@abloatai/cli 0.56.0 → 0.58.0

package/dist/cli.cjs

@@ -827,9 +827,9 @@ var init_query = __esm({
     CLOSE = {};
     Query = class extends Promise {
       constructor(strings, args, handler, canceller, options = {}) {
-        let resolve10, reject;
+        let resolve11, reject;
         super((a, b4) => {
-          resolve10 = a;
+          resolve11 = a;
           reject = b4;
         });
         this.tagged = Array.isArray(strings.raw);
@@ -840,7 +840,7 @@ var init_query = __esm({
         this.options = options;
         this.state = null;
         this.statement = null;
-        this.resolve = (x2) => (this.active = false, resolve10(x2));
+        this.resolve = (x2) => (this.active = false, resolve11(x2));
         this.reject = (x2) => (this.active = false, reject(x2));
         this.active = false;
         this.cancelled = null;
@@ -888,12 +888,12 @@ var init_query = __esm({
               if (this.executed && !this.active)
                 return { done: true };
               prev && prev();
-              const promise = new Promise((resolve10, reject) => {
+              const promise = new Promise((resolve11, reject) => {
                 this.cursorFn = (value) => {
-                  resolve10({ value, done: false });
+                  resolve11({ value, done: false });
                   return new Promise((r2) => prev = r2);
                 };
-                this.resolve = () => (this.active = false, resolve10({ done: true }));
+                this.resolve = () => (this.active = false, resolve11({ done: true }));
                 this.reject = (x2) => (this.active = false, reject(x2));
               });
               this.execute();
@@ -1491,12 +1491,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x2.on("drain", drain);
     return x2;
   }
-  async function cancel({ pid, secret }, resolve10, reject) {
+  async function cancel({ pid, secret }, resolve11, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect2();
       socket.once("error", reject);
-      socket.once("close", resolve10);
+      socket.once("close", resolve11);
     } catch (error2) {
       reject(error2);
     }
@@ -2519,7 +2519,7 @@ var init_subscribe = __esm({
 
 // ../../node_modules/postgres/src/large.js
 function largeObject(sql, oid, mode = 131072 | 262144) {
-  return new Promise(async (resolve10, reject) => {
+  return new Promise(async (resolve11, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -2545,7 +2545,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           ) seek
         `
       };
-      resolve10(lo);
+      resolve11(lo);
       return new Promise(async (r2) => finish = r2);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -2707,8 +2707,8 @@ function Postgres(a, b4) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve10, reject) => {
-      const query = { reserve: resolve10, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve11, reject) => {
+      const query = { reserve: resolve11, reject };
       queries.push(query);
       closed.length && connect2(closed.shift(), query);
     });
@@ -2745,9 +2745,9 @@ function Postgres(a, b4) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve10, reject) => {
+        result = await new Promise((resolve11, reject) => {
           const x2 = fn2(sql2);
-          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve10, reject);
+          Promise.resolve(Array.isArray(x2) ? Promise.all(x2) : x2).then(resolve11, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -2804,8 +2804,8 @@ function Postgres(a, b4) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve10, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve10, reject) : query.cancelled = { resolve: resolve10, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve10());
