `branch ${branch}`;
-    console.log(`  ${import_picocolors18.default.dim("acts on")} ${import_picocolors18.default.bold(label)}`);
+    console.log(`  ${import_picocolors19.default.dim("acts on")} ${import_picocolors19.default.bold(label)}`);
   } else if (env) {
-    const suffix = confirmed ? "" : ` ${import_picocolors18.default.yellow("(unconfirmed)")}`;
-    console.log(`  ${import_picocolors18.default.dim("acts on")} ${import_picocolors18.default.bold(env)}${suffix}`);
+    const suffix = confirmed ? "" : ` ${import_picocolors19.default.yellow("(unconfirmed)")}`;
+    console.log(`  ${import_picocolors19.default.dim("acts on")} ${import_picocolors19.default.bold(env)}${suffix}`);
   }
   const divergence = describeMismatches(target?.mismatches ?? []);
-  if (divergence) console.log(`    ${import_picocolors18.default.yellow(`\u26A0 ${divergence}`)}`);
+  if (divergence) console.log(`    ${import_picocolors19.default.yellow(`\u26A0 ${divergence}`)}`);
 }
 async function status(args = []) {
   const apiUrl3 = apiBaseUrl();
   const cfg = readConfig();
   const mode = getMode();
-  const effective = resolveEffectiveApiKey();
-  const target = effective.key ? await resolveTarget({ url: apiUrl3, apiKey: effective.key, keySource: effective.source ?? "stored" }) : null;
+  const runtimeKey = resolveRuntimeApiKey();
+  const target = runtimeKey.key ? await resolveTarget({ url: apiUrl3, apiKey: runtimeKey.key, keySource: runtimeKey.source ?? "stored" }) : null;
   if (args.includes("--json")) {
     const entry = getKeyEntry(mode);
-    const key2 = describeEffectiveKey(mode, process.env.ABLO_API_KEY, entry);
-    const plan2 = resolvePushPlan();
     const activeProject2 = getActiveProject();
-    const pushed2 = await fetchPushedSchema(apiUrl3, effective.key);
+    const pushed2 = await fetchPushedSchema(apiUrl3, runtimeKey.key);
     const reachableForJson = await ping(apiUrl3);
-    const dataSource2 = reachableForJson ? (await fetchRoutingState(apiUrl3, effective.key)).source : { kind: "unknown", detail: "unreachable" };
+    const dataSource2 = reachableForJson ? (await fetchRoutingState(apiUrl3, runtimeKey.key)).source : { kind: "unknown", detail: "unreachable" };
     const driftForJson = schemaDrift(await readLocalSchemaHash(), pushed2?.hash);
     const out = {
       // The locally-active project (`ablo projects use`); null = org-default.
@@ -284397,28 +284797,20 @@ async function status(args = []) {
       // The credential the CLI resolves for requests, with its source —
       // 'env' | '.env.local' | '.env' | 'stored'. Key confusion is a common
       // source of trouble, and the source is usually the answer.
-      effectiveKey: {
-        prefix: effective.key ? effective.key.slice(0, 12) : null,
-        source: effective.source,
+      runtimeKey: {
+        prefix: runtimeKey.key ? runtimeKey.key.slice(0, 12) : null,
+        source: runtimeKey.source,
         // What this credential can do. A pipeline that pushes can read it before
         // running the push, rather than learning from the 403 — the same fact
         // the human output prints, from the same place.
-        kind: credentialCapability(effective.key).kind
+        kind: credentialCapability(runtimeKey.key).kind
       },
-      keyPrefix: key2.keyPrefix,
-      keySource: key2.keySource,
-      keyMode: key2.keyMode,
-      storedKeyPrefix: key2.storedKeyPrefix,
-      keyMatchesActiveMode: key2.keyMatchesActiveMode,
-      keyMatchesStoredActiveKey: key2.keyMatchesStoredActiveKey,
-      keyMismatch: key2.keyMismatch,
       organizationId: entry?.organizationId ?? null,
       // The SERVER-CONFIRMED plane this key resolves to — the authoritative
       // answer to "where does a push land", independent of the local
       // project preference above. Null when the server didn't answer.
       confirmedTarget: target?.confirmed ? {
         organizationId: target.confirmed.organizationId,
-        environment: target.confirmed.environment,
         project: target.confirmed.project,
         projectId: target.confirmed.projectId,
         branchId: target.confirmed.branchId,
@@ -284426,14 +284818,7 @@ async function status(args = []) {
       } : null,
       // Divergence between local project intent and the confirmed target.
       mismatches: target?.mismatches ?? [],
-      // What `ablo push` would do right now — the answer to "why did push
-      // demand a different key".
-      push: {
-        flow: plan2.flow,
-        keyPrefix: plan2.apiKey?.slice(0, 12) ?? null,
-        keySource: plan2.source
-      },
-      // The schema active for this key's environment — the typename and conflict
+      // The schema active for this key's branch — the typename and conflict
       // rules the engine enforces, which may differ from your local `schema.ts`.
       // null means the server did not answer (unreachable, too old, or no key).
       schema: pushed2 ? {
@@ -284453,7 +284838,7 @@ async function status(args = []) {
       drift: driftForJson,
       blockers: blockers({
         reachable: reachableForJson,
-        hasKey: Boolean(effective.key),
+        hasKey: Boolean(runtimeKey.key),
         dataSource: dataSource2,
         schemaPushed: Boolean(pushed2?.active),
         drift: driftForJson
@@ -284463,26 +284848,31 @@ async function status(args = []) {
     return;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors18.default.dim("status")}
+  ${brand("ablo")} ${import_picocolors19.default.dim("status")}
 `);
-  if (effective.key && effective.source && effective.source !== "stored") {
-    const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
+  if (runtimeKey.key && runtimeKey.source && runtimeKey.source !== "stored") {
+    const label = runtimeKey.source === "env" ? "ABLO_API_KEY env" : runtimeKey.source;
     console.log(
-      `  ${import_picocolors18.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors18.default.dim(`(${label} \u2014 overrides stored)`)}`
+      `  ${import_picocolors19.default.dim("key")}     ${runtimeKey.key.slice(0, 12)}\u2026 ${import_picocolors19.default.dim(`(${label} \u2014 overrides stored)`)}`
     );
   } else if (!cfg) {
-    console.log(`  ${import_picocolors18.default.yellow("!")} Not logged in \u2014 run ${import_picocolors18.default.bold("ablo login")}.`);
+    console.log(`  ${import_picocolors19.default.yellow("!")} Not logged in \u2014 run ${import_picocolors19.default.bold("ablo login")}.`);
   }
   const activeEntry = getKeyEntry(mode);
-  const key = describeEffectiveKey(mode, process.env.ABLO_API_KEY, activeEntry);
-  if (key.keyMismatch) {
-    console.log(`    ${import_picocolors18.default.yellow(`! ${key.keyMismatch.message}`)}`);
-  }
   const activeProject = getActiveProject();
-  printTargetLines(target, activeProject, activeEntry?.organizationId);
+  printTargetLines(
+    target,
+    activeProject,
+    activeEntry?.organizationId,
+    activeEntry?.organizationSlug
+  );
+  const management = getManagementKeyEntry();
+  console.log(
+    `  ${import_picocolors19.default.dim("\u25CB")} ${"management".padEnd(12)}  ${management ? import_picocolors19.default.dim(`${management.apiKey.slice(0, 12)}\u2026${management.expiresAt ? ` \xB7 ${expiryLabel(management.expiresAt)}` : ""}`) : import_picocolors19.default.dim("\u2014 no key")}`
+  );
   for (const { key: m2, label } of [
-    { key: "sandbox", label: "management" },
-    { key: "production", label: "observer" }
+    { key: "sandbox", label: "legacy child" },
+    { key: "production", label: "legacy root" }
   ]) {
     const entry = getKeyEntry(m2);
     if (entry) {
@@ -284490,106 +284880,104 @@ async function status(args = []) {
         credentialCapability(entry.apiKey).label,
         entry.expiresAt ? expiryLabel(entry.expiresAt) : ""
       ].filter(Boolean);
-      const trail = facts.length ? ` ${import_picocolors18.default.dim("\xB7")} ${facts.join(import_picocolors18.default.dim(" \xB7 "))}` : "";
+      const trail = facts.length ? ` ${import_picocolors19.default.dim("\xB7")} ${facts.join(import_picocolors19.default.dim(" \xB7 "))}` : "";
       console.log(
-        `  ${import_picocolors18.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors18.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
+        `  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(12)}  ${import_picocolors19.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
       );
-    } else {
