@abloatai/cli 0.42.0 → 0.43.0

package/dist/cli.cjs

@@ -3313,43 +3313,16 @@ function getKeyEntry(mode) {
   if (!cfg) return void 0;
   return cfg.profiles[activeProfileName(cfg)]?.[mode];
 }
+function getManagementKeyEntry() {
+  const cfg = readConfig();
+  if (!cfg) return void 0;
+  return cfg.profiles[activeProfileName(cfg)]?.management;
+}
 function modeFromKey(key) {
   if (/^(sk|rk)_test_/.test(key)) return "sandbox";
   if (/^(sk|rk)_live_/.test(key)) return "production";
   return void 0;
 }
-function prefix(key) {
-  return key ? key.slice(0, 12) : null;
-}
-function describeEffectiveKey(activeMode, envKey, storedEntry) {
-  const effectiveKey = envKey ?? storedEntry?.apiKey;
-  const keySource = envKey ? "env" : storedEntry ? "stored" : null;
-  const keyMode = effectiveKey ? modeFromKey(effectiveKey) ?? null : null;
-  const keyMatchesActiveMode = keyMode ? keyMode === activeMode : null;
-  const keyMatchesStoredActiveKey = envKey && storedEntry?.apiKey ? envKey === storedEntry.apiKey : null;
-  let keyMismatch = null;
-  if (keyMode && keyMode !== activeMode) {
-    const sourceLabel = envKey ? "ABLO_API_KEY" : "stored active key";
-    keyMismatch = {
-      code: "key_mode_mismatch",
-      message: `${sourceLabel} is a ${keyMode} key but the CLI mode is ${activeMode}. Requests use ${sourceLabel} (${prefix(effectiveKey)}...), not the active CLI mode.`
-    };
-  } else if (envKey && storedEntry?.apiKey && envKey !== storedEntry.apiKey) {
-    keyMismatch = {
-      code: "env_key_overrides_stored",
-      message: `ABLO_API_KEY (${prefix(envKey)}...) overrides the stored ${activeMode} key (${prefix(storedEntry.apiKey)}...).`
-    };
-  }
-  return {
-    keyPrefix: prefix(effectiveKey),
-    keySource,
-    keyMode,
-    storedKeyPrefix: prefix(storedEntry?.apiKey),
-    keyMatchesActiveMode,
-    keyMatchesStoredActiveKey,
-    keyMismatch
-  };
-}
 function normalizeMode(value) {
   return normalizeStoredMode(value);
 }
@@ -3363,13 +3336,13 @@ function clearCredential() {
   }
   return removed;
 }
-function resolveApiKey(modeOverride) {
+function resolveMutationApiKey(modeOverride) {
   return resolveKey({ purpose: "data", mode: modeOverride }).key;
 }
 function ambientEnvKeyNote(cwd) {
   const ambient = readProjectApiKey(cwd);
   if (!ambient || ambient.source === "env") return null;
-  return `Note: ${ambient.source} in this directory holds an ABLO_API_KEY, which this command does not load \u2014 it reads only the process environment and your stored login, so a file cannot silently choose the plane. Export the variable (or prefix the command with it) to use that key.`;
+  return `Note: ${ambient.source} in this directory holds an ABLO_API_KEY, which this command does not load \u2014 it reads only the process environment and your stored login, so a file cannot silently choose a branch. Export the variable, or pass \`--env-file ` + ambient.source + "` to a connect command, to choose it explicitly.";
 }
 function resolveManagementKey() {
   if (process.env.ABLO_MANAGEMENT_KEY) return process.env.ABLO_MANAGEMENT_KEY;
@@ -3398,7 +3371,7 @@ function resolveOrgManagementKey() {
   return void 0;
 }
 function guardActiveProjectKey() {
-  const { key, source } = resolveEffectiveApiKey();
+  const { key, source } = resolveRuntimeApiKey();
   if (key != null && source != null && source !== "stored") {
     return { ok: true, activeProfile: DEFAULT_PROFILE, available: [] };
   }
@@ -3431,16 +3404,9 @@ function resolveKey(policy) {
   }
   return { key: void 0, source: null };
 }
-function resolveEffectiveApiKey(modeOverride, cwd) {
+function resolveRuntimeApiKey(modeOverride, cwd) {
   return resolveKey({ purpose: "data", mode: modeOverride, scanEnvFiles: true, cwd });
 }
-function resolvePushPlan() {
-  const { key, source } = resolveEffectiveApiKey();
-  if (key != null && source != null && source !== "stored") {
-    return { flow: modeFromKey(key) ?? getMode(), apiKey: key, source };
-  }
-  return { flow: getMode(), apiKey: key, source };
-}
 var import_os2, import_path2, import_fs3, DEFAULT_PROFILE;
 var init_config = __esm({
   "src/config.ts"() {
@@ -3777,7 +3743,7 @@ async function confirmFromServer(opts) {
     const project = projectId ? await nameProject(projectId, identity.accountScope, opts) : null;
     return {
       organizationId: identity.accountScope,
-      environment: keyEnv,
+      environment: identity.branchRoot === void 0 ? keyEnv : identity.branchRoot ? "production" : "sandbox",
       project,
       projectId,
       branchId: identity.branchId ?? null,
@@ -4028,6 +3994,7 @@ function parsePushArgs(argv) {
   let force = false;
   let yes = false;
   let dryRun = false;
+  let envFile;
   const renames = [];
   const backfills = [];
   for (let i = 0; i < argv.length; i++) {
@@ -4042,6 +4009,9 @@ function parsePushArgs(argv) {
       case "--url":
         url = argv[++i] ?? url;
         break;
+      case "--env-file":
+        envFile = argv[++i] ?? envFile;
+        break;
       case "--force":
         force = true;
         break;
@@ -4083,7 +4053,18 @@ function parsePushArgs(argv) {
     }
   }
   url = url.replace(/\/+$/, "");
-  return { schemaPath, exportName, url, apiKey: process.env.ABLO_API_KEY, force, renames, backfills, yes, dryRun };
+  return {
+    schemaPath,
+    exportName,
+    url,
+    apiKey: process.env.ABLO_API_KEY,
+    ...envFile ? { envFile } : {},
+    force,
+    renames,
+    backfills,
+    yes,
+    dryRun
+  };
 }
 function publicationGap(value) {
   if (typeof value !== "object" || value === null) return null;
@@ -4184,8 +4165,21 @@ function printPlan(local, remote) {
   console.log("");
 }
 async function confirmPush(args, target) {
-  const env = target.confirmed?.environment ?? target.keyEnv;
-  const isProd = env === "production";
+  const confirmedRoot = target.confirmed?.branchRoot;
+  const legacyEnv = target.keyEnv;
+  if (confirmedRoot === void 0 && legacyEnv === null) {
+    console.error(
+      `  ${import_picocolors5.default.red("\u2717")} Refusing to deploy because the server did not confirm which branch this key targets.`
+    );
+    console.error(
+      import_picocolors5.default.dim(
+        `    Current ${import_picocolors5.default.bold("sk_")} keys do not encode live/test state. Check connectivity with ${import_picocolors5.default.bold("ablo whoami")} and retry; the CLI will not guess for a write.`
+      )
+    );
+    process.exit(1);
+    return;
+  }
+  const isProd = confirmedRoot ?? legacyEnv === "production";
   const tty = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   if (isProd && !args.yes) {
     if (!tty) {
@@ -4208,7 +4202,10 @@ async function confirmPush(args, target) {
     return;
   }
   if (!isProd && !args.yes && tty) {
-    const ok = await ye({ message: `Apply to ${import_picocolors5.default.bold("sandbox")}?` });
+    const branch = target.confirmed?.branchId;
+    const ok = await ye({
+      message: `Apply to development branch${branch ? ` ${import_picocolors5.default.bold(branch)}` : ""}?`
+    });
     if (pD(ok) || !ok) {
       xe("Aborted.");
       process.exit(1);
@@ -4217,8 +4214,7 @@ async function confirmPush(args, target) {
 }
 function printPushTarget(target, schema) {
   const confirmed = target.confirmed;
-  const env = confirmed?.environment ?? target.keyEnv;
-  const envLabel = env === "production" ? import_picocolors5.default.bold("production") : env === "sandbox" ? import_picocolors5.default.bold("sandbox") : import_picocolors5.default.yellow("unknown env");
+  const branchLabel = confirmed?.branchRoot === true ? import_picocolors5.default.bold("production root") : confirmed?.branchId ? `${import_picocolors5.default.bold("branch")} ${import_picocolors5.default.bold(confirmed.branchId)}` : target.keyEnv === "production" ? `${import_picocolors5.default.bold("production root")} ${import_picocolors5.default.yellow("(legacy key; unconfirmed)")}` : target.keyEnv === "sandbox" ? `${import_picocolors5.default.bold("development branch")} ${import_picocolors5.default.yellow("(legacy key; unconfirmed)")}` : import_picocolors5.default.red("unknown branch");
   let projectLabel;
   if (confirmed?.project) {
     const p2 = confirmed.project;
@@ -4231,7 +4227,7 @@ function printPushTarget(target, schema) {
     projectLabel = `${shown} ${import_picocolors5.default.yellow("(unconfirmed \u2014 server did not answer)")}`;
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors5.default.dim("push")} ${import_picocolors5.default.dim("\u2192")} ${envLabel}`);
+  ${brand("ablo")} ${import_picocolors5.default.dim("push")} ${import_picocolors5.default.dim("\u2192")} ${branchLabel}`);
   if (confirmed?.organizationId) console.log(`  ${import_picocolors5.default.dim("org")}      ${import_picocolors5.default.dim(confirmed.organizationId)}`);
   console.log(`  ${import_picocolors5.default.dim("project")}  ${projectLabel}`);
   console.log(`  ${import_picocolors5.default.dim("target")}   ${import_picocolors5.default.dim(target.url)}`);
@@ -4260,6 +4256,8 @@ function describeKeySource(source) {
       return ".env";
     case "stored":
       return "ablo login";
+    case "explicit-file":
+      return "--env-file";
   }
 }
 async function push(argv) {
@@ -4270,16 +4268,29 @@ async function push(argv) {
     console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
+  if (args.envFile) {
+    try {
+      process.loadEnvFile(args.envFile);
+    } catch (error) {
+      throw new import_errors6.AbloValidationError(
+        `could not load --env-file ${args.envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+    args.apiKey = process.env.ABLO_API_KEY;
+  }
   let keySource = "env";
   if (!args.apiKey) {
-    const resolved = resolveEffectiveApiKey();
-    args.apiKey = resolved.key;
-    keySource = resolved.source ?? "stored";
+    args.apiKey = resolveMutationApiKey();
+    keySource = args.apiKey ? "stored" : "env";
+  } else if (args.envFile) {
+    keySource = "explicit-file";
   }
   if (!args.apiKey) {
+    const ambient = ambientEnvKeyNote();
     console.error(
       import_picocolors5.default.red(`  No API key.`) + import_picocolors5.default.dim(
-        ` Run ${import_picocolors5.default.bold("npx ablo login")} \u2014 or set ${import_picocolors5.default.bold("ABLO_API_KEY")} (${import_picocolors5.default.bold("sk_test_")} = sandbox; ${import_picocolors5.default.bold("sk_live_")} = production).`
+        ` Run ${import_picocolors5.default.bold("ablo login")}, or set ${import_picocolors5.default.bold("ABLO_API_KEY")} to a branch-bound ${import_picocolors5.default.bold("sk_")} credential.` + (ambient ? ` A project env file contains one; select it explicitly with ${import_picocolors5.default.bold("npx ablo push --env-file .env.local")}.` : "")
       )
     );
     process.exit(1);
@@ -4416,19 +4427,19 @@ async function push(argv) {
     } else if (code === "schema_provisioning_forbidden") {
       console.error(
         import_picocolors5.default.dim(
-          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors5.default.bold("npx ablo connect register")}, and pushes to that environment record the schema as metadata only \u2014 no tables are created anywhere.`
+          `  This is not a key problem \u2014 the push was authorized, but the target database refused to let the engine create tables (Postgres 42501). On the replication read path Ablo never runs DDL: register your database as a data source with ${import_picocolors5.default.bold("npx ablo connect register")}, and pushes to that branch record the schema as metadata only \u2014 no tables are created anywhere.`
         )
       );
     } else if (args.apiKey != null && (0, import_credentialPolicy.classifyCredentialKind)(args.apiKey) === "restricted") {
       console.error(
         import_picocolors5.default.dim(
-          `  Schema pushes need a SECRET key: ${import_picocolors5.default.bold("sk_test_")} (sandbox dev loop) or a dashboard ${import_picocolors5.default.bold("sk_live_")} (production deploy: ${import_picocolors5.default.bold("ABLO_API_KEY=sk_live_\u2026 npx ablo push")}).`