+    return new Promise((resolve11, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve11, reject) : query.cancelled = { resolve: resolve11, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve11());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -2824,11 +2824,11 @@ function Postgres(a, b4) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve10) {
+  async function destroy(resolve11) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve10();
+    resolve11();
   }
   function connect2(c, query) {
     move(c, connecting);
@@ -3349,7 +3349,7 @@ function ambientEnvKeyNote(cwd) {
   return `Note: ${ambient.source} in this directory holds an ABLO_API_KEY, which this command does not load \u2014 it reads only the process environment and your stored login, so a file cannot silently choose a branch. Export the variable, or pass \`--env-file ` + ambient.source + "` to a connect command, to choose it explicitly.";
 }
 function resolveManagementKey() {
-  if (process.env.ABLO_MANAGEMENT_KEY) return process.env.ABLO_MANAGEMENT_KEY;
+  if (process.env.ABLO_API_KEY?.startsWith("mk_")) return process.env.ABLO_API_KEY;
   const cfg = readConfig();
   if (!cfg) return void 0;
   const entry = cfg.profiles[activeProfileName(cfg)]?.management;
@@ -3358,7 +3358,7 @@ function resolveManagementKey() {
   return entry.apiKey;
 }
 function resolveOrgManagementKey(options = {}) {
-  if (process.env.ABLO_MANAGEMENT_KEY) return process.env.ABLO_MANAGEMENT_KEY;
+  if (process.env.ABLO_API_KEY?.startsWith("mk_")) return process.env.ABLO_API_KEY;
   const cfg = readConfig({ persistMigrations: options.persistConfigMigrations });
   if (!cfg) return void 0;
   const profiles = [.../* @__PURE__ */ new Set([
@@ -3458,7 +3458,7 @@ function requireKey() {
   if (!apiKey) {
     console.error(
       import_picocolors3.default.red("  No project management credential.") + import_picocolors3.default.dim(
-        ` Run ${import_picocolors3.default.bold("npx ablo login")} \u2014 or set ${import_picocolors3.default.bold("ABLO_MANAGEMENT_KEY")} to an ${import_picocolors3.default.bold("mk_")} credential.`
+        ` Run ${import_picocolors3.default.bold("npx ablo login")} \u2014 or set ${import_picocolors3.default.bold("ABLO_API_KEY")} to an ${import_picocolors3.default.bold("mk_")} credential.`
       )
     );
     process.exit(1);
@@ -3481,15 +3481,18 @@ async function request(path, apiKey, init3 = {}, baseUrl2) {
   }
   return { status: res.status, body };
 }
+function projectListResult(status2, body) {
+  if (status2 !== 200) {
+    const code = typeof body === "object" && body !== null && "code" in body ? body.code : void 0;
+    return { ok: false, reason: typeof code === "string" ? code : `HTTP ${status2}` };
+  }
+  const parsed = import_wire.projectListResponseSchema.safeParse(body);
+  return parsed.success ? { ok: true, projects: parsed.data.data } : { ok: false, reason: "the response did not match the project list" };
+}
 async function listProjects(apiKey, baseUrl2) {
   try {
     const { status: status2, body } = await request("/api/v1/projects", apiKey, {}, baseUrl2);
-    if (status2 !== 200) {
-      const code = body?.code;
-      return { ok: false, reason: typeof code === "string" ? code : `HTTP ${status2}` };
-    }
-    const parsed = import_wire.projectListResponseSchema.safeParse(body);
-    return parsed.success ? { ok: true, projects: parsed.data.data } : { ok: false, reason: "the response did not match the project list" };
+    return projectListResult(status2, body);
   } catch (err) {
     return { ok: false, reason: err instanceof Error ? err.message : "the request failed" };
   }
@@ -3538,6 +3541,10 @@ async function ensureProject(slug, name) {
     return null;
   }
 }
+function projectDisplayName(p2) {
+  const spelling = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return p2.name && spelling(p2.name) !== spelling(p2.slug) ? p2.name : void 0;
+}