-      console.log(`  ${import_picocolors18.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors18.default.dim("\u2014 no key")}`);
     }
   }
-  const plan = resolvePushPlan();
+  const pushBranch = target?.confirmed?.branchRoot === true ? "production root" : target?.confirmed?.branchId ? `branch ${target.confirmed.branchId}` : runtimeKey.key ? "unknown branch" : "no branch";
   console.log(
-    `  ${import_picocolors18.default.dim("push")}    ${plan.apiKey ? `${import_picocolors18.default.bold(plan.flow)} ${import_picocolors18.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors18.default.bold(plan.flow)} ${import_picocolors18.default.yellow("\u2014 no credential")} ${import_picocolors18.default.dim(`(run ${import_picocolors18.default.bold("ablo login")} or set ${import_picocolors18.default.bold("ABLO_API_KEY")})`)}`}`
+    `  ${import_picocolors19.default.dim("push")}    ${runtimeKey.key ? `${import_picocolors19.default.bold(pushBranch)} ${import_picocolors19.default.dim(`with ${runtimeKey.key.slice(0, 12)}\u2026 (${runtimeKey.source})`)}` : `${import_picocolors19.default.bold(pushBranch)} ${import_picocolors19.default.yellow("\u2014 no runtime key")} ${import_picocolors19.default.dim(`(set ${import_picocolors19.default.bold("ABLO_API_KEY")} or run ${import_picocolors19.default.bold("ablo dev")})`)}`}`
   );
-  const capability = credentialCapability(effective.key);
-  if (capability.note) console.log(`    ${import_picocolors18.default.dim(capability.note)}`);
-  process.stdout.write(`  ${import_picocolors18.default.dim("api")}     ${apiUrl3}  `);
+  const capability = credentialCapability(runtimeKey.key);
+  if (capability.note) console.log(`    ${import_picocolors19.default.dim(capability.note)}`);
+  process.stdout.write(`  ${import_picocolors19.default.dim("api")}     ${apiUrl3}  `);
   const reachable = await ping(apiUrl3);
-  console.log(reachable ? import_picocolors18.default.green("reachable") : import_picocolors18.default.red("unreachable"));
-  const introspectKey = effective.key;
+  console.log(reachable ? import_picocolors19.default.green("reachable") : import_picocolors19.default.red("unreachable"));
+  const introspectKey = runtimeKey.key;
   const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, introspectKey) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
   if (dataSource.kind === "connected") {
     const how = [...new Set(dataSource.connections)].join(" + ");
     const pooled = detectPoolerIn(dataSource.hosts);
     const unreachable = validation && !validation.ok ? validation.message : void 0;
-    console.log(`  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.green("\u2713")} ${import_picocolors18.default.dim(`database connected to this plane (${how})`)}`);
+    console.log(`  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim(`database connected to this plane (${how})`)}`);
     if (pooled) {
       console.log(
-        `          ${import_picocolors18.default.yellow("\u26A0")} ${import_picocolors18.default.dim(
+        `          ${import_picocolors19.default.yellow("\u26A0")} ${import_picocolors19.default.dim(
           `${pooled.host} is a connection pooler` + (pooled.direct ? `; register the direct host instead: ${pooled.direct}` : "; register the direct host instead")
         )}`
       );
     }
     if (unreachable) {
-      console.log(`          ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.dim(`Ablo could not reach it \u2014 ${unreachable}`)}`);
+      console.log(`          ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.dim(`Ablo could not reach it \u2014 ${unreachable}`)}`);
     }
   } else if (dataSource.kind === "none") {
     console.log(
-      `  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.red("\u2717 no database connected to this plane")} ${import_picocolors18.default.dim("\u2014 writes are held")}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 no database connected to this plane")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
     );
   } else if (reachable) {
-    console.log(`  ${import_picocolors18.default.dim("data")}    ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`);
+    console.log(`  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`);
   }
   const pushed = reachable ? await fetchPushedSchema(apiUrl3, introspectKey) : null;
   if (reachable) {
     if (pushed?.active) {
-      const when = pushed.pushedAt ? ` ${import_picocolors18.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
-      const ver = pushed.version != null ? ` ${import_picocolors18.default.dim(`(rev ${pushed.version})`)}` : "";
-      const hashLabel = pushed.hash ? ` ${import_picocolors18.default.dim(`hash ${pushed.hash}`)}` : "";
-      console.log(`  ${import_picocolors18.default.dim("schema")}  ${import_picocolors18.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
+      const when = pushed.pushedAt ? ` ${import_picocolors19.default.dim(`@ ${pushed.pushedAt.slice(0, 10)}`)}` : "";
+      const ver = pushed.version != null ? ` ${import_picocolors19.default.dim(`(rev ${pushed.version})`)}` : "";
+      const hashLabel = pushed.hash ? ` ${import_picocolors19.default.dim(`hash ${pushed.hash}`)}` : "";
+      console.log(`  ${import_picocolors19.default.dim("schema")}  ${import_picocolors19.default.bold(`${pushed.models.length} models pushed`)}${ver}${hashLabel}${when}`);
       for (const m2 of pushed.models) {
-        const tn = m2.typename === m2.key ? import_picocolors18.default.dim(`typename=${m2.typename}`) : import_picocolors18.default.yellow(`typename=${m2.typename}`);
+        const tn = m2.typename === m2.key ? import_picocolors19.default.dim(`typename=${m2.typename}`) : import_picocolors19.default.yellow(`typename=${m2.typename}`);
         const conflict = formatConflict(m2.conflict);
-        const conflictStr2 = conflict ? `  ${import_picocolors18.default.dim(`conflict=${conflict}`)}` : "";
-        console.log(`          ${import_picocolors18.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
+        const conflictStr2 = conflict ? `  ${import_picocolors19.default.dim(`conflict=${conflict}`)}` : "";
+        console.log(`          ${import_picocolors19.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
       }
     } else if (pushed && !pushed.active) {
-      console.log(`  ${import_picocolors18.default.dim("schema")}  ${import_picocolors18.default.yellow("none pushed")} ${import_picocolors18.default.dim(`(run ${import_picocolors18.default.bold("ablo push")} or ${import_picocolors18.default.bold("ablo dev")})`)}`);
+      console.log(`  ${import_picocolors19.default.dim("schema")}  ${import_picocolors19.default.yellow("none pushed")} ${import_picocolors19.default.dim(`(run ${import_picocolors19.default.bold("ablo push")} or ${import_picocolors19.default.bold("ablo dev")})`)}`);
     }
   }
   const drift = schemaDrift(await readLocalSchemaHash(), pushed?.hash);
   if (drift) {
     console.log(
-      `  ${import_picocolors18.default.dim("drift")}   ${import_picocolors18.default.red("\u2717 local schema differs from the server")} ` + import_picocolors18.default.dim(`(local ${drift.local}, server ${drift.server})`)
+      `  ${import_picocolors19.default.dim("drift")}   ${import_picocolors19.default.red("\u2717 local schema differs from the server")} ` + import_picocolors19.default.dim(`(local ${drift.local}, server ${drift.server})`)
     );
   }
   const found = blockers({
     reachable,
-    hasKey: Boolean(effective.key),
+    hasKey: Boolean(runtimeKey.key),
     dataSource,
     schemaPushed: Boolean(pushed?.active),
     drift
   });
   console.log();
   if (found.length > 0) {
-    console.log(`  ${import_picocolors18.default.red("\u2717")} ${import_picocolors18.default.bold("writes would fail right now")}`);
+    console.log(`  ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.bold("writes would fail right now")}`);
     for (const b4 of found) {
-      console.log(`    ${import_picocolors18.default.dim("\xB7")} ${b4.problem}`);
-      console.log(`      ${import_picocolors18.default.dim(b4.fix)}`);
+      console.log(`    ${import_picocolors19.default.dim("\xB7")} ${b4.problem}`);
+      console.log(`      ${import_picocolors19.default.dim(b4.fix)}`);
     }
   } else if (dataSource.kind === "unknown") {
     console.log(
-      `  ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
+      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
     );
   } else {