+          `  Schema pushes need a branch-bound SECRET ${import_picocolors5.default.bold("sk_")} key. Use ${import_picocolors5.default.bold("ablo dev")} for a development child or ${import_picocolors5.default.bold("ablo push")} with a root-bound key for production.`
         )
       );
     } else {
       console.error(
         import_picocolors5.default.dim(
-          `  This key isn't authorized to push schema (needs ${import_picocolors5.default.bold("schema:push")}). ` + (keySource === "stored" ? `It's your stored ${import_picocolors5.default.bold("ablo login")} sandbox key \u2014 a key in ${import_picocolors5.default.bold(".env.local")} or ${import_picocolors5.default.bold("ABLO_API_KEY")} takes precedence, so put a schema:push key there (sandbox ${import_picocolors5.default.bold("sk_test_")} or production ${import_picocolors5.default.bold("sk_live_")}) and re-push. ` : `Use a schema:push key \u2014 a sandbox ${import_picocolors5.default.bold("sk_test_")} or production ${import_picocolors5.default.bold("sk_live_")}. `) + `Manage keys at https://abloatai.com`
+          `  This key isn't authorized to push schema (needs ${import_picocolors5.default.bold("schema:push")}). ` + (keySource === "stored" ? `The stored login is management-only. Put a branch-bound ${import_picocolors5.default.bold("sk_")} key with ${import_picocolors5.default.bold("schema:push")} in ${import_picocolors5.default.bold(".env.local")} or ${import_picocolors5.default.bold("ABLO_API_KEY")} and retry. ` : `Use a branch-bound ${import_picocolors5.default.bold("sk_")} key with ${import_picocolors5.default.bold("schema:push")}. `) + `Manage keys at https://abloatai.com`
         )
       );
     }
@@ -4437,7 +4448,7 @@ async function push(argv) {
   }
   process.exit(1);
 }
-var import_picocolors5, import_errors6, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, import_schema2, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT;
+var import_picocolors5, import_errors6, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, import_schema2, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT, PUSH_USAGE;
 var init_push = __esm({
   "src/push.ts"() {
     "use strict";
@@ -4458,6 +4469,26 @@ var init_push = __esm({
     import_schema2 = require("@abloatai/transaction/coordination/schema");
     DEFAULT_SCHEMA_PATH = "ablo/schema.ts";
     DEFAULT_EXPORT = "schema";
+    PUSH_USAGE = `  ablo push \u2014 upload a schema to one confirmed branch
+
+  Usage:
+    npx ablo push
+    npx ablo push --env-file .env.production --yes
+    npx ablo push --dry-run
+
+  Credential:
+    ABLO_API_KEY          Branch-bound sk_ key from the process environment
+    --env-file <path>     Explicitly load ABLO_API_KEY from a dotenv file
+
+  Safety:
+    --yes, -y             Confirm non-interactively (required for the production root)
+    --dry-run, --plan     Show target and schema diff without applying
+    --force               Allow destructive schema changes
+    --rename old:new      Record a model rename
+    --backfill m.f=value  Seed existing rows for a new required field
+
+  The server confirms the key's project and branch. Current keys do not encode
+  live/test state, and push never guesses a branch from their spelling.`;
   }
 });
 
@@ -4982,8 +5013,8 @@ __export(disconnect_exports, {
 function planeLabel(target) {
   const confirmed = target.confirmed;
   const project = confirmed?.project?.name ?? confirmed?.project?.slug ?? confirmed?.projectId ?? "the default project";
-  const env = confirmed?.environment ?? target.keyEnv ?? "unknown environment";
-  return { project, env };
+  const branch = confirmed?.branchRoot === true ? "production root" : confirmed?.branchId ? `branch ${confirmed.branchId}` : target.keyEnv === "production" ? "production root (legacy key; unconfirmed)" : target.keyEnv === "sandbox" ? "development branch (legacy key; unconfirmed)" : "unknown branch";
+  return { project, branch };
 }
 async function deregisterDataSource(opts) {
   try {
@@ -5000,7 +5031,7 @@ async function deregisterDataSource(opts) {
     if (err instanceof import_errors8.AbloError && err.code === "entity_not_found") return { removed: false };
     if (err instanceof import_errors8.AbloError && err.code === "forbidden") {
       throw new import_errors8.AbloPermissionError(
-        `${err.message}. Disconnecting needs a secret key (sk_\u2026) \u2014 run \`ablo login\` to store one.`,
+        `${err.message}. Disconnecting needs a branch-bound secret key (sk_\u2026).`,
         {
           code: "forbidden",
           ...err.requestId !== void 0 ? { requestId: err.requestId } : {}
@@ -5010,7 +5041,7 @@ async function deregisterDataSource(opts) {
     throw err;
   }
 }
-function renderDisconnected(response, project, envLabel) {
+function renderDisconnected(response, project, branchLabel) {
   const parts = [];
   if (response.cleared.direct) parts.push("the direct database registration");
   if (response.cleared.endpoints > 0) {
@@ -5021,7 +5052,7 @@ function renderDisconnected(response, project, envLabel) {
   const what = parts.length > 0 ? parts.join(" and ") : "the data source";
   console.log(
     `
-  ${import_picocolors8.default.green("\u2713")} Disconnected ${what} for ${import_picocolors8.default.bold(project)} in ${envLabel}. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.
+  ${import_picocolors8.default.green("\u2713")} Disconnected ${what} for ${import_picocolors8.default.bold(project)} on ${branchLabel}. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.
 `
   );
   const slot = response.replication_slot;
@@ -5030,14 +5061,27 @@ function renderDisconnected(response, project, envLabel) {
       `  ${import_picocolors8.default.yellow("!")} ${slot.warning ?? `The replication slot ${import_picocolors8.default.bold(slot.slot)} is still on your database and still holding your write-ahead log. Remove it yourself \u2014 nothing will release it now.`}`
     );
     if (slot.detail) console.log(import_picocolors8.default.dim(`      ${slot.detail}`));
-    if (slot.remove_with) console.log(`      ${import_picocolors8.default.bold(slot.remove_with)}`);
+    console.log(
+      import_picocolors8.default.dim(
+        `      Moving this database to another branch? Keep the roles and slot; run ${import_picocolors8.default.bold("ablo connect rotate --env-file .env.local --yes")} to re-key and reuse them.`
+      )
+    );
+    if (slot.remove_with) {
+      console.log(import_picocolors8.default.dim("      Not reconnecting this database? Remove the unused slot in your SQL editor:"));
+      console.log(`      ${import_picocolors8.default.bold(slot.remove_with)}`);
+    }
     console.log();
   }
 }
 async function disconnect(argv) {
   let skipConfirm = false;
-  for (const arg of argv) {
+  let envFile;
+  let keyEnv;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
     if (arg === "--yes" || arg === "-y") skipConfirm = true;
+    else if (arg === "--env-file") envFile = argv[++i];
+    else if (arg === "--key-env") keyEnv = argv[++i];
     else if (arg === "--help" || arg === "-h") {
       console.log(DISCONNECT_USAGE);
       return;
@@ -5053,19 +5097,39 @@ async function disconnect(argv) {
   ${brand("ablo")} ${import_picocolors8.default.dim("connect deregister")}  ${import_picocolors8.default.dim("remove this project's data source")}
 `
   );
-  const resolved = resolveEffectiveApiKey();
+  if (envFile) {
+    try {
+      process.loadEnvFile(envFile);
+    } catch (error) {
+      throw new import_errors8.AbloValidationError(
+        `could not load --env-file ${envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+  }
+  const selected = keyEnv ? readProjectEnvVariable(keyEnv) : null;
+  if (keyEnv && !selected) {
+    throw new import_errors8.AbloAuthenticationError(
+      `No value named ${keyEnv} was found in the process environment, .env.local, or .env.`,
+      { code: "cli_api_key_missing" }
+    );
+  }
+  const resolved = selected ? { key: selected.value, source: selected.source } : {
+    key: resolveMutationApiKey(),
+    source: envFile ? "explicit-file" : process.env.ABLO_API_KEY ? "env" : "stored"
+  };
   const apiKey = resolved.key;
   const keySource = resolved.source ?? "stored";
   if (!apiKey) {
     throw new import_errors8.AbloAuthenticationError(
-      "Disconnecting needs an API key, and none was found. Run `ablo login` (or set ABLO_API_KEY), then re-run `ablo connect deregister`.",
+      "Disconnecting needs a branch-bound sk_ key. Set ABLO_API_KEY, pass `--env-file .env.local`, or select a named recovery key with `--key-env <NAME>`.",
       { code: "cli_api_key_missing" }
     );
   }
   const apiUrl3 = apiBaseUrl();
   const target = await resolveTarget({ url: apiUrl3, apiKey, keySource });
-  const { project, env } = planeLabel(target);
-  const envLabel = env === "production" ? import_picocolors8.default.yellow(env) : import_picocolors8.default.dim(env);
+  const { project, branch } = planeLabel(target);
+  const branchLabel = target.confirmed?.branchRoot ? import_picocolors8.default.yellow(branch) : import_picocolors8.default.dim(branch);
   const divergence = describeMismatches(target.mismatches);
   if (divergence) console.log(`  ${import_picocolors8.default.yellow("\u26A0")}  ${divergence}
 `);
@@ -5077,7 +5141,7 @@ async function disconnect(argv) {
       );
     }
     const proceed = await ye({
-      message: `Disconnect the data source for ${import_picocolors8.default.bold(project)} in ${envLabel}?`,
+      message: `Disconnect the data source for ${import_picocolors8.default.bold(project)} on ${branchLabel}?`,
       initialValue: true
     });
     if (pD(proceed) || !proceed) {
@@ -5088,11 +5152,11 @@ async function disconnect(argv) {
   }
   const outcome = await deregisterDataSource({ apiKey });
   if (!outcome.removed) {
-    console.log(import_picocolors8.default.dim(`  No data source registered for ${project} in ${env}.
+    console.log(import_picocolors8.default.dim(`  No data source registered for ${project} on ${branch}.
 `));
     return;
   }
-  renderDisconnected(outcome.response, project, envLabel);
+  renderDisconnected(outcome.response, project, branchLabel);
 }
 var import_picocolors8, import_errors8, import_wire4, DISCONNECT_USAGE;
 var init_disconnect = __esm({
@@ -5104,6 +5168,7 @@ var init_disconnect = __esm({
     import_errors8 = require("@abloatai/transaction/errors");
     import_wire4 = require("@abloatai/transaction/wire");
     init_config();
+    init_dbRole();
     init_controlPlane();
     init_theme();
     init_target();
@@ -5112,9 +5177,10 @@ var init_disconnect = __esm({
   Usage
     npx ablo connect deregister          Remove the active project's data source (confirms first)
     npx ablo connect deregister --yes    Skip the confirmation
+    npx ablo connect deregister --key-env OLD_KEY_NAME --yes
 
-  Acts on one plane \u2014 the active project (${import_picocolors8.default.bold("ablo projects use")}) in the key's
-  environment (its ${import_picocolors8.default.bold("sk_test_")}/${import_picocolors8.default.bold("sk_live_")} prefix), shown before it runs. Removes the registration and
+  Acts on exactly the server-confirmed project and branch bound to the key, shown
+  before it runs. Removes the registration and
   Ablo's replication state for that plane, so Ablo stops reading and writing the
   database. Reconnect with ${import_picocolors8.default.bold("ablo connect")}.`;
   }
@@ -5704,18 +5770,20 @@ async function runConnectApply(args) {
     target = `${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
   } catch {
   }
-  const apiKey = resolveApiKey();
+  const apiKey = resolveMutationApiKey();
   if (!apiKey) {
     const loggedIn = resolveManagementKey() !== void 0;
     const ambient = ambientEnvKeyNote();
+    const retry = `npx ablo connect ${rotating ? "rotate" : "apply"} --env-file .env.local --yes`;
     throw new import_errors9.AbloAuthenticationError(
-      loggedIn ? `You are logged in, but this project has no ${getMode()} data key.