 function describeKeys(profile) {
   const now = Date.now();
   let usable = 0;
@@ -3566,8 +3573,7 @@ function describeAge(createdAt) {
 function printList(projects2) {
   const active = getActiveProject();
   const profiles = readConfig()?.profiles ?? {};
-  const spelling = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
-  const nameOf = (p2) => p2.name && spelling(p2.name) !== spelling(p2.slug) ? p2.name : "";
+  const nameOf = (p2) => projectDisplayName(p2) ?? "";
   const showNames = projects2.some((p2) => nameOf(p2) !== "");
   const slugWidth = Math.max(...projects2.map((p2) => p2.slug.length));
   const nameWidth = showNames ? Math.max(...projects2.map((p2) => nameOf(p2).length)) : 0;
@@ -3970,7 +3976,7 @@ var init_observeCliError = __esm({
     import_errorObservation = require("@abloatai/transaction/errorObservation");
     import_errors5 = require("@abloatai/transaction/errors");
     dsn = process.env.ABLO_CLI_SENTRY_DSN ?? "https://1ac154bff10b06836e1ea9de9e0d92f0@o4510928209772544.ingest.de.sentry.io/4511660691423312" ?? "";
-    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.56.0";
+    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.58.0";
     initialized = false;
     nativeProcessExit = process.exit.bind(process);
     exitBoundaryInstalled = false;
@@ -4297,7 +4303,7 @@ var init_src2 = __esm({
 
 // src/cliEnvironment.ts
 function cliVersion() {
-  return "0.56.0";
+  return "0.58.0";
 }
 function cliOs() {
   const value = (0, import_node_os.platform)();
@@ -4372,7 +4378,9 @@ function trackCliSchemaPushAttempted() {
 }
 function flushProductAnalytics(options = {}) {
   if (flushInFlight) return flushInFlight;
-  flushInFlight = flushOnce(options).catch(() => void 0).finally(() => {
+  flushInFlight = flushOnce(options).catch((error) => {
+    void error;
+  }).finally(() => {
     flushInFlight = null;
   });
   return flushInFlight;
@@ -4395,8 +4403,8 @@ function queueEvent(eventName, properties) {
     state.queue = [...state.queue, parsed].slice(-MAX_QUEUED_EVENTS);
     writeState(state);
     if (disclose) {
-      console.error(
-        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details."
+      process.stderr.write(
+        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details.\n"
       );
     }
   } catch {
@@ -4473,8 +4481,9 @@ function writeState(state) {
 function environmentBlocker() {
   if (process.env.ABLO_TELEMETRY_DISABLED === "1") return "ABLO_TELEMETRY_DISABLED";
   if (process.env.DO_NOT_TRACK === "1") return "DO_NOT_TRACK";
-  const ciVariables = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI", "TF_BUILD"];
-  return ciVariables.find((name) => truthyEnvironmentValue(process.env[name])) ?? null;
+  return TELEMETRY_BLOCKING_ENV.slice(2).find(
+    (name) => truthyEnvironmentValue(process.env[name])
+  ) ?? null;
 }
 function truthyEnvironmentValue(value) {
   return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
@@ -4502,7 +4511,7 @@ function runTelemetryCommand(argv) {
   if (status2.blockedBy) console.log(`Environment override: ${status2.blockedBy}`);
   console.log(`Queued events: ${status2.queuedEvents}`);
 }
-var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight;
+var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight, TELEMETRY_BLOCKING_ENV;
 var init_telemetry = __esm({
   "src/telemetry.ts"() {
     "use strict";
@@ -4519,6 +4528,16 @@ var init_telemetry = __esm({
     MAX_FLUSH_EVENTS = 20;
     DEFAULT_FLUSH_TIMEOUT_MS = 800;
     flushInFlight = null;
+    TELEMETRY_BLOCKING_ENV = [
+      "ABLO_TELEMETRY_DISABLED",
+      "DO_NOT_TRACK",
+      "CI",
+      "GITHUB_ACTIONS",
+      "GITLAB_CI",
+      "BUILDKITE",
+      "CIRCLECI",
+      "TF_BUILD"
+    ];
   }
 });
 
@@ -4716,16 +4735,9 @@ async function fetchActiveSchema(url, apiKey) {
     clearTimeout(t);
   }
 }