-    console.log(`  ${import_picocolors18.default.green("\u2713")} ${import_picocolors18.default.dim("ready \u2014 a write should succeed")}`);
+    console.log(`  ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim("ready \u2014 a write should succeed")}`);
   }
   console.log();
 }
 
 // src/doctor.ts
 init_cjs_shims();
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 init_theme();
 init_controlPlane();
 init_config();
 init_target();
 init_readiness();
 function render(check2) {
-  const mark = check2.state === "ok" ? import_picocolors19.default.green("\u2713") : check2.state === "fail" ? import_picocolors19.default.red("\u2717") : import_picocolors19.default.dim("\u2013");
-  console.log(`  ${mark} ${check2.label.padEnd(10)} ${check2.state === "fail" ? check2.detail : import_picocolors19.default.dim(check2.detail)}`);
-  if (check2.fix) console.log(`    ${" ".repeat(11)}${import_picocolors19.default.dim(`\u2192 ${check2.fix}`)}`);
+  const mark = check2.state === "ok" ? import_picocolors20.default.green("\u2713") : check2.state === "fail" ? import_picocolors20.default.red("\u2717") : import_picocolors20.default.dim("\u2013");
+  console.log(`  ${mark} ${check2.label.padEnd(10)} ${check2.state === "fail" ? check2.detail : import_picocolors20.default.dim(check2.detail)}`);
+  if (check2.fix) console.log(`    ${" ".repeat(11)}${import_picocolors20.default.dim(`\u2192 ${check2.fix}`)}`);
 }
 async function ping2(apiUrl3) {
   const ctrl = new AbortController();
@@ -284607,16 +284995,16 @@ async function ping2(apiUrl3) {
 }
 async function doctor() {
   console.log(`
-  ${brand("ablo")} ${import_picocolors19.default.dim("doctor")}
+  ${brand("ablo")} ${import_picocolors20.default.dim("doctor")}
 `);
   const apiUrl3 = apiBaseUrl();
-  const effective = resolveEffectiveApiKey();
+  const runtimeKey = resolveRuntimeApiKey();
   const checks = [];
-  if (effective.key) {
+  if (runtimeKey.key) {
     checks.push({
       label: "key",
       state: "ok",
-      detail: `${effective.key.slice(0, 12)}\u2026 from ${effective.source}`
+      detail: `${runtimeKey.key.slice(0, 12)}\u2026 from ${runtimeKey.source}`
     });
   } else {
     checks.push({
@@ -284635,7 +285023,7 @@ async function doctor() {
       fix: "check your connection, then re-run `ablo doctor`"
     }
   );
-  const target = effective.key ? await resolveTarget({ url: apiUrl3, apiKey: effective.key, keySource: effective.source ?? "stored" }) : null;
+  const target = runtimeKey.key ? await resolveTarget({ url: apiUrl3, apiKey: runtimeKey.key, keySource: runtimeKey.source ?? "stored" }) : null;
   const confirmed = target?.confirmed ?? null;
   if (confirmed) {
     const project = confirmed.project ? confirmed.project.isDefault ? "default" : confirmed.project.name === null ? `${confirmed.project.id} (unnamed \u2014 ${confirmed.project.unnamedReason ?? "the project list did not answer"})` : `${confirmed.project.slug} (${confirmed.project.id})` : "default";
@@ -284648,12 +285036,12 @@ async function doctor() {
     const local = getActiveProject();
     checks.push({
       label: "identity",
-      state: effective.key && reachable ? "fail" : "skip",
-      detail: effective.key ? `the server did not resolve this key${local ? ` (locally selected: ${local.slug})` : ""}` : "no key to resolve",
-      fix: effective.key ? "check the key is valid and not expired \u2014 `ablo login` mints a fresh pair" : void 0
+      state: runtimeKey.key && reachable ? "fail" : "skip",
+      detail: runtimeKey.key ? `the server did not resolve this key${local ? ` (locally selected: ${local.slug})` : ""}` : "no key to resolve",
+      fix: runtimeKey.key ? "check the key is valid and not expired \u2014 `ablo login` mints a fresh pair" : void 0
     });
   }
-  const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, effective.key) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
+  const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, runtimeKey.key) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
   if (dataSource.kind === "connected") {
     const how = [...new Set(dataSource.connections)].join(" + ");
     const pooled = detectPoolerIn(dataSource.hosts);
@@ -284675,13 +285063,13 @@ async function doctor() {
   } else {
     checks.push({ label: "data", state: "skip", detail: `not determined (${dataSource.detail})` });
   }
-  const pushed = reachable ? await fetchPushedSchema(apiUrl3, effective.key) : null;
+  const pushed = reachable ? await fetchPushedSchema(apiUrl3, runtimeKey.key) : null;
   checks.push(
     pushed?.active ? {
       label: "schema",
       state: "ok",
       detail: `${pushed.models.length} models active${pushed.hash ? `, hash ${pushed.hash}` : ""}`
-    } : reachable && effective.key ? { label: "schema", state: "fail", detail: "none active for this key", fix: "run `ablo push`" } : { label: "schema", state: "skip", detail: "not determined" }
+    } : reachable && runtimeKey.key ? { label: "schema", state: "fail", detail: "none active for this key", fix: "run `ablo push`" } : { label: "schema", state: "skip", detail: "not determined" }
   );
   const drift = schemaDrift(await readLocalSchemaHash(), pushed?.hash);
   if (drift) {
@@ -284712,7 +285100,7 @@ async function doctor() {
   for (const check2 of checks) render(check2);
   const blocking = blockers({
     reachable,
-    hasKey: Boolean(effective.key),
+    hasKey: Boolean(runtimeKey.key),
     dataSource,
     schemaPushed: Boolean(pushed?.active),
     drift
@@ -284722,15 +285110,15 @@ async function doctor() {
   console.log();
   if (failed > 0) {
     console.log(
-      `  ${import_picocolors19.default.red("\u2717")} ${import_picocolors19.default.bold(`${failed} problem${failed === 1 ? "" : "s"}`)}` + import_picocolors19.default.dim(skipped > 0 ? `, ${skipped} check${skipped === 1 ? "" : "s"} skipped` : "")
+      `  ${import_picocolors20.default.red("\u2717")} ${import_picocolors20.default.bold(`${failed} problem${failed === 1 ? "" : "s"}`)}` + import_picocolors20.default.dim(skipped > 0 ? `, ${skipped} check${skipped === 1 ? "" : "s"} skipped` : "")
     );
-    console.log(import_picocolors19.default.dim("    Fix them in the order above \u2014 an earlier one often explains a later one."));
+    console.log(import_picocolors20.default.dim("    Fix them in the order above \u2014 an earlier one often explains a later one."));
   } else if (skipped > 0) {
     console.log(
-      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`nothing is blocking a write, but ${skipped} check${skipped === 1 ? "" : "s"} could not be run`)}`
+      `  ${import_picocolors20.default.yellow("?")} ${import_picocolors20.default.dim(`nothing is blocking a write, but ${skipped} check${skipped === 1 ? "" : "s"} could not be run`)}`
     );
   } else {
-    console.log(`  ${import_picocolors19.default.green("\u2713")} ${import_picocolors19.default.dim("everything checks out \u2014 a write should succeed")}`);
+    console.log(`  ${import_picocolors20.default.green("\u2713")} ${import_picocolors20.default.dim("everything checks out \u2014 a write should succeed")}`);
   }
   console.log();
   if (blocking.length > 0 || failed > 0) process.exitCode = 1;
@@ -284738,9 +285126,9 @@ async function doctor() {
 
 // src/logs.ts
 init_cjs_shims();
-var import_errors15 = require("@abloatai/transaction/errors");
-var import_wire8 = require("@abloatai/transaction/wire");
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_errors16 = require("@abloatai/transaction/errors");
+var import_wire9 = require("@abloatai/transaction/wire");
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 init_config();
 init_theme();
 init_controlPlane();
@@ -284751,8 +285139,7 @@ function parseLogsArgs(argv) {
     since: void 0,
     model: void 0,
     op: void 0,
-    json: false,
-    mode: void 0
+    json: false
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -284780,15 +285167,13 @@ function parseLogsArgs(argv) {
       case "--json":
         args.json = true;
         break;
-      case "--mode": {
-        const raw = argv[++i];
-        const m2 = normalizeMode(raw);
-        if (!m2) throw new import_errors15.AbloValidationError(`--mode expects "sandbox" or "production", got "${raw}"`, { code: "cli_invalid_arguments" });
-        args.mode = m2;
-        break;
-      }
+      case "--mode":
+        throw new import_errors16.AbloValidationError(
+          "--mode was removed. Logs follow the branch bound to ABLO_API_KEY; select a different branch by supplying its key.",