+      loggedIn ? `You are logged in, but connect needs a branch-bound runtime key.
 
-The key is looked for in ABLO_API_KEY, then in the credential stored for the active project in the active mode (${getMode()}). Logging in stores a management credential, which administers the project but cannot register a database \u2014 and a key for another mode is never used implicitly, so registering against production takes an explicit production key.
+Logging in stores an mk_ management credential; it can manage branches but cannot read, write, or register a database. Set ABLO_API_KEY to the sk_ key for the exact branch this database should join. The server confirms whether that branch is the production root or a development child; the CLI does not infer it from the key spelling.${ambient ? `
 
-Mint a sandbox key with \`npx ablo dev\`, or set ABLO_API_KEY to the key of the plane this database should join (its sk_live_ key for production).${ambient ? `
+${ambient}
 
-${ambient}` : ""}` : `Not logged in, and no ABLO_API_KEY is set. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
+Use it explicitly with:
+  ${retry}` : ""}` : `Not logged in, and no ABLO_API_KEY is set. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
 
 ${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
@@ -6122,6 +6190,7 @@ function parseConnectArgs(argv) {
   let apply = false;
   let rotate = false;
   let url;
+  let envFile;
   let yes = false;
   let showSql = false;
   let scan = false;
@@ -6167,6 +6236,9 @@ function parseConnectArgs(argv) {
       case "--url":
         url = argv[++i] ?? url;
         break;
+      case "--env-file":
+        envFile = argv[++i] ?? envFile;
+        break;
       case "--yes":
       case "-y":
         yes = true;
@@ -6214,6 +6286,7 @@ function parseConnectArgs(argv) {
     apply,
     rotate,
     url,
+    envFile,
     yes,
     showSql,
     scan,
@@ -6513,11 +6586,11 @@ async function runCheck() {
   ${brand("ablo")} ${import_picocolors12.default.dim("connect check")}  ${import_picocolors12.default.dim("direct-write + WAL readiness")}
 `
   );
-  const apiKey = resolveApiKey();
+  const apiKey = resolveRuntimeApiKey().key;
   if (!apiKey) {
     const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      `No API key found. Run \`ablo login\` (or set ABLO_API_KEY), then re-run \`ablo connect check\`.${ambient ? `
+      `No branch-bound runtime key found. Set ABLO_API_KEY to the sk_ key for the branch to check, or pass \`--env-file .env.local\` explicitly.${ambient ? `
 
 ${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
@@ -6582,11 +6655,11 @@ ${ambient}` : ""}`,
 async function runRegister(args) {
   const dbUrl = requireScopedUrl("replication", "register");
   const writeDbUrl = requireScopedUrl("write", "register");
-  const apiKey = resolveApiKey();
+  const apiKey = resolveMutationApiKey();
   if (!apiKey) {
     const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      `Not logged in. Run \`ablo login\` (or set ABLO_API_KEY) so Ablo knows which project to register this database for.${ambient ? `
+      `No branch-bound runtime key found. Set ABLO_API_KEY to the sk_ key for the branch to register, or pass \`--env-file .env.local\` explicitly.${ambient ? `
 
 ${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
@@ -6702,11 +6775,11 @@ async function runLocate(args) {
       { code: "cli_database_url_missing" }
     );
   }
-  const apiKey = resolveApiKey();
+  const apiKey = resolveRuntimeApiKey().key;
   if (!apiKey) {
     const ambient = ambientEnvKeyNote();
     throw new import_errors10.AbloAuthenticationError(
-      `No API key found. Run \`ablo login\` (or set ABLO_API_KEY), then re-run \`ablo connect locate\`.${ambient ? `
+      `No branch-bound runtime key found. Set ABLO_API_KEY to a key that can inspect this project, or pass \`--env-file .env.local\` explicitly.${ambient ? `
 
 ${ambient}` : ""}`,
       { code: "cli_api_key_missing" }
@@ -6752,6 +6825,16 @@ async function connect(argv) {
     return;
   }
   const args = parseConnectArgs(argv);
+  if (args.envFile) {
+    try {
+      process.loadEnvFile(args.envFile);
+    } catch (error) {
+      throw new import_errors10.AbloValidationError(
+        `could not load --env-file ${args.envFile}: ${error instanceof Error ? error.message : String(error)}`,
+        { code: "cli_invalid_arguments" }
+      );
+    }
+  }
   if (args.apply || args.rotate) {
     const { runConnectApply: runConnectApply2 } = await Promise.resolve().then(() => (init_connectApply(), connectApply_exports));
     await runConnectApply2(args);
@@ -6829,6 +6912,7 @@ var init_connect = __esm({
 
   Modifiers:
     --url <admin-conn>   Admin connection used once to set up (else DATABASE_URL); never stored
+    --env-file <path>    Explicitly load DATABASE_URL and ABLO_API_KEY from this file
     --tables a,b,c       Publish only these tables (default: all tables)
     --role <name>        Name the replication role (default: ablo_replicator)
     --write-role <name>  Name the DML role (default: ablo_writer)
@@ -12719,8 +12803,8 @@ var require_typescript = __commonJS({
       function createGetCanonicalFileName(useCaseSensitiveFileNames2) {
         return useCaseSensitiveFileNames2 ? identity : toFileNameLowerCase;
       }
-      function patternText({ prefix: prefix2, suffix }) {
-        return `${prefix2}*${suffix}`;
+      function patternText({ prefix, suffix }) {
+        return `${prefix}*${suffix}`;
       }
       function matchedText(pattern, candidate) {
         Debug.assert(isPatternMatch(pattern, candidate));
@@ -12739,17 +12823,17 @@ var require_typescript = __commonJS({
         }
         return matchedValue;
       }
-      function startsWith(str, prefix2, ignoreCase) {
-        return ignoreCase ? equateStringsCaseInsensitive(str.slice(0, prefix2.length), prefix2) : str.lastIndexOf(prefix2, 0) === 0;
+      function startsWith(str, prefix, ignoreCase) {
+        return ignoreCase ? equateStringsCaseInsensitive(str.slice(0, prefix.length), prefix) : str.lastIndexOf(prefix, 0) === 0;
       }
-      function removePrefix(str, prefix2) {
-        return startsWith(str, prefix2) ? str.substr(prefix2.length) : str;
+      function removePrefix(str, prefix) {
+        return startsWith(str, prefix) ? str.substr(prefix.length) : str;
       }
-      function tryRemovePrefix(str, prefix2, getCanonicalFileName = identity) {
-        return startsWith(getCanonicalFileName(str), getCanonicalFileName(prefix2)) ? str.substring(prefix2.length) : void 0;
+      function tryRemovePrefix(str, prefix, getCanonicalFileName = identity) {
+        return startsWith(getCanonicalFileName(str), getCanonicalFileName(prefix)) ? str.substring(prefix.length) : void 0;
       }
-      function isPatternMatch({ prefix: prefix2, suffix }, candidate) {
-        return candidate.length >= prefix2.length + suffix.length && startsWith(candidate, prefix2) && endsWith(candidate, suffix);
+      function isPatternMatch({ prefix, suffix }, candidate) {
+        return candidate.length >= prefix.length + suffix.length && startsWith(candidate, prefix) && endsWith(candidate, suffix);
       }
       function and(f, g2) {
         return (arg) => f(arg) && g2(arg);
@@ -18523,8 +18607,8 @@ ${lanes.join("\n")}
         );
         const firstComponent = pathComponents2[0];
         if (isAbsolutePathAnUrl && isRootedDiskPath(firstComponent)) {
-          const prefix2 = firstComponent.charAt(0) === directorySeparator ? "file://" : "file:///";
-          pathComponents2[0] = prefix2 + firstComponent;
+          const prefix = firstComponent.charAt(0) === directorySeparator ? "file://" : "file:///";
+          pathComponents2[0] = prefix + firstComponent;
         }
         return getPathFromPathComponents(pathComponents2);
       }
@@ -35540,12 +35624,12 @@ ${lanes.join("\n")}
           node.symbol = void 0;
           return node;
         }
-        function createBaseGeneratedIdentifier(text, autoGenerateFlags, prefix2, suffix) {
+        function createBaseGeneratedIdentifier(text, autoGenerateFlags, prefix, suffix) {
           const node = createBaseIdentifier(escapeLeadingUnderscores(text));
           setIdentifierAutoGenerate(node, {
             flags: autoGenerateFlags,
             id: nextAutoGenerateId,
-            prefix: prefix2,
+            prefix,
             suffix
           });
           nextAutoGenerateId++;
@@ -35568,10 +35652,10 @@ ${lanes.join("\n")}
           }
           return node;
         }
-        function createTempVariable(recordTempVariable, reservedInNestedScopes, prefix2, suffix) {
+        function createTempVariable(recordTempVariable, reservedInNestedScopes, prefix, suffix) {
           let flags2 = 1;
           if (reservedInNestedScopes) flags2 |= 8;
-          const name = createBaseGeneratedIdentifier("", flags2, prefix2, suffix);
+          const name = createBaseGeneratedIdentifier("", flags2, prefix, suffix);
           if (recordTempVariable) {
             recordTempVariable(name);
           }
@@ -35589,23 +35673,23 @@ ${lanes.join("\n")}
             void 0
           );
         }
-        function createUniqueName(text, flags2 = 0, prefix2, suffix) {
+        function createUniqueName(text, flags2 = 0, prefix, suffix) {
           Debug.assert(!(flags2 & 7), "Argument out of range: flags");
           Debug.assert((flags2 & (16 | 32)) !== 32, "GeneratedIdentifierFlags.FileLevel cannot be set without also setting GeneratedIdentifierFlags.Optimistic");
-          return createBaseGeneratedIdentifier(text, 3 | flags2, prefix2, suffix);
+          return createBaseGeneratedIdentifier(text, 3 | flags2, prefix, suffix);
         }
-        function getGeneratedNameForNode(node, flags2 = 0, prefix2, suffix) {
+        function getGeneratedNameForNode(node, flags2 = 0, prefix, suffix) {
           Debug.assert(!(flags2 & 7), "Argument out of range: flags");
           const text = !node ? "" : isMemberName(node) ? formatGeneratedName(
             /*privateName*/
             false,
-            prefix2,
+            prefix,
             node,
             suffix,
             idText
           ) : `generated@${getNodeId(node)}`;
-          if (prefix2 || suffix) flags2 |= 16;
-          const name = createBaseGeneratedIdentifier(text, 4 | flags2, prefix2, suffix);
+          if (prefix || suffix) flags2 |= 16;
+          const name = createBaseGeneratedIdentifier(text, 4 | flags2, prefix, suffix);
           name.original = node;
           return name;
         }
@@ -35622,33 +35706,33 @@ ${lanes.join("\n")}
           if (!startsWith(text, "#")) Debug.fail("First character of private identifier must be #: " + text);
           return createBasePrivateIdentifier(escapeLeadingUnderscores(text));
         }
-        function createBaseGeneratedPrivateIdentifier(text, autoGenerateFlags, prefix2, suffix) {
+        function createBaseGeneratedPrivateIdentifier(text, autoGenerateFlags, prefix, suffix) {
           const node = createBasePrivateIdentifier(escapeLeadingUnderscores(text));
           setIdentifierAutoGenerate(node, {
             flags: autoGenerateFlags,
             id: nextAutoGenerateId,
-            prefix: prefix2,
+            prefix,
             suffix
           });
           nextAutoGenerateId++;
           return node;
         }
-        function createUniquePrivateName(text, prefix2, suffix) {
+        function createUniquePrivateName(text, prefix, suffix) {
           if (text && !startsWith(text, "#")) Debug.fail("First character of private identifier must be #: " + text);
           const autoGenerateFlags = 8 | (text ? 3 : 1);
-          return createBaseGeneratedPrivateIdentifier(text ?? "", autoGenerateFlags, prefix2, suffix);
+          return createBaseGeneratedPrivateIdentifier(text ?? "", autoGenerateFlags, prefix, suffix);
         }
-        function getGeneratedPrivateNameForNode(node, prefix2, suffix) {
+        function getGeneratedPrivateNameForNode(node, prefix, suffix) {
           const text = isMemberName(node) ? formatGeneratedName(