-function conflictStr(c) {
-  if (!c) return "";
-  const parts = import_schema2.participantKindSchema.options.flatMap((k3) => c[k3] ? [`${k3}:${c[k3]}`] : []);
-  return parts.length ? `{${parts.join(",")}}` : "";
-}
 function localModels(schema) {
   const json = JSON.parse((0, import_schema.serializeSchema)(schema));
-  const out = /* @__PURE__ */ new Map();
-  for (const [key, def] of Object.entries(json.models)) out.set(key, conflictStr(def.conflict));
-  return out;
+  return new Set(Object.keys(json.models));
 }
 function printPlan(local, remote) {
   if (!remote?.models) {
@@ -4733,21 +4745,17 @@ function printPlan(local, remote) {
 `);
     return;
   }
-  const remoteMap = /* @__PURE__ */ new Map();
-  for (const m2 of remote.models) remoteMap.set(m2.key, conflictStr(m2.conflict));
-  const added = [...local.keys()].filter((k3) => !remoteMap.has(k3));
-  const removed = [...remoteMap.keys()].filter((k3) => !local.has(k3));
-  const changed = [...local.keys()].filter((k3) => remoteMap.has(k3) && remoteMap.get(k3) !== local.get(k3));
+  const remoteKeys = new Set(remote.models.map((model) => model.key));
+  const added = [...local].filter((key) => !remoteKeys.has(key));
+  const removed = [...remoteKeys].filter((key) => !local.has(key));
   const verLabel = remote.version != null ? `v${remote.version}` : "active";
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+  if (added.length === 0 && removed.length === 0) {
     console.log(`  ${import_picocolors5.default.dim("plan")}     ${import_picocolors5.default.dim(`no model-level changes vs deployed ${verLabel} (any field changes apply on push)`)}
 `);
     return;
   }
   console.log(`  ${import_picocolors5.default.dim("plan")}     ${import_picocolors5.default.dim(`vs deployed ${verLabel}:`)}`);
   for (const k3 of added) console.log(`           ${import_picocolors5.default.green(`+ ${k3}`)} ${import_picocolors5.default.dim("(new model)")}`);
-  for (const k3 of changed)
-    console.log(`           ${import_picocolors5.default.yellow(`~ ${k3}`)} ${import_picocolors5.default.dim(`conflict ${remoteMap.get(k3) || "(default)"} \u2192 ${local.get(k3) || "(default)"}`)}`);
   for (const k3 of removed) console.log(`           ${import_picocolors5.default.red(`- ${k3}`)} ${import_picocolors5.default.dim("(removed \u2014 destructive, needs --force)")}`);
   console.log("");
 }
@@ -5038,7 +5046,7 @@ async function push(argv) {
   }
   process.exit(1);
 }
-var import_picocolors5, import_errors7, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, import_schema2, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT, PUSH_USAGE;
+var import_picocolors5, import_errors7, import_credentialPolicy, import_fs4, import_path3, import_child_process, import_schema, DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT, PUSH_USAGE;
 var init_push = __esm({
   "src/push.ts"() {
     "use strict";
@@ -5056,7 +5064,6 @@ var init_push = __esm({
     init_target();
     init_theme();
     init_renderError();
-    import_schema2 = require("@abloatai/transaction/coordination/schema");
     init_telemetry();
     DEFAULT_SCHEMA_PATH = "ablo/schema.ts";
     DEFAULT_EXPORT = "schema";
@@ -5083,6 +5090,84 @@ var init_push = __esm({
   }
 });
 
+// src/dbProvider.ts
+function hostAndPort(hostOrTarget) {
+  const withoutScheme = hostOrTarget.trim().replace(/^[a-z0-9+.-]+:\/\//i, "");
+  const at = withoutScheme.lastIndexOf("@");
+  const withoutUserinfo = at === -1 ? withoutScheme : withoutScheme.slice(at + 1);
+  const authority = withoutUserinfo.split("/")[0] ?? "";
+  const parts = /^(\[[^\]]*\]|[^:]*)(?::(\d+))?$/.exec(authority);
+  return { hostname: (parts?.[1] ?? authority).toLowerCase(), port: parts?.[2] ?? "" };
+}
+function inDomain(hostname, domain) {
+  return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+function detectProvider(hostOrTarget) {