+          { code: "cli_invalid_arguments" }
+        );
       default:
-        throw new import_errors15.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors16.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return args;
@@ -284807,10 +285192,10 @@ function resolveSince(since) {
 var sleep2 = (ms) => new Promise((r2) => setTimeout(r2, ms));
 function colorOp(op) {
   const label = op.padEnd(6);
-  if (op === "create") return import_picocolors20.default.green(label);
-  if (op === "update") return import_picocolors20.default.yellow(label);
-  if (op === "delete") return import_picocolors20.default.red(label);
-  return import_picocolors20.default.dim(label);
+  if (op === "create") return import_picocolors21.default.green(label);
+  if (op === "update") return import_picocolors21.default.yellow(label);
+  if (op === "delete") return import_picocolors21.default.red(label);
+  return import_picocolors21.default.dim(label);
 }
 function render2(e2, json) {
   if (json) {
@@ -284819,21 +285204,21 @@ function render2(e2, json) {
     return;
   }
   const t = new Date(e2.at).toLocaleTimeString();
-  const actor = e2.actor ? import_picocolors20.default.dim(`  ${e2.actor}`) : "";
-  console.log(`  ${import_picocolors20.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors20.default.bold(e2.model)} ${import_picocolors20.default.dim(e2.recordId)}${actor}`);
+  const actor = e2.actor ? import_picocolors21.default.dim(`  ${e2.actor}`) : "";
+  console.log(`  ${import_picocolors21.default.dim(t)}  ${colorOp(e2.op)}  ${import_picocolors21.default.bold(e2.model)} ${import_picocolors21.default.dim(e2.recordId)}${actor}`);
 }
 async function logs(argv) {
   let args;
   try {
     args = parseLogsArgs(argv);
   } catch (err) {
-    console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  const apiKey = resolveApiKey(args.mode);
+  const apiKey = resolveRuntimeApiKey().key;
   if (!apiKey) {
     console.error(
-      import_picocolors20.default.red(`  No API key.`) + import_picocolors20.default.dim(` Run ${import_picocolors20.default.bold("ablo login")} or set ${import_picocolors20.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors21.default.red(`  No API key.`) + import_picocolors21.default.dim(` Run ${import_picocolors21.default.bold("ablo login")} or set ${import_picocolors21.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
@@ -284847,18 +285232,18 @@ async function logs(argv) {
     if (!res) return null;
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
-      console.error(import_picocolors20.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
+      console.error(import_picocolors21.default.red(`  logs failed (${res.status}): ${body.reason ?? body.message ?? ""}`));
       process.exit(1);
     }
     const json = await res.json();
     return {
       events: json.data ?? json.events ?? [],
-      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire8.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire8.formatFeedCursor)(import_wire8.FEED_CURSOR_START))
+      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire9.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire9.formatFeedCursor)(import_wire9.FEED_CURSOR_START))
     };
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors20.default.dim("logs")} ${import_picocolors20.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors21.default.dim("logs")}
 `);
   }
   const initial = await fetchPage({
@@ -284868,13 +285253,13 @@ async function logs(argv) {
     ...args.op ? { op: args.op } : {}
   });
   if (!initial) {
-    console.error(import_picocolors20.default.red(`  Couldn't reach ${baseUrl2}.`));
+    console.error(import_picocolors21.default.red(`  Couldn't reach ${baseUrl2}.`));
     process.exit(1);
   }
   for (const e2 of initial.events) render2(e2, args.json);
   let cursor = initial.cursor;
   if (!args.follow) return;
-  if (!args.json) console.log(`  ${import_picocolors20.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
+  if (!args.json) console.log(`  ${import_picocolors21.default.dim("watching for new activity \u2026 (Ctrl-C to stop)")}
 `);
   for (; ; ) {
     await sleep2(1500);
@@ -284885,16 +285270,16 @@ async function logs(argv) {
     });
     if (!page) continue;
     for (const e2 of page.events) render2(e2, args.json);
-    const prev = (0, import_wire8.parseFeedCursor)(cursor);
-    const next = (0, import_wire8.parseFeedCursor)(page.cursor);
-    if (prev && next && (0, import_wire8.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
+    const prev = (0, import_wire9.parseFeedCursor)(cursor);
+    const next = (0, import_wire9.parseFeedCursor)(page.cursor);
+    if (prev && next && (0, import_wire9.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
   }
 }
 
 // src/webhooks.ts
 init_cjs_shims();
 var import_fs9 = require("fs");
-var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 var import_credentialPolicy4 = require("@abloatai/transaction/auth/credentialPolicy");
 init_config();
 init_theme();
@@ -284924,15 +285309,15 @@ function positional(args) {
   return void 0;
 }
 function requireKey3(mode) {
-  const apiKey = resolveApiKey(mode);
+  const apiKey = resolveMutationApiKey(mode);
   if (!apiKey) {
     console.error(
-      import_picocolors21.default.red("  No API key.") + import_picocolors21.default.dim(` Run ${import_picocolors21.default.bold("ablo login")} or set ${import_picocolors21.default.bold("ABLO_API_KEY")}.`)
+      import_picocolors22.default.red("  No API key.") + import_picocolors22.default.dim(` Run ${import_picocolors22.default.bold("ablo login")} or set ${import_picocolors22.default.bold("ABLO_API_KEY")}.`)
     );
     process.exit(1);
   }
   if ((0, import_credentialPolicy4.classifyCredentialKind)(apiKey) !== "secret") {
-    console.error(import_picocolors21.default.red("  Managing webhooks requires a secret key ") + import_picocolors21.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors22.default.red("  Managing webhooks requires a branch-bound secret key ") + import_picocolors22.default.dim("(sk_)."));
     process.exit(1);
   }
   return apiKey;
@@ -284948,12 +285333,12 @@ async function api(apiKey, method, path, body) {
     ...body ? { body: JSON.stringify(body) } : {}
   }).catch(() => null);
   if (!res) {
-    console.error(import_picocolors21.default.red(`  Couldn't reach ${baseUrl()}.`));
+    console.error(import_picocolors22.default.red(`  Couldn't reach ${baseUrl()}.`));
     process.exit(1);
   }
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    console.error(import_picocolors21.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
+    console.error(import_picocolors22.default.red(`  Request failed (${res.status}): ${err.message ?? err.reason ?? ""}`));
     process.exit(1);
   }
   return await res.json();
@@ -284975,11 +285360,11 @@ ${line}
   return file;
 }
 function printEndpoint(e2) {
-  const dot = e2.status === "enabled" ? import_picocolors21.default.green("\u25CF") : import_picocolors21.default.red("\u25CF");
-  const health = e2.last_error ? import_picocolors21.default.red(` last error: ${e2.last_error}`) : "";
-  console.log(`  ${dot} ${import_picocolors21.default.bold(e2.id)}  ${e2.url}`);
+  const dot = e2.status === "enabled" ? import_picocolors22.default.green("\u25CF") : import_picocolors22.default.red("\u25CF");
+  const health = e2.last_error ? import_picocolors22.default.red(` last error: ${e2.last_error}`) : "";
+  console.log(`  ${dot} ${import_picocolors22.default.bold(e2.id)}  ${e2.url}`);
   console.log(
-    import_picocolors21.default.dim(
+    import_picocolors22.default.dim(
       `      ${e2.status} \xB7 ${e2.environment} \xB7 events ${e2.enabled_events.join(",")} \xB7 cursor ${e2.cursor ?? "\u2014"}${health}`
     )
   );
@@ -284991,7 +285376,7 @@ async function webhooks(argv) {
   if (sub === "create") {
     const url = positional(rest);
     if (!url) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks create <url>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
@@ -285003,8 +285388,8 @@ async function webhooks(argv) {
     });
     const file = writeSecretToEnv(created.secret);
     console.log(`
-  ${import_picocolors21.default.green("\u2713")} Registered ${import_picocolors21.default.bold(created.id)} \u2192 ${created.url}`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Wrote ${import_picocolors21.default.bold(ENV_KEY)} to ${import_picocolors21.default.bold(file)} ${import_picocolors21.default.dim("(shown once)")}