             /*privateName*/
             true,
-            prefix2,
+            prefix,
             node,
             suffix,
             idText
           ) : `#generated@${getNodeId(node)}`;
-          const flags2 = prefix2 || suffix ? 16 : 0;
-          const name = createBaseGeneratedPrivateIdentifier(text, 4 | flags2, prefix2, suffix);
+          const flags2 = prefix || suffix ? 16 : 0;
+          const name = createBaseGeneratedPrivateIdentifier(text, 4 | flags2, prefix, suffix);
           name.original = node;
           return name;
         }
@@ -40450,13 +40534,13 @@ ${lanes.join("\n")}
             [expr]
           );
         }
-        function createSetFunctionNameHelper(f, name, prefix2) {
+        function createSetFunctionNameHelper(f, name, prefix) {
           context.requestEmitHelper(setFunctionNameHelper);
           return context.factory.createCallExpression(
             getUnscopedHelperName("__setFunctionName"),
             /*typeArguments*/
             void 0,
-            prefix2 ? [f, name, context.factory.createStringLiteral(prefix2)] : [f, name]
+            prefix ? [f, name, context.factory.createStringLiteral(prefix)] : [f, name]
           );
         }
         function createValuesHelper(expression) {
@@ -42793,11 +42877,11 @@ ${lanes.join("\n")}
       function formatIdentifierWorker(node, generateName) {
         return isGeneratedPrivateIdentifier(node) ? generateName(node).slice(1) : isGeneratedIdentifier(node) ? generateName(node) : isPrivateIdentifier(node) ? node.escapedText.slice(1) : idText(node);
       }
-      function formatGeneratedName(privateName, prefix2, baseName, suffix, generateName) {
-        prefix2 = formatGeneratedNamePart(prefix2, generateName);
+      function formatGeneratedName(privateName, prefix, baseName, suffix, generateName) {
+        prefix = formatGeneratedNamePart(prefix, generateName);
         suffix = formatGeneratedNamePart(suffix, generateName);
         baseName = formatIdentifier(baseName, generateName);
-        return `${privateName ? "#" : ""}${prefix2}${baseName}${suffix}`;
+        return `${privateName ? "#" : ""}${prefix}${baseName}${suffix}`;
       }
       function createAccessorPropertyBackingField(factory2, node, modifiers, initializer) {
         return factory2.updatePropertyDeclaration(
@@ -62872,11 +62956,11 @@ ${lanes.join("\n")}
               candidates.push({ ending: void 0, value: relativeToBaseUrl });
             }
             if (indexOfStar !== -1) {
-              const prefix2 = pattern.substring(0, indexOfStar);
+              const prefix = pattern.substring(0, indexOfStar);
               const suffix = pattern.substring(indexOfStar + 1);
               for (const { ending, value } of candidates) {
-                if (value.length >= prefix2.length + suffix.length && startsWith(value, prefix2) && endsWith(value, suffix) && validateEnding({ ending, value })) {
-                  const matchedStar = value.substring(prefix2.length, value.length - suffix.length);
+                if (value.length >= prefix.length + suffix.length && startsWith(value, prefix) && endsWith(value, suffix) && validateEnding({ ending, value })) {
+                  const matchedStar = value.substring(prefix.length, value.length - suffix.length);
                   if (!pathIsRelative(matchedStar)) {
                     return replaceFirstStar(key, matchedStar);
                   }
@@ -82575,9 +82659,9 @@ ${lanes.join("\n")}
                     }
                     secondaryRootErrors.unshift([mappedMsg, args[0], args[1]]);
                   } else {
-                    const prefix2 = msg.code === Diagnostics.Construct_signature_return_types_0_and_1_are_incompatible.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "new " : "";
+                    const prefix = msg.code === Diagnostics.Construct_signature_return_types_0_and_1_are_incompatible.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "new " : "";
                     const params = msg.code === Diagnostics.Call_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code || msg.code === Diagnostics.Construct_signatures_with_no_arguments_have_incompatible_return_types_0_and_1.code ? "" : "...";
-                    path = `${prefix2}${path}(${params})`;
+                    path = `${prefix}${path}(${params})`;
                   }
                   break;
                 }
@@ -117419,13 +117503,13 @@ ${lanes.join("\n")}
         }
         function createHoistedVariableForClass(name, node, suffix) {
           const { className } = getPrivateIdentifierEnvironment().data;
-          const prefix2 = className ? { prefix: "_", node: className, suffix: "_" } : "_";
-          const identifier = typeof name === "object" ? factory2.getGeneratedNameForNode(name, 16 | 8, prefix2, suffix) : typeof name === "string" ? factory2.createUniqueName(name, 16, prefix2, suffix) : factory2.createTempVariable(
+          const prefix = className ? { prefix: "_", node: className, suffix: "_" } : "_";
+          const identifier = typeof name === "object" ? factory2.getGeneratedNameForNode(name, 16 | 8, prefix, suffix) : typeof name === "string" ? factory2.createUniqueName(name, 16, prefix, suffix) : factory2.createTempVariable(
             /*recordTempVariable*/
             void 0,
             /*reservedInNestedScopes*/
             true,
-            prefix2,
+            prefix,
             suffix
           );
           if (resolver.hasNodeCheckFlag(
@@ -118498,7 +118582,7 @@ ${lanes.join("\n")}
           if (!decoratorExpressions) {
             return void 0;
           }
-          const prefix2 = getClassMemberPrefix(node, member);
+          const prefix = getClassMemberPrefix(node, member);
           const memberName = getExpressionForPropertyName(
             member,
             /*generateNameForComputedPropertyName*/
@@ -118511,7 +118595,7 @@ ${lanes.join("\n")}
           const descriptor = isPropertyDeclaration(member) && !hasAccessorModifier(member) ? factory2.createVoidZero() : factory2.createNull();
           const helper = emitHelpers().createDecorateHelper(
             decoratorExpressions,
-            prefix2,
+            prefix,
             memberName,
             descriptor
           );
@@ -120414,13 +120498,13 @@ ${lanes.join("\n")}
             3072
             /* NoComments */
           );
-          const prefix2 = kind === "get" || kind === "set" ? kind : void 0;
+          const prefix = kind === "get" || kind === "set" ? kind : void 0;
           const functionName = factory2.createStringLiteralFromNode(
             name,
             /*isSingleQuote*/
             void 0
           );
-          const namedFunction = emitHelpers().createSetFunctionNameHelper(func, functionName, prefix2);
+          const namedFunction = emitHelpers().createSetFunctionNameHelper(func, functionName, prefix);
           const method = factory2.createPropertyAssignment(factory2.createIdentifier(kind), namedFunction);
           setOriginalNode(method, original);
           setSourceMapRange(method, moveRangePastDecorators(original));
@@ -141200,9 +141284,9 @@ ${lanes.join("\n")}
             emitExpression(node, parenthesizerRule);
           }
         }
-        function emitNodeWithPrefix(prefix2, prefixWriter, node, emit2) {
+        function emitNodeWithPrefix(prefix, prefixWriter, node, emit2) {
           if (node) {
-            prefixWriter(prefix2);
+            prefixWriter(prefix);
             emit2(node);
           }
         }
@@ -141940,10 +142024,10 @@ ${lanes.join("\n")}
             return autoGeneratedIdToGeneratedName[autoGenerateId] || (autoGeneratedIdToGeneratedName[autoGenerateId] = makeName(name));
           }
         }
-        function generateNameCached(node, privateName, flags, prefix2, suffix) {
+        function generateNameCached(node, privateName, flags, prefix, suffix) {
           const nodeId = getNodeId(node);
           const cache = privateName ? nodeIdToGeneratedPrivateName : nodeIdToGeneratedName;
-          return cache[nodeId] || (cache[nodeId] = generateNameForNode(node, privateName, flags ?? 0, formatGeneratedNamePart(prefix2, generateName), formatGeneratedNamePart(suffix)));
+          return cache[nodeId] || (cache[nodeId] = generateNameForNode(node, privateName, flags ?? 0, formatGeneratedNamePart(prefix, generateName), formatGeneratedNamePart(suffix)));
         }
         function isUniqueName(name, privateName) {
           return isFileLevelUniqueNameInCurrentFile(name, privateName) && !isReservedName(name, privateName) && !generatedNames.has(name);
@@ -142010,15 +142094,15 @@ ${lanes.join("\n")}
               break;
           }
         }
-        function makeTempVariableName(flags, reservedInNestedScopes, privateName, prefix2, suffix) {
-          if (prefix2.length > 0 && prefix2.charCodeAt(0) === 35) {
-            prefix2 = prefix2.slice(1);
+        function makeTempVariableName(flags, reservedInNestedScopes, privateName, prefix, suffix) {
+          if (prefix.length > 0 && prefix.charCodeAt(0) === 35) {
+            prefix = prefix.slice(1);
           }
-          const key = formatGeneratedName(privateName, prefix2, "", suffix);
+          const key = formatGeneratedName(privateName, prefix, "", suffix);
           let tempFlags2 = getTempFlags(key);
           if (flags && !(tempFlags2 & flags)) {
             const name = flags === 268435456 ? "_i" : "_n";
-            const fullName = formatGeneratedName(privateName, prefix2, name, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, name, suffix);
             if (isUniqueName(fullName, privateName)) {
               tempFlags2 |= flags;
               if (privateName) {
@@ -142035,7 +142119,7 @@ ${lanes.join("\n")}
             tempFlags2++;
             if (count !== 8 && count !== 13) {
               const name = count < 26 ? "_" + String.fromCharCode(97 + count) : "_" + (count - 26);
-              const fullName = formatGeneratedName(privateName, prefix2, name, suffix);
+              const fullName = formatGeneratedName(privateName, prefix, name, suffix);
               if (isUniqueName(fullName, privateName)) {
                 if (privateName) {
                   reservePrivateNameInNestedScopes(fullName);
@@ -142048,15 +142132,15 @@ ${lanes.join("\n")}
             }
           }
         }
-        function makeUniqueName2(baseName, checkFn = isUniqueName, optimistic, scoped, privateName, prefix2, suffix) {
+        function makeUniqueName2(baseName, checkFn = isUniqueName, optimistic, scoped, privateName, prefix, suffix) {
           if (baseName.length > 0 && baseName.charCodeAt(0) === 35) {
             baseName = baseName.slice(1);
           }
-          if (prefix2.length > 0 && prefix2.charCodeAt(0) === 35) {
-            prefix2 = prefix2.slice(1);
+          if (prefix.length > 0 && prefix.charCodeAt(0) === 35) {
+            prefix = prefix.slice(1);
           }
           if (optimistic) {
-            const fullName = formatGeneratedName(privateName, prefix2, baseName, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, baseName, suffix);
             if (checkFn(fullName, privateName)) {
               if (privateName) {
                 reservePrivateNameInNestedScopes(fullName);
@@ -142073,7 +142157,7 @@ ${lanes.join("\n")}
           }
           let i = 1;
           while (true) {
-            const fullName = formatGeneratedName(privateName, prefix2, baseName + i, suffix);
+            const fullName = formatGeneratedName(privateName, prefix, baseName + i, suffix);
             if (checkFn(fullName, privateName)) {
               if (privateName) {
                 reservePrivateNameInNestedScopes(fullName);
@@ -142170,7 +142254,7 @@ ${lanes.join("\n")}
             ""
           );
         }
-        function generateNameForMethodOrAccessor(node, privateName, prefix2, suffix) {
+        function generateNameForMethodOrAccessor(node, privateName, prefix, suffix) {
           if (isIdentifier2(node.name)) {
             return generateNameCached(node.name, privateName);
           }
@@ -142179,11 +142263,11 @@ ${lanes.join("\n")}
             /*reservedInNestedScopes*/
             false,
             privateName,
-            prefix2,
+            prefix,
             suffix
           );
         }
-        function generateNameForNode(node, privateName, flags, prefix2, suffix) {
+        function generateNameForNode(node, privateName, flags, prefix, suffix) {
           switch (node.kind) {
             case 80:
             case 81:
@@ -142193,20 +142277,20 @@ ${lanes.join("\n")}
                 !!(flags & 16),
                 !!(flags & 8),
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
             case 267:
             case 266:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForModuleOrEnum(node);
             case 272:
             case 278:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForImportOrExportDeclaration(node);
             case 262:
             case 263: {
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               const name = node.name;
               if (name && !isGeneratedIdentifier(name)) {
                 return generateNameForNode(
@@ -142214,29 +142298,29 @@ ${lanes.join("\n")}
                   /*privateName*/
                   false,
                   flags,
-                  prefix2,
+                  prefix,
                   suffix
                 );
               }
               return generateNameForExportDefault();
             }
             case 277:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForExportDefault();
             case 231:
-              Debug.assert(!prefix2 && !suffix && !privateName);
+              Debug.assert(!prefix && !suffix && !privateName);
               return generateNameForClassExpression();
             case 174:
             case 177:
             case 178:
-              return generateNameForMethodOrAccessor(node, privateName, prefix2, suffix);
+              return generateNameForMethodOrAccessor(node, privateName, prefix, suffix);
             case 167:
               return makeTempVariableName(
                 0,
                 /*reservedInNestedScopes*/
                 true,
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
             default:
@@ -142245,18 +142329,18 @@ ${lanes.join("\n")}
                 /*reservedInNestedScopes*/
                 false,
                 privateName,
-                prefix2,
+                prefix,
                 suffix
               );
           }
         }
         function makeName(name) {
           const autoGenerate = name.emitNode.autoGenerate;
-          const prefix2 = formatGeneratedNamePart(autoGenerate.prefix, generateName);
+          const prefix = formatGeneratedNamePart(autoGenerate.prefix, generateName);
           const suffix = formatGeneratedNamePart(autoGenerate.suffix);
           switch (autoGenerate.flags & 7) {
             case 1:
-              return makeTempVariableName(0, !!(autoGenerate.flags & 8), isPrivateIdentifier(name), prefix2, suffix);
+              return makeTempVariableName(0, !!(autoGenerate.flags & 8), isPrivateIdentifier(name), prefix, suffix);
             case 2:
               Debug.assertNode(name, isIdentifier2);
               return makeTempVariableName(
@@ -142264,7 +142348,7 @@ ${lanes.join("\n")}
                 !!(autoGenerate.flags & 8),
                 /*privateName*/
                 false,
-                prefix2,
+                prefix,
                 suffix
               );
             case 3:
@@ -142274,7 +142358,7 @@ ${lanes.join("\n")}
                 !!(autoGenerate.flags & 16),
                 !!(autoGenerate.flags & 8),
                 isPrivateIdentifier(name),
-                prefix2,
+                prefix,
                 suffix
               );
           }
@@ -158830,8 +158914,8 @@ ${lanes.join("\n")}
       }
       function buildLinkParts(link, checker) {
         var _a;
-        const prefix2 = isJSDocLink(link) ? "link" : isJSDocLinkCode(link) ? "linkcode" : "linkplain";
-        const parts = [linkPart(`{@${prefix2} `)];
+        const prefix = isJSDocLink(link) ? "link" : isJSDocLinkCode(link) ? "linkcode" : "linkplain";
+        const parts = [linkPart(`{@${prefix} `)];
         if (!link.name) {
           if (link.text) {
             parts.push(linkTextPart(link.text));
@@ -160304,9 +160388,9 @@ ${lanes.join("\n")}
           let token = 0;
           let lastNonTriviaToken = 0;
           const templateStack = [];
-          const { prefix: prefix2, pushTemplate } = getPrefixFromLexState(lexState);
-          text = prefix2 + text;
-          const offset = prefix2.length;
+          const { prefix, pushTemplate } = getPrefixFromLexState(lexState);
+          text = prefix + text;
+          const offset = prefix.length;
           if (pushTemplate) {
             templateStack.push(
               16
@@ -169464,11 +169548,11 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           if (decls && decls.some((d3) => d3.parent === scopeDecl)) {
             return factory.createIdentifier(symbol.name);
           }
-          const prefix2 = tryReplaceWithQualifiedNameOrPropertyAccess(symbol.parent, scopeDecl, isTypeNode2);
-          if (prefix2 === void 0) {
+          const prefix = tryReplaceWithQualifiedNameOrPropertyAccess(symbol.parent, scopeDecl, isTypeNode2);
+          if (prefix === void 0) {
             return void 0;
           }
-          return isTypeNode2 ? factory.createQualifiedName(prefix2, factory.createIdentifier(symbol.name)) : factory.createPropertyAccessExpression(prefix2, symbol.name);
+          return isTypeNode2 ? factory.createQualifiedName(prefix, factory.createIdentifier(symbol.name)) : factory.createPropertyAccessExpression(prefix, symbol.name);
         }
       }
       function getExtractableParent(node) {
@@ -170783,13 +170867,13 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         if (textChangeRange) {
           if (version2 !== sourceFile.version) {
             let newText;
-            const prefix2 = textChangeRange.span.start !== 0 ? sourceFile.text.substr(0, textChangeRange.span.start) : "";
+            const prefix = textChangeRange.span.start !== 0 ? sourceFile.text.substr(0, textChangeRange.span.start) : "";
             const suffix = textSpanEnd(textChangeRange.span) !== sourceFile.text.length ? sourceFile.text.substr(textSpanEnd(textChangeRange.span)) : "";
             if (textChangeRange.newLength === 0) {
-              newText = prefix2 && suffix ? prefix2 + suffix : prefix2 || suffix;
+              newText = prefix && suffix ? prefix + suffix : prefix || suffix;
             } else {
               const changedText = scriptSnapshot.getText(textChangeRange.span.start, textChangeRange.span.start + textChangeRange.newLength);
-              newText = prefix2 && suffix ? prefix2 + changedText + suffix : prefix2 ? prefix2 + changedText : changedText + suffix;
+              newText = prefix && suffix ? prefix + changedText + suffix : prefix ? prefix + changedText : changedText + suffix;
             }
             const newSourceFile = updateSourceFile(sourceFile, newText, textChangeRange, aggressiveChecks);
             setSourceFileFields(newSourceFile, scriptSnapshot, version2);
@@ -172919,8 +173003,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           const end = pos + 6;
           const typeChecker = program.getTypeChecker();
           const symbol = typeChecker.getSymbolAtLocation(node.parent);
-          const prefix2 = symbol ? `${typeChecker.symbolToString(symbol, node.parent)} ` : "";
-          return { text: `${prefix2}static {}`, pos, end };
+          const prefix = symbol ? `${typeChecker.symbolToString(symbol, node.parent)} ` : "";
+          return { text: `${prefix}static {}`, pos, end };
         }
         const declName = isAssignedExpression(node) ? node.parent.name : Debug.checkDefined(getNameOfDeclaration(node), "Expected call hierarchy item to have a name");
         let text = isIdentifier2(declName) ? idText(declName) : isStringOrNumericLiteralLike(declName) ? declName.text : isComputedPropertyName(declName) ? isStringOrNumericLiteralLike(declName.expression) ? declName.expression.text : void 0 : void 0;
@@ -176266,18 +176350,18 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         const commentNode = node.parent;
         const { leftSibling, rightSibling } = getLeftAndRightSiblings(node);
         let pos = commentNode.getStart();
-        let prefix2 = "";
+        let prefix = "";
         if (!leftSibling && commentNode.comment) {
           pos = findEndOfTextBetween(commentNode, commentNode.getStart(), node.getStart());
-          prefix2 = `${newLine} */${newLine}`;
+          prefix = `${newLine} */${newLine}`;
         }
         if (leftSibling) {
           if (fixAll && isJSDocTypedefTag(leftSibling)) {
             pos = node.getStart();
-            prefix2 = "";
+            prefix = "";
           } else {
             pos = findEndOfTextBetween(commentNode, leftSibling.getStart(), node.getStart());
-            prefix2 = `${newLine} */${newLine}`;
+            prefix = `${newLine} */${newLine}`;
           }
         }
         let end = commentNode.getEnd();
@@ -176291,7 +176375,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             suffix = `${newLine}/**${newLine} * `;
           }
         }
-        changes.replaceRange(sourceFile, { pos, end }, declaration, { prefix: prefix2, suffix });
+        changes.replaceRange(sourceFile, { pos, end }, declaration, { prefix, suffix });
       }
       function getLeftAndRightSiblings(typedefNode) {
         const commentNode = typedefNode.parent;
@@ -180709,9 +180793,9 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
               result.push(createDeleteFix(deletion, [Diagnostics.Remove_unused_declaration_for_Colon_0, name.getText(sourceFile)]));
             }
           }
-          const prefix2 = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode, sourceFile, token));
-          if (prefix2.length) {
-            result.push(createCodeFixAction(fixName3, prefix2, [Diagnostics.Prefix_0_with_an_underscore, token.getText(sourceFile)], fixIdPrefix, Diagnostics.Prefix_all_unused_declarations_with_where_possible));
+          const prefix = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode, sourceFile, token));
+          if (prefix.length) {
+            result.push(createCodeFixAction(fixName3, prefix, [Diagnostics.Prefix_0_with_an_underscore, token.getText(sourceFile)], fixIdPrefix, Diagnostics.Prefix_all_unused_declarations_with_where_possible));
           }
           return result;
         },
@@ -190412,9 +190496,9 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         function getDirectoryMatches(directoryName) {
           return mapDefined(tryGetDirectories(host, directoryName), (dir) => dir === "node_modules" ? void 0 : directoryResult(dir));
         }
-        function trimPrefixAndSuffix(path, prefix2) {
+        function trimPrefixAndSuffix(path, prefix) {
           return firstDefined(matchingSuffixes, (suffix) => {
-            const inner = withoutStartAndEnd(normalizePath(path), prefix2, suffix);
+            const inner = withoutStartAndEnd(normalizePath(path), prefix, suffix);
             return inner === void 0 ? void 0 : removeLeadingDirectorySeparator(inner);
           });
         }
@@ -190447,7 +190531,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         if (!match) {
           return void 0;
         }
-        const [, prefix2, kind, toComplete] = match;
+        const [, prefix, kind, toComplete] = match;
         const scriptPath = getDirectoryPath(sourceFile.path);
         const names = kind === "path" ? getCompletionEntriesForDirectoryFragment(
           toComplete,
@@ -190460,7 +190544,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           true,
           sourceFile.path