+  ${import_picocolors22.default.green("\u2713")} Registered ${import_picocolors22.default.bold(created.id)} \u2192 ${created.url}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Wrote ${import_picocolors22.default.bold(ENV_KEY)} to ${import_picocolors22.default.bold(file)} ${import_picocolors22.default.dim("(shown once)")}
 `);
     return;
   }
@@ -285012,7 +285397,7 @@ async function webhooks(argv) {
     const apiKey = requireKey3(mode);
     const { data } = await api(apiKey, "GET", "");
     if (data.length === 0) {
-      console.log(import_picocolors21.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
+      console.log(import_picocolors22.default.dim("  No webhook endpoints. ") + brand("ablo webhooks create <url>"));
       return;
     }
     console.log();
@@ -285023,40 +285408,40 @@ async function webhooks(argv) {
   if (sub === "roll") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks roll <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     const rolled = await api(apiKey, "POST", `/${id}/roll_secret`);
     const file = writeSecretToEnv(rolled.secret);
     console.log(`
-  ${import_picocolors21.default.green("\u2713")} Rolled secret for ${import_picocolors21.default.bold(id)} \u2192 ${import_picocolors21.default.bold(file)} ${import_picocolors21.default.dim("(old secret now invalid)")}
+  ${import_picocolors22.default.green("\u2713")} Rolled secret for ${import_picocolors22.default.bold(id)} \u2192 ${import_picocolors22.default.bold(file)} ${import_picocolors22.default.dim("(old secret now invalid)")}
 `);
     return;
   }
   if (sub === "enable") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks enable <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     const e2 = await api(apiKey, "POST", `/${id}/enable`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Re-enabled ${import_picocolors21.default.bold(e2.id)}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Re-enabled ${import_picocolors22.default.bold(e2.id)}`);
     return;
   }
   if (sub === "rm" || sub === "delete") {
     const id = positional(rest);
     if (!id) {
-      console.error(import_picocolors21.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
+      console.error(import_picocolors22.default.red("  Usage: ") + brand("ablo webhooks rm <id>"));
       process.exit(1);
     }
     const apiKey = requireKey3(mode);
     await api(apiKey, "DELETE", `/${id}`);
-    console.log(`  ${import_picocolors21.default.green("\u2713")} Removed ${import_picocolors21.default.bold(id)}`);
+    console.log(`  ${import_picocolors22.default.green("\u2713")} Removed ${import_picocolors22.default.bold(id)}`);
     return;
   }
-  console.log(`  ${import_picocolors21.default.bold("Usage:")}`);
+  console.log(`  ${import_picocolors22.default.bold("Usage:")}`);
   console.log(`    ${brand("ablo webhooks create <url>")}   Register an endpoint; writes ${ENV_KEY}`);
   console.log(`    ${brand("ablo webhooks list")}           List endpoints + delivery health`);
   console.log(`    ${brand("ablo webhooks roll <id>")}       Mint a fresh signing secret`);
@@ -285067,8 +285452,8 @@ async function webhooks(argv) {
 
 // src/check.ts
 init_cjs_shims();
-var import_errors16 = require("@abloatai/transaction/errors");
-var import_picocolors22 = __toESM(require_picocolors(), 1);
+var import_errors17 = require("@abloatai/transaction/errors");
+var import_picocolors23 = __toESM(require_picocolors(), 1);
 init_src();
 var import_schema9 = require("@abloatai/transaction/schema");
 init_push();
@@ -285215,7 +285600,7 @@ function parseCheckArgs(argv) {
         appSchema = argv[++i] ?? appSchema;
         break;
       default:
-        throw new import_errors16.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors17.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, appSchema };
@@ -285229,22 +285614,22 @@ function hostOf(connectionString) {
 }
 async function reportReadSubject(dbUrl) {
   const host = hostOf(dbUrl);
-  console.log(`  ${import_picocolors22.default.dim("reading")} ${import_picocolors22.default.bold(host ?? "your database")}`);
-  const effective = resolveEffectiveApiKey();
-  const state = await fetchDataSourceState(apiBaseUrl(), effective.key);
+  console.log(`  ${import_picocolors23.default.dim("reading")} ${import_picocolors23.default.bold(host ?? "your database")}`);
+  const runtimeKey = resolveRuntimeApiKey();
+  const state = await fetchDataSourceState(apiBaseUrl(), runtimeKey.key);
   if (state.kind === "unknown") {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("?")} ${import_picocolors22.default.dim(`couldn't ask which database Ablo reads (${state.detail})`)}
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("?")} ${import_picocolors23.default.dim(`couldn't ask which database Ablo reads (${state.detail})`)}
 `
     );
     return;
   }
   if (state.kind === "none") {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
     );
     console.log(
-      `           ${import_picocolors22.default.dim(`Connect it with ${import_picocolors22.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}
+      `           ${import_picocolors23.default.dim(`Connect it with ${import_picocolors23.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}
 `
     );
     return;
@@ -285252,15 +285637,15 @@ async function reportReadSubject(dbUrl) {
   const registered = [...new Set(state.hosts)];
   if (host && registered.length > 0 && !registered.includes(host)) {
     console.log(
-      `  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.yellow("!")} Ablo reads ${import_picocolors22.default.bold(registered.join(", "))}`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} Ablo reads ${import_picocolors23.default.bold(registered.join(", "))}`
     );
     console.log(
-      `           ${import_picocolors22.default.dim("If that is this database under a pooled hostname, this is fine \u2014 otherwise the report below describes a database Ablo never reads.")}
+      `           ${import_picocolors23.default.dim("If that is this database under a pooled hostname, this is fine \u2014 otherwise the report below describes a database Ablo never reads.")}
 `
     );
     return;
   }
-  console.log(`  ${import_picocolors22.default.dim("ablo")}    ${import_picocolors22.default.green("\u2713")} ${import_picocolors22.default.dim("reads this database")}
+  console.log(`  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.green("\u2713")} ${import_picocolors23.default.dim("reads this database")}
 `);
 }
 async function check(argv) {
@@ -285268,20 +285653,20 @@ async function check(argv) {
   try {
     args = parseCheckArgs(argv);
   } catch (err) {
-    console.error(import_picocolors22.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors23.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = readProjectAdminDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors22.default.red(`  No database.`) + import_picocolors22.default.dim(` Set ${import_picocolors22.default.bold(ADMIN_URL_VAR)} to the Postgres you want Ablo to adopt.`)
+      import_picocolors23.default.red(`  No database.`) + import_picocolors23.default.dim(` Set ${import_picocolors23.default.bold(ADMIN_URL_VAR)} to the Postgres you want Ablo to adopt.`)
     );
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const schemaJson = JSON.parse((0, import_schema9.serializeSchema)(schema));
   console.log(`
-  ${brand("ablo")} ${import_picocolors22.default.dim("check")}  ${import_picocolors22.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors23.default.dim("check")}  ${import_picocolors23.default.dim(`schema "${args.appSchema}"`)}
 `);
   await reportReadSubject(dbUrl);
   const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
@@ -285293,7 +285678,7 @@ async function check(argv) {
       [args.appSchema]
     );
   } catch (err) {
-    console.error(import_picocolors22.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors23.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     await sql.end({ timeout: 2 });
     process.exit(1);
   }
@@ -285315,7 +285700,7 @@ async function check(argv) {
     declaredTables.add(table);
     const present = colsByTable.get(table);
     if (!present) {
-      console.log(`  ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} table ${import_picocolors22.default.bold(table)} ${import_picocolors22.default.red("not found")}`);