         ) : kind === "types" ? getCompletionEntriesFromTypings(program, host, moduleSpecifierResolutionHost, scriptPath, getFragmentDirectory(toComplete), getExtensionOptions(compilerOptions, 1, sourceFile)) : Debug.fail();
-        return addReplacementSpans(toComplete, range.pos + prefix2.length, arrayFrom(names.values()));
+        return addReplacementSpans(toComplete, range.pos + prefix.length, arrayFrom(names.values()));
       }
       function getCompletionEntriesFromTypings(program, host, moduleSpecifierResolutionHost, scriptPath, fragmentDirectory, extensionOptions, result = createNameAndKindSet()) {
         const options = program.getCompilerOptions();
@@ -196811,8 +196895,8 @@ ${content}
       ), spacePart()];
       function getSignatureHelpItem(candidateSignature, callTargetDisplayParts, isTypeParameterList, checker, enclosingDeclaration, sourceFile) {
         const infos = (isTypeParameterList ? itemInfoForTypeParameters : itemInfoForParameters)(candidateSignature, checker, enclosingDeclaration, sourceFile);
-        return map(infos, ({ isVariadic, parameters, prefix: prefix2, suffix }) => {
-          const prefixDisplayParts = [...callTargetDisplayParts, ...prefix2];
+        return map(infos, ({ isVariadic, parameters, prefix, suffix }) => {
+          const prefixDisplayParts = [...callTargetDisplayParts, ...prefix];
           const suffixDisplayParts = [...suffix, ...returnTypeToDisplayParts(candidateSignature, enclosingDeclaration, checker)];
           const documentation = candidateSignature.getDocumentationComment(checker);
           const tags = candidateSignature.getJsDocTags();
@@ -198899,11 +198983,11 @@ ${options.prefix}` : "\n" : options.prefix
           const noIndent = options.indentation !== void 0 || getLineStartPositionForPosition(pos, targetSourceFile) === pos ? text : text.replace(/^\s+/, "");
           return (options.prefix || "") + noIndent + (!options.suffix || endsWith(noIndent, options.suffix) ? "" : options.suffix);
         }
-        function getFormattedTextOfNode(nodeIn, targetSourceFile, sourceFile, pos, { indentation, prefix: prefix2, delta }, newLineCharacter, formatContext, validate) {
+        function getFormattedTextOfNode(nodeIn, targetSourceFile, sourceFile, pos, { indentation, prefix, delta }, newLineCharacter, formatContext, validate) {
           const { node, text } = getNonformattedText(nodeIn, targetSourceFile, newLineCharacter);
           if (validate) validate(node, text);
           const formatOptions = getFormatCodeSettingsForWriting(formatContext, targetSourceFile);
-          const initialIndentation = indentation !== void 0 ? indentation : ts_formatting_exports.SmartIndenter.getIndentation(pos, sourceFile, formatOptions, prefix2 === newLineCharacter || getLineStartPositionForPosition(pos, targetSourceFile) === pos);
+          const initialIndentation = indentation !== void 0 ? indentation : ts_formatting_exports.SmartIndenter.getIndentation(pos, sourceFile, formatOptions, prefix === newLineCharacter || getLineStartPositionForPosition(pos, targetSourceFile) === pos);
           if (delta === void 0) {
             delta = ts_formatting_exports.SmartIndenter.shouldIndentChildNode(formatOptions, nodeIn) ? formatOptions.indentSize || 0 : 0;
           }
@@ -216628,9 +216712,9 @@ Project '${project.projectName}' (${ProjectKind[project.projectKind]}) ${counter
           );
           if (completions === void 0) return void 0;
           if (kind === "completions-full") return completions;
-          const prefix2 = args.prefix || "";
+          const prefix = args.prefix || "";
           const entries = mapDefined(completions.entries, (entry) => {
-            if (completions.isMemberCompletion || startsWith(entry.name.toLowerCase(), prefix2.toLowerCase())) {
+            if (completions.isMemberCompletion || startsWith(entry.name.toLowerCase(), prefix.toLowerCase())) {
               const convertedSpan = entry.replacementSpan ? toProtocolTextSpan(entry.replacementSpan, scriptInfo) : void 0;
               return {
                 ...entry,
@@ -221575,15 +221659,15 @@ var require_to_regex_range = __commonJS({
       }
       return tokens;
     }
-    function filterPatterns(arr, comparison, prefix2, intersection, options) {
+    function filterPatterns(arr, comparison, prefix, intersection, options) {
       let result = [];
       for (let ele of arr) {
         let { string } = ele;
         if (!intersection && !contains(comparison, "string", string)) {
-          result.push(prefix2 + string);
+          result.push(prefix + string);
         }
         if (intersection && contains(comparison, "string", string)) {
-          result.push(prefix2 + string);
+          result.push(prefix + string);
         }
       }
       return result;
@@ -221694,7 +221778,7 @@ var require_fill_range = __commonJS({
     var toSequence = (parts, options, maxLen) => {
       parts.negatives.sort((a, b4) => a < b4 ? -1 : a > b4 ? 1 : 0);
       parts.positives.sort((a, b4) => a < b4 ? -1 : a > b4 ? 1 : 0);
-      let prefix2 = options.capture ? "" : "?:";
+      let prefix = options.capture ? "" : "?:";
       let positives = "";
       let negatives = "";
       let result;
@@ -221702,7 +221786,7 @@ var require_fill_range = __commonJS({
         positives = parts.positives.map((v2) => toMaxLen(String(v2), maxLen)).join("|");
       }
       if (parts.negatives.length) {
-        negatives = `-(${prefix2}${parts.negatives.map((v2) => toMaxLen(String(v2), maxLen)).join("|")})`;
+        negatives = `-(${prefix}${parts.negatives.map((v2) => toMaxLen(String(v2), maxLen)).join("|")})`;
       }
       if (positives && negatives) {
         result = `${positives}|${negatives}`;
@@ -221710,7 +221794,7 @@ var require_fill_range = __commonJS({
         result = positives || negatives;
       }
       if (options.wrap) {
-        return `(${prefix2}${result})`;
+        return `(${prefix}${result})`;
       }
       return result;
     };
@@ -221726,8 +221810,8 @@ var require_fill_range = __commonJS({
     var toRegex = (start, end, options) => {
       if (Array.isArray(start)) {
         let wrap = options.wrap === true;
-        let prefix2 = options.capture ? "" : "?:";
-        return wrap ? `(${prefix2}${start.join("|")})` : start.join("|");
+        let prefix = options.capture ? "" : "?:";
+        return wrap ? `(${prefix}${start.join("|")})` : start.join("|");
       }
       return toRegexRange(start, end, options);
     };
@@ -221849,20 +221933,20 @@ var require_compile = __commonJS({
         const invalidBlock = utils.isInvalidBrace(parent);
         const invalidNode = node.invalid === true && options.escapeInvalid === true;
         const invalid = invalidBlock === true || invalidNode === true;
-        const prefix2 = options.escapeInvalid === true ? "\\" : "";
+        const prefix = options.escapeInvalid === true ? "\\" : "";
         let output = "";
         if (node.isOpen === true) {
-          return prefix2 + node.value;
+          return prefix + node.value;
         }
         if (node.isClose === true) {
-          console.log("node.isClose", prefix2, node.value);
-          return prefix2 + node.value;
+          console.log("node.isClose", prefix, node.value);
+          return prefix + node.value;
         }
         if (node.type === "open") {
-          return invalid ? prefix2 + node.value : "(";
+          return invalid ? prefix + node.value : "(";
         }
         if (node.type === "close") {
-          return invalid ? prefix2 + node.value : ")";
+          return invalid ? prefix + node.value : ")";
         }
         if (node.type === "comma") {
           return node.prev.type === "comma" ? "" : invalid ? node.value : "|";
@@ -222898,10 +222982,10 @@ var require_scan = __commonJS({
         isGlob = false;
       }
       let base = str;
-      let prefix2 = "";
+      let prefix = "";
       let glob = "";
       if (start > 0) {
-        prefix2 = str.slice(0, start);
+        prefix = str.slice(0, start);
         str = str.slice(start);
         lastIndex -= start;
       }
@@ -222926,7 +223010,7 @@ var require_scan = __commonJS({
         }
       }
       const state = {
-        prefix: prefix2,
+        prefix,
         input,
         start,
         base,
@@ -222955,7 +223039,7 @@ var require_scan = __commonJS({
           if (opts.tokens) {
             if (idx === 0 && start !== 0) {
               tokens[idx].isPrefix = true;
-              tokens[idx].value = prefix2;
+              tokens[idx].value = prefix;
             } else {
               tokens[idx].value = value;
             }
@@ -227173,8 +227257,8 @@ ${nodeLocation}` : message2;
       errors.ArgumentTypeError = ArgumentTypeError;
       class PathNotFoundError extends BaseError {
         path;
-        constructor(path2, prefix2 = "Path") {
-          super(`${prefix2} not found: ${path2}`);
+        constructor(path2, prefix = "Path") {
+          super(`${prefix} not found: ${path2}`);
           this.path = path2;
         }
         code = "ENOENT";
@@ -283492,32 +283576,26 @@ function parseDevArgs(argv) {
     url,
     apiKey: process.env.ABLO_API_KEY,
     watch: watchEnabled,
-    planeLabel: "sandbox"
+    planeLabel: "branch"
   };
 }
 function classifyKey(apiKey) {
   if (!apiKey) {
     return {
       ok: false,
-      reason: `No API key. Run ${import_picocolors15.default.bold("npx ablo login")}, or set ${import_picocolors15.default.bold("ABLO_API_KEY")}: ${import_picocolors15.default.bold("sk_test_")} runs the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, ${import_picocolors15.default.bold("sk_live_")} deploys production with ${import_picocolors15.default.bold("npx ablo push")}.`
-    };
-  }
-  if (apiKey.startsWith("sk_test_")) return { ok: true };
-  if (apiKey.startsWith("sk_live_")) {
-    return {
-      ok: false,
-      reason: `A ${import_picocolors15.default.bold("sk_live_")} key deploys production schema in one reviewed step: ${import_picocolors15.default.bold("npx ablo push")}. The ${import_picocolors15.default.bold("--watch")} loop runs on a ${import_picocolors15.default.bold("sk_test_")} key, which reaches the same API and the same schema over its own rows.`
+      reason: `No API key. Run ${import_picocolors15.default.bold("npx ablo login")}, or set a branch-bound ${import_picocolors15.default.bold("ABLO_API_KEY")}. ${import_picocolors15.default.bold("npx ablo dev")} prepares a development branch.`
     };
   }
+  if ((0, import_credentialPolicy2.classifyCredentialKind)(apiKey) === "secret") return { ok: true };
   if ((0, import_credentialPolicy2.classifyCredentialKind)(apiKey) === "restricted") {
     return {
       ok: false,
-      reason: `Authoring schema needs a secret key. ${import_picocolors15.default.bold("sk_test_")} runs the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, ${import_picocolors15.default.bold("sk_live_")} deploys production with ${import_picocolors15.default.bold("npx ablo push")}. A restricted ${import_picocolors15.default.bold("rk_")} key carries only the scopes it was minted with.`
+      reason: `Authoring schema needs a branch-bound secret ${import_picocolors15.default.bold("sk_")} key. ${import_picocolors15.default.bold("npx ablo dev")} prepares a development branch. A restricted ${import_picocolors15.default.bold("rk_")} key carries only the scopes it was minted with.`
     };
   }
   return {
     ok: false,
-    reason: `${import_picocolors15.default.bold("ABLO_API_KEY")} is not an Ablo key. Expected ${import_picocolors15.default.bold("sk_test_\u2026")} for the ${import_picocolors15.default.bold("npx ablo dev")} watch loop, or ${import_picocolors15.default.bold("sk_live_\u2026")} for a production deploy with ${import_picocolors15.default.bold("npx ablo push")}.`
+    reason: `${import_picocolors15.default.bold("ABLO_API_KEY")} is not a secret Ablo key. Expected a branch-bound ${import_picocolors15.default.bold("sk_\u2026")} credential. Run ${import_picocolors15.default.bold("npx ablo dev")} to prepare a development branch.`
   };
 }
 function wireEnvLocal(apiKey, cwd = process.cwd()) {