+      console.log(`  ${import_picocolors23.default.red("\u2717")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} table ${import_picocolors23.default.bold(table)} ${import_picocolors23.default.red("not found")}`);
       errors++;
       continue;
     }
@@ -285337,26 +285722,26 @@ async function check(argv) {
       if (!present.has(col)) problems.push(`missing column "${col}" (field ${fieldName})`);
     }
     if (problems.length > 0) {
-      console.log(`  ${import_picocolors22.default.red("\u2717")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} ${table}`);
-      for (const p2 of problems) console.log(`      ${import_picocolors22.default.red("\u2022")} ${p2}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors22.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors23.default.red("\u2717")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} ${table}`);
+      for (const p2 of problems) console.log(`      ${import_picocolors23.default.red("\u2022")} ${p2}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors23.default.yellow("\u2022")} ${w2}`);
       errors++;
     } else if (warns.length > 0) {
-      console.log(`  ${import_picocolors22.default.yellow("!")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim("\u2192")} ${table}`);
-      for (const w2 of warns) console.log(`      ${import_picocolors22.default.yellow("\u2022")} ${w2}`);
+      console.log(`  ${import_picocolors23.default.yellow("!")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim("\u2192")} ${table}`);
+      for (const w2 of warns) console.log(`      ${import_picocolors23.default.yellow("\u2022")} ${w2}`);
       warnings++;
     } else {
-      console.log(`  ${import_picocolors22.default.green("\u2713")} ${import_picocolors22.default.bold(key)} ${import_picocolors22.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
+      console.log(`  ${import_picocolors23.default.green("\u2713")} ${import_picocolors23.default.bold(key)} ${import_picocolors23.default.dim(`\u2192 ${table} (id, ${orgCol ?? "no org"} ok)`)}`);
     }
   }
   const modelCount = Object.keys(schemaJson.models).length;
   const ignored = [...colsByTable.keys()].filter((t) => !declaredTables.has(t)).length;
   console.log(
     `
-  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors22.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors22.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors22.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
+  ${modelCount} model${modelCount === 1 ? "" : "s"} \xB7 ${import_picocolors23.default.green(`${modelCount - errors - warnings} ok`)}` + (warnings ? ` \xB7 ${import_picocolors23.default.yellow(`${warnings} warning${warnings === 1 ? "" : "s"}`)}` : "") + (errors ? ` \xB7 ${import_picocolors23.default.red(`${errors} error${errors === 1 ? "" : "s"}`)}` : "")
   );
   if (ignored > 0) {
-    console.log(`  ${import_picocolors22.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
+    console.log(`  ${import_picocolors23.default.dim(`${ignored} other table${ignored === 1 ? "" : "s"} in your database \u2014 ignored by Ablo`)}`);
   }
   console.log();
   process.exit(errors > 0 ? 1 : 0);
@@ -285367,7 +285752,7 @@ init_dbRole();
 
 // src/upgrade.ts
 init_cjs_shims();
-var import_picocolors23 = __toESM(require_picocolors(), 1);
+var import_picocolors24 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -285445,7 +285830,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors23.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors24.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -285519,39 +285904,39 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors23.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors24.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors23.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors24.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors23.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors23.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors23.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors23.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors24.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors24.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors24.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors24.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors23.default.bold(import_picocolors23.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors24.default.bold(import_picocolors24.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors23.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors23.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors23.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors24.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors24.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors24.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors23.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors24.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors23.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors24.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/pull.ts
 init_cjs_shims();
-var import_errors17 = require("@abloatai/transaction/errors");
-var import_picocolors24 = __toESM(require_picocolors(), 1);
+var import_errors18 = require("@abloatai/transaction/errors");
+var import_picocolors25 = __toESM(require_picocolors(), 1);
 init_src();
 var import_fs10 = require("fs");
 init_theme();
@@ -285579,7 +285964,7 @@ function parsePullArgs(argv) {
         force = true;
         break;
       default:
-        throw new import_errors17.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors18.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { out, appSchema, importPath, force };
@@ -285649,56 +286034,56 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors24.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors25.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = readProjectAdminDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors24.default.red(`  No database.`) + import_picocolors24.default.dim(` Set ${import_picocolors24.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
+      import_picocolors25.default.red(`  No database.`) + import_picocolors25.default.dim(` Set ${import_picocolors25.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
     );
     process.exit(1);
   }
   if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors24.default.red(`  ${args.out} already exists.`) + import_picocolors24.default.dim(` Re-run with ${import_picocolors24.default.bold("--force")} to overwrite.`)
+      import_picocolors25.default.red(`  ${args.out} already exists.`) + import_picocolors25.default.dim(` Re-run with ${import_picocolors25.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors24.default.dim("pull")}  ${import_picocolors24.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors25.default.dim("pull")}  ${import_picocolors25.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors24.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors25.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors24.default.yellow(`  No adoptable tables found`) + import_picocolors24.default.dim(` (a model needs an ${import_picocolors24.default.bold("id")} + ${import_picocolors24.default.bold("organization_id")} column).`)
+      import_picocolors25.default.yellow(`  No adoptable tables found`) + import_picocolors25.default.dim(` (a model needs an ${import_picocolors25.default.bold("id")} + ${import_picocolors25.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors24.default.green("\u2713")} wrote ${import_picocolors24.default.bold(args.out)} ${import_picocolors24.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors24.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors25.default.green("\u2713")} wrote ${import_picocolors25.default.bold(args.out)} ${import_picocolors25.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors25.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors24.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors24.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors25.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors25.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors24.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors24.default.bold("ablo check")}.
+  ${import_picocolors25.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors25.default.bold("ablo check")}.
 `
   );
 }
 
 // src/prismaPull.ts
 init_cjs_shims();
-var import_errors18 = require("@abloatai/transaction/errors");
-var import_picocolors25 = __toESM(require_picocolors(), 1);
+var import_errors19 = require("@abloatai/transaction/errors");
+var import_picocolors26 = __toESM(require_picocolors(), 1);
 var import_fs11 = require("fs");
 init_theme();
 var DEFAULT_SCHEMA = "prisma/schema.prisma";
@@ -285895,7 +286280,7 @@ function parsePrismaPullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors18.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors19.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -285906,56 +286291,56 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors25.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!(0, import_fs11.existsSync)(args.schema)) {
     console.error(
-      import_picocolors25.default.red(`  No Prisma schema at ${import_picocolors25.default.bold(args.schema)}.`) + import_picocolors25.default.dim(` Pass a path: ${import_picocolors25.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors26.default.red(`  No Prisma schema at ${import_picocolors26.default.bold(args.schema)}.`) + import_picocolors26.default.dim(` Pass a path: ${import_picocolors26.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
   if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors25.default.red(`  ${args.out} already exists.`) + import_picocolors25.default.dim(` Re-run with ${import_picocolors25.default.bold("--force")} to overwrite.`)
+      import_picocolors26.default.red(`  ${args.out} already exists.`) + import_picocolors26.default.dim(` Re-run with ${import_picocolors26.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors25.default.dim("pull prisma")}  ${import_picocolors25.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors26.default.dim("pull prisma")}  ${import_picocolors26.default.dim(args.schema)}
 `);
   let result;
   try {
     const src = (0, import_fs11.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors25.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors26.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors25.default.yellow(`  No adoptable models found`) + import_picocolors25.default.dim(` (a model needs an ${import_picocolors25.default.bold("id")} + ${import_picocolors25.default.bold("organizationId")} / ${import_picocolors25.default.bold("organization_id")}).`)
+      import_picocolors26.default.yellow(`  No adoptable models found`) + import_picocolors26.default.dim(` (a model needs an ${import_picocolors26.default.bold("id")} + ${import_picocolors26.default.bold("organizationId")} / ${import_picocolors26.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
   (0, import_fs11.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors25.default.green("\u2713")} wrote ${import_picocolors25.default.bold(args.out)} ${import_picocolors25.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors25.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors26.default.green("\u2713")} wrote ${import_picocolors26.default.bold(args.out)} ${import_picocolors26.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors26.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors25.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors25.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors26.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors26.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors25.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors25.default.bold("ablo check")}.
+  ${import_picocolors26.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors26.default.bold("ablo check")}.
 `
   );
 }
 
 // src/drizzlePull.ts
 init_cjs_shims();
-var import_picocolors26 = __toESM(require_picocolors(), 1);
-var import_errors19 = require("@abloatai/transaction/errors");
+var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_errors20 = require("@abloatai/transaction/errors");
 var import_fs12 = require("fs");
 var import_path7 = require("path");
 init_theme();
@@ -286062,7 +286447,7 @@ function parseDrizzlePullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors19.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors20.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -286079,27 +286464,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors27.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors26.default.red(`  No Drizzle schema given.`) + import_picocolors26.default.dim(` Pass the module: ${import_picocolors26.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors27.default.red(`  No Drizzle schema given.`) + import_picocolors27.default.dim(` Pass the module: ${import_picocolors27.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
   if (!(0, import_fs12.existsSync)(args.schema)) {
-    console.error(import_picocolors26.default.red(`  No file at ${import_picocolors26.default.bold(args.schema)}.`));
+    console.error(import_picocolors27.default.red(`  No file at ${import_picocolors27.default.bold(args.schema)}.`));
     process.exit(1);
   }
   if ((0, import_fs12.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors26.default.red(`  ${args.out} already exists.`) + import_picocolors26.default.dim(` Re-run with ${import_picocolors26.default.bold("--force")} to overwrite.`)
+      import_picocolors27.default.red(`  ${args.out} already exists.`) + import_picocolors27.default.dim(` Re-run with ${import_picocolors27.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors26.default.dim("pull drizzle")}  ${import_picocolors26.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors27.default.dim("pull drizzle")}  ${import_picocolors27.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -286107,26 +286492,26 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors26.default.dim(` (install ${import_picocolors26.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors26.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors27.default.dim(` (install ${import_picocolors27.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors27.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors26.default.yellow(`  No adoptable tables found`) + import_picocolors26.default.dim(` (a table needs an ${import_picocolors26.default.bold("id")} + ${import_picocolors26.default.bold("organization_id")} column).`)
+      import_picocolors27.default.yellow(`  No adoptable tables found`) + import_picocolors27.default.dim(` (a table needs an ${import_picocolors27.default.bold("id")} + ${import_picocolors27.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs12.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors26.default.green("\u2713")} wrote ${import_picocolors26.default.bold(args.out)} ${import_picocolors26.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors26.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors27.default.green("\u2713")} wrote ${import_picocolors27.default.bold(args.out)} ${import_picocolors27.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors27.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors26.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors26.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors27.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors27.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors26.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors26.default.bold("ablo check")}.
+  ${import_picocolors27.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors27.default.bold("ablo check")}.
 `
   );
 }
@@ -286212,7 +286597,7 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
 
 // src/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors27.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors28.default.dim("sync engine")}
 `;
 var HANDLERS = {
   init: (argv) => init([...argv]),
@@ -286221,6 +286606,7 @@ var HANDLERS = {
   projects: (argv) => projects([...argv]),
   branch: (argv) => branches([...argv]),
   status: (argv) => status([...argv]),
+  whoami: (argv) => whoami([...argv]),
   doctor: () => doctor(),
   logs: (argv) => logs([...argv]),
   webhooks: (argv) => webhooks([...argv]),
@@ -286239,7 +286625,7 @@ async function runDev(argv) {
   const devArgs = [...argv];
   const oneShot = devArgs.includes("--no-watch");
   console.log(
-    import_picocolors27.default.dim(
+    import_picocolors28.default.dim(
       oneShot ? "  `ablo dev --no-watch` prepares this Git branch and pushes once." : "  `ablo dev` prepares this Git branch and watches the schema."
     )
   );
@@ -286253,31 +286639,11 @@ async function runPull(argv) {
 }
 async function runPush2(argv) {
   const rest = [...argv];
-  const advanced = rest.some(
-    (a) => ["--force", "--rename", "--backfill", "--url", "--dry-run", "--plan", "--yes", "-y", "--allow-dirty"].includes(a)
-  );
-  const watching = rest.includes("--watch");
-  const guard = guardActiveProjectKey();
-  if (!guard.ok && guard.available.length > 0 && !rest.includes("--url")) {
-    console.error(
-      `  ${import_picocolors27.default.yellow("\u26A0")} active project ${import_picocolors27.default.bold(guard.activeProfile)} has no stored key ${import_picocolors27.default.dim(
-        `(you have keys for: ${guard.available.join(", ")})`
-      )}`
-    );
-    const loginCmd = guard.activeProfile === "default" ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
-    console.error(
-      import_picocolors27.default.dim(`    Mint one with ${import_picocolors27.default.bold(loginCmd)}, or switch with ${import_picocolors27.default.bold("ablo projects use <slug>")}.`)
-    );
-    process.exitCode = 1;
-    return;
-  }
-  const plan = resolvePushPlan();
-  if (advanced || plan.flow === "production" && !watching) await push(rest);
-  else await dev(rest);
+  await push(rest);
 }
 function runRenamedSchema(argv) {
   const forwarded = argv.slice(1).join(" ");
-  console.error(`  ${import_picocolors27.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
+  console.error(`  ${import_picocolors28.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
   console.error(`    Run \`ablo push${forwarded ? " " + forwarded : ""}\` instead.`);
   process.exitCode = 1;
 }
@@ -286287,7 +286653,7 @@ async function main() {
   const argv = process.argv.slice(3);
   if (!command && raw !== void 0 && raw !== "help" && !raw.startsWith("-")) {
     const suggestion = suggestCommand(raw);
-    throw new import_errors20.AbloValidationError(
+    throw new import_errors21.AbloValidationError(
       `\`${raw}\` isn't an ablo command.` + (suggestion ? ` Did you mean \`ablo ${suggestion}\`?` : " Run `ablo help --all` to see every command."),
       { code: "cli_invalid_arguments" }
     );
@@ -286318,7 +286684,7 @@ function printCoreHelp() {
   const width = Math.max(...rows.map((r2) => r2.run.length)) + 4;
   console.log(LOGO);
   for (const group of CORE_GROUPS) {
-    console.log(`  ${import_picocolors27.default.bold(group)}`);
+    console.log(`  ${import_picocolors28.default.bold(group)}`);
     const printed = group === "More" ? [...coreRows(group), ...extra] : coreRows(group);
     for (const row of printed) console.log(`    npx ablo ${row.run.padEnd(width)}${row.does}`);
     console.log();
@@ -286327,7 +286693,7 @@ function printCoreHelp() {
 }
 function printSchemaReminder() {
   console.log(
-    import_picocolors27.default.dim(`  Edit ${import_picocolors27.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors27.default.yellow("server_execute_unknown_model") + import_picocolors27.default.dim(".")