@@ -283612,7 +283690,7 @@ async function runPush(schema, args) {
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a ${import_picocolors15.default.bold("sandbox")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`;
+    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`;
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
@@ -283638,7 +283716,7 @@ async function dev(argv, runtime = {}) {
     process.exit(1);
   }
   if (runtime.apiKey) args.apiKey = runtime.apiKey;
-  else if (!args.apiKey) args.apiKey = resolveEffectiveApiKey("sandbox").key;
+  else if (!args.apiKey) args.apiKey = resolveRuntimeApiKey("sandbox").key;
   if (runtime.branch) args.planeLabel = runtime.branch.slug;
   const key = classifyKey(args.apiKey);
   if (!key.ok) {
@@ -283667,7 +283745,7 @@ async function dev(argv, runtime = {}) {
   console.log(`  ${import_picocolors15.default.dim("api")}     ${args.url}
 `);
   const s = Y2();
-  s.start("Pushing schema definition (sandbox)");
+  s.start("Pushing schema definition (development branch)");
   const first = await runPush(schema, args);
   s.stop(first.message, first.ok ? 0 : 1);
   if (!first.ok) process.exit(1);
@@ -283692,7 +283770,7 @@ async function dev(argv, runtime = {}) {
   ${import_picocolors15.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
     console.log(`  ${import_picocolors15.default.dim("Frameworks load it automatically; plain Node: node --env-file=.env.local app.ts")}`);
   }
-  console.log(`  Your app is wired for ${runtime.branch ? `branch ${runtime.branch.slug}` : "the sandbox"}.`);
+  console.log(`  Your app is wired for ${runtime.branch ? `branch ${runtime.branch.slug}` : "this branch"}.`);
   if (!args.watch) return;
   const abs = (0, import_path5.resolve)(process.cwd(), args.schemaPath);
   console.log(`  ${import_picocolors15.default.dim(`watching ${args.schemaPath} \u2026 (Ctrl-C to stop)`)}
@@ -283864,9 +283942,9 @@ init_controlPlane();
 // src/credentialCapability.ts
 init_cjs_shims();
 var import_credentialPolicy3 = require("@abloatai/transaction/auth/credentialPolicy");
-init_config();
 function secretCounterpart(key) {
-  return modeFromKey(key) === "production" ? "sk_live_" : "sk_test_";
+  void key;
+  return "sk_";
 }
 function credentialCapability(key) {
   const kind = key ? (0, import_credentialPolicy3.classifyCredentialKind)(key) : null;
@@ -283879,7 +283957,7 @@ function credentialCapability(key) {
       return {
         kind,
         label: "scoped",
-        note: `A scoped key does exactly what it was minted for. The production key \`ablo login\` stores is for observing your live plane with \`ablo status\` and \`ablo logs\`; authoring schema there takes a secret ${secret} key from the dashboard.`
+        note: `A scoped key does exactly what it was minted for. Authoring schema requires a branch-bound secret ${secret} key with schema:push.`
       };
     case "publishable":
       return {
@@ -283984,12 +284062,13 @@ function selectWhoamiCredential(args, cwd = process.cwd()) {
       targetSource: "env"
     };
   }
-  const dataKey = resolveApiKey();
+  const runtimeKey = resolveRuntimeApiKey();
+  const dataKey = runtimeKey.key;
   if (dataKey) {
     return {
       key: dataKey,
-      source: process.env.ABLO_API_KEY ? "env:ABLO_API_KEY" : "stored data key",
-      targetSource: process.env.ABLO_API_KEY ? "env" : "stored"
+      source: runtimeKey.source === "stored" ? "stored data key" : `${runtimeKey.source ?? "env"}:ABLO_API_KEY`,
+      targetSource: runtimeKey.source ?? "stored"
     };
   }
   const managementKey = resolveManagementKey();
@@ -284072,6 +284151,7 @@ async function whoami(argv) {
 }
 
 // src/commands.ts
+init_push();
 var CORE_GROUPS = ["Start", "Every day", "More"];
 var FULL_GROUPS = [
   "Set up",
@@ -284170,6 +284250,7 @@ var COMMANDS = [
   },
   {
     name: "push",
+    usage: PUSH_USAGE,
     core: { group: "Every day", does: "Upload your schema \u2014 schema only; your rows stay in your database" },
     full: {
       group: "Your schema",
@@ -284261,7 +284342,7 @@ var COMMANDS = [
         { run: "branch check [id|slug]", does: "CI alias for branch status" },
         { run: "branch create <slug>", does: "Create a child of the production root" },
         { run: "branch ensure <slug> --credential", does: "Resolve a branch and mint its expiring CI key" },
-        { run: "branch credential <id>", does: "Mint an expiring branch-bound test key" },
+        { run: "branch credential <id>", does: "Mint an expiring branch-bound runtime key" },
         { run: "branch delete <id>", does: "Delete a non-root branch" }
       ]
     }
@@ -284701,16 +284782,14 @@ async function status(args = []) {
   const apiUrl3 = apiBaseUrl();
   const cfg = readConfig();
   const mode = getMode();
-  const effective = resolveEffectiveApiKey();
-  const target = effective.key ? await resolveTarget({ url: apiUrl3, apiKey: effective.key, keySource: effective.source ?? "stored" }) : null;
+  const runtimeKey = resolveRuntimeApiKey();
+  const target = runtimeKey.key ? await resolveTarget({ url: apiUrl3, apiKey: runtimeKey.key, keySource: runtimeKey.source ?? "stored" }) : null;
   if (args.includes("--json")) {
     const entry = getKeyEntry(mode);
-    const key2 = describeEffectiveKey(mode, process.env.ABLO_API_KEY, entry);
-    const plan2 = resolvePushPlan();
     const activeProject2 = getActiveProject();
-    const pushed2 = await fetchPushedSchema(apiUrl3, effective.key);
+    const pushed2 = await fetchPushedSchema(apiUrl3, runtimeKey.key);
     const reachableForJson = await ping(apiUrl3);
-    const dataSource2 = reachableForJson ? (await fetchRoutingState(apiUrl3, effective.key)).source : { kind: "unknown", detail: "unreachable" };
+    const dataSource2 = reachableForJson ? (await fetchRoutingState(apiUrl3, runtimeKey.key)).source : { kind: "unknown", detail: "unreachable" };
     const driftForJson = schemaDrift(await readLocalSchemaHash(), pushed2?.hash);
     const out = {
       // The locally-active project (`ablo projects use`); null = org-default.
@@ -284718,28 +284797,20 @@ async function status(args = []) {
       // The credential the CLI resolves for requests, with its source —
       // 'env' | '.env.local' | '.env' | 'stored'. Key confusion is a common
       // source of trouble, and the source is usually the answer.
-      effectiveKey: {
-        prefix: effective.key ? effective.key.slice(0, 12) : null,
-        source: effective.source,
+      runtimeKey: {
+        prefix: runtimeKey.key ? runtimeKey.key.slice(0, 12) : null,
+        source: runtimeKey.source,
         // What this credential can do. A pipeline that pushes can read it before
         // running the push, rather than learning from the 403 — the same fact
         // the human output prints, from the same place.
-        kind: credentialCapability(effective.key).kind
+        kind: credentialCapability(runtimeKey.key).kind
       },
-      keyPrefix: key2.keyPrefix,
-      keySource: key2.keySource,
-      keyMode: key2.keyMode,
-      storedKeyPrefix: key2.storedKeyPrefix,
-      keyMatchesActiveMode: key2.keyMatchesActiveMode,
-      keyMatchesStoredActiveKey: key2.keyMatchesStoredActiveKey,
-      keyMismatch: key2.keyMismatch,
       organizationId: entry?.organizationId ?? null,
       // The SERVER-CONFIRMED plane this key resolves to — the authoritative
       // answer to "where does a push land", independent of the local
       // project preference above. Null when the server didn't answer.
       confirmedTarget: target?.confirmed ? {
         organizationId: target.confirmed.organizationId,
-        environment: target.confirmed.environment,
         project: target.confirmed.project,
         projectId: target.confirmed.projectId,
         branchId: target.confirmed.branchId,
@@ -284747,14 +284818,7 @@ async function status(args = []) {
       } : null,
       // Divergence between local project intent and the confirmed target.
       mismatches: target?.mismatches ?? [],
-      // What `ablo push` would do right now — the answer to "why did push
-      // demand a different key".
-      push: {
-        flow: plan2.flow,
-        keyPrefix: plan2.apiKey?.slice(0, 12) ?? null,
-        keySource: plan2.source
-      },
-      // The schema active for this key's environment — the typename and conflict
+      // The schema active for this key's branch — the typename and conflict
       // rules the engine enforces, which may differ from your local `schema.ts`.
       // null means the server did not answer (unreachable, too old, or no key).
       schema: pushed2 ? {
@@ -284774,7 +284838,7 @@ async function status(args = []) {
       drift: driftForJson,
       blockers: blockers({
         reachable: reachableForJson,
-        hasKey: Boolean(effective.key),
+        hasKey: Boolean(runtimeKey.key),
         dataSource: dataSource2,
         schemaPushed: Boolean(pushed2?.active),
         drift: driftForJson
@@ -284786,19 +284850,15 @@ async function status(args = []) {
   console.log(`
   ${brand("ablo")} ${import_picocolors19.default.dim("status")}
 `);
-  if (effective.key && effective.source && effective.source !== "stored") {
-    const label = effective.source === "env" ? "ABLO_API_KEY env" : effective.source;
+  if (runtimeKey.key && runtimeKey.source && runtimeKey.source !== "stored") {
+    const label = runtimeKey.source === "env" ? "ABLO_API_KEY env" : runtimeKey.source;
     console.log(
-      `  ${import_picocolors19.default.dim("key")}     ${effective.key.slice(0, 12)}\u2026 ${import_picocolors19.default.dim(`(${label} \u2014 overrides stored)`)}`
+      `  ${import_picocolors19.default.dim("key")}     ${runtimeKey.key.slice(0, 12)}\u2026 ${import_picocolors19.default.dim(`(${label} \u2014 overrides stored)`)}`
     );
   } else if (!cfg) {
     console.log(`  ${import_picocolors19.default.yellow("!")} Not logged in \u2014 run ${import_picocolors19.default.bold("ablo login")}.`);
   }
   const activeEntry = getKeyEntry(mode);
-  const key = describeEffectiveKey(mode, process.env.ABLO_API_KEY, activeEntry);
-  if (key.keyMismatch) {
-    console.log(`    ${import_picocolors19.default.yellow(`! ${key.keyMismatch.message}`)}`);
-  }
   const activeProject = getActiveProject();
   printTargetLines(
     target,
@@ -284806,9 +284866,13 @@ async function status(args = []) {
     activeEntry?.organizationId,
     activeEntry?.organizationSlug
   );
+  const management = getManagementKeyEntry();
+  console.log(
+    `  ${import_picocolors19.default.dim("\u25CB")} ${"management".padEnd(12)}  ${management ? import_picocolors19.default.dim(`${management.apiKey.slice(0, 12)}\u2026${management.expiresAt ? ` \xB7 ${expiryLabel(management.expiresAt)}` : ""}`) : import_picocolors19.default.dim("\u2014 no key")}`
+  );
   for (const { key: m2, label } of [
-    { key: "sandbox", label: "management" },
-    { key: "production", label: "observer" }
+    { key: "sandbox", label: "legacy child" },
+    { key: "production", label: "legacy root" }
   ]) {
     const entry = getKeyEntry(m2);
     if (entry) {
@@ -284818,22 +284882,20 @@ async function status(args = []) {
       ].filter(Boolean);
       const trail = facts.length ? ` ${import_picocolors19.default.dim("\xB7")} ${facts.join(import_picocolors19.default.dim(" \xB7 "))}` : "";
       console.log(
-        `  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors19.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
+        `  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(12)}  ${import_picocolors19.default.dim(`${entry.apiKey.slice(0, 12)}\u2026`)}${trail}`
       );
-    } else {
-      console.log(`  ${import_picocolors19.default.dim("\u25CB")} ${label.padEnd(10)}  ${import_picocolors19.default.dim("\u2014 no key")}`);
     }
   }
-  const plan = resolvePushPlan();
+  const pushBranch = target?.confirmed?.branchRoot === true ? "production root" : target?.confirmed?.branchId ? `branch ${target.confirmed.branchId}` : runtimeKey.key ? "unknown branch" : "no branch";
   console.log(
-    `  ${import_picocolors19.default.dim("push")}    ${plan.apiKey ? `${import_picocolors19.default.bold(plan.flow)} ${import_picocolors19.default.dim(`with ${plan.apiKey.slice(0, 12)}\u2026 (${plan.source})`)}` : `${import_picocolors19.default.bold(plan.flow)} ${import_picocolors19.default.yellow("\u2014 no credential")} ${import_picocolors19.default.dim(`(run ${import_picocolors19.default.bold("ablo login")} or set ${import_picocolors19.default.bold("ABLO_API_KEY")})`)}`}`
+    `  ${import_picocolors19.default.dim("push")}    ${runtimeKey.key ? `${import_picocolors19.default.bold(pushBranch)} ${import_picocolors19.default.dim(`with ${runtimeKey.key.slice(0, 12)}\u2026 (${runtimeKey.source})`)}` : `${import_picocolors19.default.bold(pushBranch)} ${import_picocolors19.default.yellow("\u2014 no runtime key")} ${import_picocolors19.default.dim(`(set ${import_picocolors19.default.bold("ABLO_API_KEY")} or run ${import_picocolors19.default.bold("ablo dev")})`)}`}`
   );
-  const capability = credentialCapability(effective.key);
+  const capability = credentialCapability(runtimeKey.key);
   if (capability.note) console.log(`    ${import_picocolors19.default.dim(capability.note)}`);
   process.stdout.write(`  ${import_picocolors19.default.dim("api")}     ${apiUrl3}  `);
   const reachable = await ping(apiUrl3);
   console.log(reachable ? import_picocolors19.default.green("reachable") : import_picocolors19.default.red("unreachable"));
-  const introspectKey = effective.key;
+  const introspectKey = runtimeKey.key;
   const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, introspectKey) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
   if (dataSource.kind === "connected") {
     const how = [...new Set(dataSource.connections)].join(" + ");
@@ -284882,7 +284944,7 @@ async function status(args = []) {
   }
   const found = blockers({
     reachable,
-    hasKey: Boolean(effective.key),
+    hasKey: Boolean(runtimeKey.key),
     dataSource,
     schemaPushed: Boolean(pushed?.active),
     drift
@@ -284936,13 +284998,13 @@ async function doctor() {
   ${brand("ablo")} ${import_picocolors20.default.dim("doctor")}
 `);
   const apiUrl3 = apiBaseUrl();
-  const effective = resolveEffectiveApiKey();
+  const runtimeKey = resolveRuntimeApiKey();
   const checks = [];
-  if (effective.key) {
+  if (runtimeKey.key) {
     checks.push({
       label: "key",
       state: "ok",
-      detail: `${effective.key.slice(0, 12)}\u2026 from ${effective.source}`
+      detail: `${runtimeKey.key.slice(0, 12)}\u2026 from ${runtimeKey.source}`
     });
   } else {
     checks.push({
@@ -284961,7 +285023,7 @@ async function doctor() {
       fix: "check your connection, then re-run `ablo doctor`"
     }
   );
-  const target = effective.key ? await resolveTarget({ url: apiUrl3, apiKey: effective.key, keySource: effective.source ?? "stored" }) : null;
+  const target = runtimeKey.key ? await resolveTarget({ url: apiUrl3, apiKey: runtimeKey.key, keySource: runtimeKey.source ?? "stored" }) : null;
   const confirmed = target?.confirmed ?? null;
   if (confirmed) {
     const project = confirmed.project ? confirmed.project.isDefault ? "default" : confirmed.project.name === null ? `${confirmed.project.id} (unnamed \u2014 ${confirmed.project.unnamedReason ?? "the project list did not answer"})` : `${confirmed.project.slug} (${confirmed.project.id})` : "default";
@@ -284974,12 +285036,12 @@ async function doctor() {
     const local = getActiveProject();
     checks.push({
       label: "identity",
-      state: effective.key && reachable ? "fail" : "skip",
-      detail: effective.key ? `the server did not resolve this key${local ? ` (locally selected: ${local.slug})` : ""}` : "no key to resolve",
-      fix: effective.key ? "check the key is valid and not expired \u2014 `ablo login` mints a fresh pair" : void 0
+      state: runtimeKey.key && reachable ? "fail" : "skip",
+      detail: runtimeKey.key ? `the server did not resolve this key${local ? ` (locally selected: ${local.slug})` : ""}` : "no key to resolve",
+      fix: runtimeKey.key ? "check the key is valid and not expired \u2014 `ablo login` mints a fresh pair" : void 0
     });
   }
-  const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, effective.key) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
+  const { source: dataSource, validation } = reachable ? await fetchRoutingState(apiUrl3, runtimeKey.key) : { source: { kind: "unknown", detail: "unreachable" }, validation: null };
   if (dataSource.kind === "connected") {
     const how = [...new Set(dataSource.connections)].join(" + ");
     const pooled = detectPoolerIn(dataSource.hosts);
@@ -285001,13 +285063,13 @@ async function doctor() {
   } else {
     checks.push({ label: "data", state: "skip", detail: `not determined (${dataSource.detail})` });
   }
-  const pushed = reachable ? await fetchPushedSchema(apiUrl3, effective.key) : null;
+  const pushed = reachable ? await fetchPushedSchema(apiUrl3, runtimeKey.key) : null;
   checks.push(
     pushed?.active ? {
       label: "schema",
       state: "ok",
       detail: `${pushed.models.length} models active${pushed.hash ? `, hash ${pushed.hash}` : ""}`
-    } : reachable && effective.key ? { label: "schema", state: "fail", detail: "none active for this key", fix: "run `ablo push`" } : { label: "schema", state: "skip", detail: "not determined" }
+    } : reachable && runtimeKey.key ? { label: "schema", state: "fail", detail: "none active for this key", fix: "run `ablo push`" } : { label: "schema", state: "skip", detail: "not determined" }
   );
   const drift = schemaDrift(await readLocalSchemaHash(), pushed?.hash);
   if (drift) {
@@ -285038,7 +285100,7 @@ async function doctor() {
   for (const check2 of checks) render(check2);
   const blocking = blockers({
     reachable,
-    hasKey: Boolean(effective.key),
+    hasKey: Boolean(runtimeKey.key),
     dataSource,
     schemaPushed: Boolean(pushed?.active),
     drift
@@ -285077,8 +285139,7 @@ function parseLogsArgs(argv) {
     since: void 0,
     model: void 0,
     op: void 0,
-    json: false,
-    mode: void 0
+    json: false
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -285106,13 +285167,11 @@ function parseLogsArgs(argv) {
       case "--json":
         args.json = true;
         break;
-      case "--mode": {
-        const raw = argv[++i];
-        const m2 = normalizeMode(raw);
-        if (!m2) throw new import_errors16.AbloValidationError(`--mode expects "sandbox" or "production", got "${raw}"`, { code: "cli_invalid_arguments" });
-        args.mode = m2;
-        break;
-      }
+      case "--mode":
+        throw new import_errors16.AbloValidationError(
+          "--mode was removed. Logs follow the branch bound to ABLO_API_KEY; select a different branch by supplying its key.",
+          { code: "cli_invalid_arguments" }
+        );
       default:
         throw new import_errors16.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
@@ -285156,7 +285215,7 @@ async function logs(argv) {
     console.error(import_picocolors21.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  const apiKey = resolveApiKey(args.mode);
+  const apiKey = resolveRuntimeApiKey().key;
   if (!apiKey) {
     console.error(
       import_picocolors21.default.red(`  No API key.`) + import_picocolors21.default.dim(` Run ${import_picocolors21.default.bold("ablo login")} or set ${import_picocolors21.default.bold("ABLO_API_KEY")}.`)
@@ -285184,7 +285243,7 @@ async function logs(argv) {
   }
   if (!args.json) {
     console.log(`
-  ${brand("ablo")} ${import_picocolors21.default.dim("logs")} ${import_picocolors21.default.dim(`(${args.mode ?? "active"} mode)`)}
+  ${brand("ablo")} ${import_picocolors21.default.dim("logs")}
 `);
   }
   const initial = await fetchPage({
@@ -285250,7 +285309,7 @@ function positional(args) {
   return void 0;
 }
 function requireKey3(mode) {
-  const apiKey = resolveApiKey(mode);
+  const apiKey = resolveMutationApiKey(mode);
   if (!apiKey) {
     console.error(
       import_picocolors22.default.red("  No API key.") + import_picocolors22.default.dim(` Run ${import_picocolors22.default.bold("ablo login")} or set ${import_picocolors22.default.bold("ABLO_API_KEY")}.`)
@@ -285258,7 +285317,7 @@ function requireKey3(mode) {
     process.exit(1);
   }
   if ((0, import_credentialPolicy4.classifyCredentialKind)(apiKey) !== "secret") {
-    console.error(import_picocolors22.default.red("  Managing webhooks requires a secret key ") + import_picocolors22.default.dim("(sk_test_ / sk_live_)."));
+    console.error(import_picocolors22.default.red("  Managing webhooks requires a branch-bound secret key ") + import_picocolors22.default.dim("(sk_)."));
     process.exit(1);
   }
   return apiKey;
@@ -285556,8 +285615,8 @@ function hostOf(connectionString) {
 async function reportReadSubject(dbUrl) {
   const host = hostOf(dbUrl);
   console.log(`  ${import_picocolors23.default.dim("reading")} ${import_picocolors23.default.bold(host ?? "your database")}`);
-  const effective = resolveEffectiveApiKey();
-  const state = await fetchDataSourceState(apiBaseUrl(), effective.key);
+  const runtimeKey = resolveRuntimeApiKey();
+  const state = await fetchDataSourceState(apiBaseUrl(), runtimeKey.key);
   if (state.kind === "unknown") {
     console.log(
       `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("?")} ${import_picocolors23.default.dim(`couldn't ask which database Ablo reads (${state.detail})`)}
@@ -286580,27 +286639,7 @@ async function runPull(argv) {
 }
 async function runPush2(argv) {
   const rest = [...argv];
-  const advanced = rest.some(
-    (a) => ["--force", "--rename", "--backfill", "--url", "--dry-run", "--plan", "--yes", "-y", "--allow-dirty"].includes(a)
-  );
-  const watching = rest.includes("--watch");
-  const guard = guardActiveProjectKey();
-  if (!guard.ok && guard.available.length > 0 && !rest.includes("--url")) {
-    console.error(
-      `  ${import_picocolors28.default.yellow("\u26A0")} active project ${import_picocolors28.default.bold(guard.activeProfile)} has no stored key ${import_picocolors28.default.dim(
-        `(you have keys for: ${guard.available.join(", ")})`
-      )}`
-    );
-    const loginCmd = guard.activeProfile === "default" ? "ablo login" : `ablo login --project ${guard.activeProfile}`;
-    console.error(
-      import_picocolors28.default.dim(`    Mint one with ${import_picocolors28.default.bold(loginCmd)}, or switch with ${import_picocolors28.default.bold("ablo projects use <slug>")}.`)
-    );
-    process.exitCode = 1;
-    return;
-  }
-  const plan = resolvePushPlan();
-  if (advanced || plan.flow === "production" && !watching) await push(rest);
-  else await dev(rest);
+  await push(rest);
 }
 function runRenamedSchema(argv) {
   const forwarded = argv.slice(1).join(" ");
@@ -287029,7 +287068,7 @@ function generateEnv(storage, opts = {}) {
   const { includeApiKey = true } = opts;
   const databaseBlock = storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
-  const apiKeyBlock = includeApiKey ? "# Ablo: a sk_test_ key for local development (`npx ablo dev` wires this for you)\nABLO_API_KEY=sk_test_your_key_here\n" : "";
+  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` wires a development branch for you)\nABLO_API_KEY=sk_your_key_here\n" : "";
   return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;
 }
 function generateDataSource(orm) {
@@ -287105,8 +287144,8 @@ var WEBHOOK_DOC = `/**
  * signature, then write each change into YOUR database. The other half \u2014 your app
  * MAKING changes + live sync \u2014 is the Ablo client in \`ablo/index.ts\`.
  *
- * Just like Stripe: you call Ablo to make changes (client) and Ablo calls you to
- * persist them (this route). Reliability is built in \u2014 Ablo retries on any
+ * Your app calls Ablo to make changes, and Ablo calls this route to persist
+ * them. Reliability is built in \u2014 Ablo retries on any
  * non-2xx, and \`event.syncId\` is a monotonic log position, so apply in order and
  * dedupe (skip a \`syncId\` you've already stored).
  */`;