+    import_picocolors28.default.dim(`  Edit ${import_picocolors28.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors28.default.yellow("server_execute_unknown_model") + import_picocolors28.default.dim(".")
   );
   console.log();
 }
@@ -286337,7 +286703,7 @@ function printFullHelp() {
   ) + 2;
   console.log(LOGO);
   for (const group of FULL_GROUPS) {
-    console.log(`  ${import_picocolors27.default.bold(group)}`);
+    console.log(`  ${import_picocolors28.default.bold(group)}`);
     for (const row of fullRows(group)) {
       console.log(row.does === void 0 ? `    ${" ".repeat(9)}${row.run}` : `    npx ablo ${row.run.padEnd(width)}${row.does}`);
     }
@@ -286392,7 +286758,7 @@ async function ensureInitProject(opts) {
   const ensured = await ensureProject(slug);
   if (ensured) {
     console.log(
-      `  ${import_picocolors27.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors27.default.bold(ensured.slug)} ${import_picocolors27.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
+      `  ${import_picocolors28.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors28.default.bold(ensured.slug)} ${import_picocolors28.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
     );
   }
 }
@@ -286434,7 +286800,7 @@ async function chooseBool(flagValue, fallback, interactive, prompt) {
 async function init(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors27.default.dim("sync engine")}`);
+  Ie(`${brand("ablo")} ${import_picocolors28.default.dim("sync engine")}`);
   if (!(0, import_fs13.existsSync)("package.json")) {
     xe("No package.json found. Run this from your project root.");
     process.exit(1);
@@ -286512,7 +286878,7 @@ async function init(args = []) {
   if (pullExisting) {
     const dbUrl = readProjectAdminDatabaseUrl();
     if (!dbUrl) {
-      schemaNote = import_picocolors27.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
+      schemaNote = import_picocolors28.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -286522,12 +286888,12 @@ async function init(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors27.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors28.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors27.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors28.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors27.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors28.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
@@ -286551,9 +286917,9 @@ async function init(args = []) {
     const existing = (0, import_fs13.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
       (0, import_fs13.writeFileSync)(envFile, existing + "\n" + envBody);
-      created.push(`${envFile} ${import_picocolors27.default.dim("(appended)")}`);
+      created.push(`${envFile} ${import_picocolors28.default.dim("(appended)")}`);
     } else {
-      created.push(`${envFile} ${import_picocolors27.default.dim("(already configured)")}`);
+      created.push(`${envFile} ${import_picocolors28.default.dim("(already configured)")}`);
     }
   }
   if (agent) {
@@ -286569,17 +286935,17 @@ async function init(args = []) {
     }
     const providersPath = (0, import_path8.join)(layout.appBase, "providers.tsx");
     (0, import_fs13.writeFileSync)(providersPath, generateProviders());
-    created.push(`${providersPath} ${import_picocolors27.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    created.push(`${providersPath} ${import_picocolors28.default.dim(`(wrap ${(0, import_path8.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
     const sessionDir = (0, import_path8.join)(layout.appBase, "api", "ablo-session");
     (0, import_fs13.mkdirSync)(sessionDir, { recursive: true });
     (0, import_fs13.writeFileSync)((0, import_path8.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors27.default.dim("(wire your auth)")}`);
+    created.push(`${(0, import_path8.join)(sessionDir, "route.ts")} ${import_picocolors28.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
     (0, import_fs13.writeFileSync)((0, import_path8.join)(abloDir, "TaskList.tsx"), generateComponent());
     created.push(`${abloDir}/TaskList.tsx`);
   }
-  Me(created.map((f) => `${import_picocolors27.default.green("\u2713")} ${f}`).join("\n"), "Created");
+  Me(created.map((f) => `${import_picocolors28.default.green("\u2713")} ${f}`).join("\n"), "Created");
   const pm = detectPackageManager();
   if (opts.install) {
     const s = Y2();
@@ -286588,46 +286954,46 @@ async function init(args = []) {
       (0, import_child_process3.execSync)(`${pm} add @abloatai/ablo`, { stdio: "ignore" });
       s.stop("Installed @abloatai/ablo");
     } catch {
-      s.stop(`${import_picocolors27.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors27.default.bold(`${pm} install @abloatai/ablo`)}`);
+      s.stop(`${import_picocolors28.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors28.default.bold(`${pm} install @abloatai/ablo`)}`);
     }
   }
   const steps = [
-    `Run ${import_picocolors27.default.bold("npx ablo login")} to authorize branch management`,
-    `Set ${import_picocolors27.default.bold("DATABASE_URL")} in ${import_picocolors27.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors27.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Run ${import_picocolors28.default.bold("npx ablo login")} to authorize branch management`,
+    `Set ${import_picocolors28.default.bold("DATABASE_URL")} in ${import_picocolors28.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors28.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "replication" ? [
-      `Connect your database \u2014 ${import_picocolors27.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
-      `Verify it \u2014 ${import_picocolors27.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
-      `Register it \u2014 ${import_picocolors27.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
+      `Connect your database \u2014 ${import_picocolors28.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
+      `Verify it \u2014 ${import_picocolors28.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
+      `Register it \u2014 ${import_picocolors28.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
     ] : [
-      `Provision your DB: ${import_picocolors27.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors27.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors27.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors28.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors28.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors28.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors27.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors27.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors27.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors28.default.bold((0, import_path8.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors28.default.bold("<Providers>")} (${(0, import_path8.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors28.default.bold((0, import_path8.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
-    `Run ${import_picocolors27.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors28.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors27.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
-      `Run ${import_picocolors27.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors28.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same tasks`,
+      `Run ${import_picocolors28.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
   const existingKey = resolveManagementKey();
   if (existingKey) {
     await ensureInitProject(opts);
-    Se(`Already authorized ${import_picocolors27.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors27.default.bold("npx ablo dev")} next. ${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+    Se(`Already authorized ${import_picocolors28.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors28.default.bold("npx ablo dev")} next. ${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
     return;
   }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       await ensureInitProject(opts);
       return;
     }
   }
-  Se(`Run ${import_picocolors27.default.bold("npx ablo login")} when ready. ${import_picocolors27.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors28.default.bold("npx ablo login")} when ready. ${import_picocolors28.default.dim("Docs:")} https://abloatai.com/docs`);
 }
 function generateSchema() {
   return `import { defineSchema, model, relation, z } from '@abloatai/ablo/schema';
@@ -286702,7 +287068,7 @@ function generateEnv(storage, opts = {}) {
   const { includeApiKey = true } = opts;
   const databaseBlock = storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
-  const apiKeyBlock = includeApiKey ? "# Ablo: a sk_test_ key for local development (`npx ablo dev` wires this for you)\nABLO_API_KEY=sk_test_your_key_here\n" : "";
+  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` wires a development branch for you)\nABLO_API_KEY=sk_your_key_here\n" : "";
   return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;
 }
 function generateDataSource(orm) {
@@ -286778,8 +287144,8 @@ var WEBHOOK_DOC = `/**
  * signature, then write each change into YOUR database. The other half \u2014 your app
  * MAKING changes + live sync \u2014 is the Ablo client in \`ablo/index.ts\`.
  *
- * Just like Stripe: you call Ablo to make changes (client) and Ablo calls you to
- * persist them (this route). Reliability is built in \u2014 Ablo retries on any
+ * Your app calls Ablo to make changes, and Ablo calls this route to persist
+ * them. Reliability is built in \u2014 Ablo retries on any
  * non-2xx, and \`event.syncId\` is a monotonic log position, so apply in order and
  * dedupe (skip a \`syncId\` you've already stored).
  */`;