+  const { hostname } = hostAndPort(hostOrTarget);
+  const spec = PROVIDERS.find((p2) => p2.domains.some((domain) => inDomain(hostname, domain)));
+  return spec?.id ?? "generic";
+}
+function detectPooler(hostOrTarget) {
+  const { hostname, port } = hostAndPort(hostOrTarget);
+  const provider = detectProvider(hostOrTarget);
+  const spec = PROVIDERS.find((p2) => p2.id === provider);
+  if (spec?.isPooledHost?.(hostname)) {
+    const direct = spec.directTarget?.(hostOrTarget);
+    return direct === void 0 ? { provider, confidence: "host" } : { provider, direct, confidence: "host" };
+  }
+  if (POOLER_PORTS.has(port)) return { provider, confidence: "port" };
+  return null;
+}
+function replicationGrantRole(provider) {
+  const specs = PROVIDERS;
+  const spec = specs.find((candidate) => candidate.id === provider);
+  return spec?.replicationGrantRole ?? null;
+}
+function logicalReplicationGuidance(provider) {
+  const spec = PROVIDERS.find((p2) => p2.id === provider);
+  if (spec) return spec.logicalReplication;
+  return `run the ALTER SYSTEM above, then restart Postgres (wal_level is not reloadable). On a managed host that refuses ALTER SYSTEM, set wal_level to logical in its dashboard instead`;
+}
+var PROVIDERS, POOLER_PORTS;
+var init_dbProvider = __esm({
+  "src/dbProvider.ts"() {
+    "use strict";
+    init_cjs_shims();
+    PROVIDERS = [
+      {
+        id: "neon",
+        domains: ["neon.tech"],
+        logicalReplication: `enable logical replication in your Neon project settings \u2014 it can't be set over SQL`,
+        // Neon encodes pooling in the endpoint id, so the direct host is the same
+        // name with the marker removed: a fix the reader applies without a lookup.
+        isPooledHost: (hostname) => hostname.includes("-pooler"),
+        directTarget: (hostOrTarget) => hostOrTarget.replace(/-pooler/i, "")
+      },
+      {
+        id: "supabase",
+        domains: ["supabase.co", "supabase.com"],
+        logicalReplication: `raise wal_level to logical in your Supabase project's database settings`,
+        // Supavisor is a separate host entirely (`aws-0-<region>.pooler.supabase.com`),
+        // so there is no direct host to derive from it.
+        isPooledHost: (hostname) => hostname.endsWith(".pooler.supabase.com")
+      },
+      {
+        id: "rds",
+        // Anchored to the real RDS domains, including the China partition, rather
+        // than a bare `.rds.` anywhere in the name.
+        domains: ["rds.amazonaws.com", "rds.amazonaws.com.cn"],
+        logicalReplication: `set rds.logical_replication = 1 in the instance's parameter group, then reboot`,
+        // RDS Proxy fronts the instance under a `.proxy-` subdomain.
+        isPooledHost: (hostname) => hostname.includes(".proxy-"),
+        // Neither the master user nor rds_superuser carries REPLICATION; AWS keeps
+        // it on rdsadmin and exposes it through this role.
+        replicationGrantRole: "rds_replication"
+      }
+    ];
+    POOLER_PORTS = /* @__PURE__ */ new Set(["6432", "6543"]);
+  }
+});
+
 // src/remoteValidation.ts
 function dialFailureReason(err) {
   if (err === null || typeof err !== "object") return null;
@@ -5179,76 +5264,6 @@ var init_remoteValidation = __esm({
   }
 });
 
-// src/dbProvider.ts
-function hostAndPort(hostOrTarget) {
-  const withoutScheme = hostOrTarget.trim().replace(/^[a-z0-9+.-]+:\/\//i, "");
-  const at = withoutScheme.lastIndexOf("@");
-  const withoutUserinfo = at === -1 ? withoutScheme : withoutScheme.slice(at + 1);
-  const authority = withoutUserinfo.split("/")[0] ?? "";
-  const parts = /^(\[[^\]]*\]|[^:]*)(?::(\d+))?$/.exec(authority);
-  return { hostname: (parts?.[1] ?? authority).toLowerCase(), port: parts?.[2] ?? "" };
-}
-function inDomain(hostname, domain) {
-  return hostname === domain || hostname.endsWith(`.${domain}`);
-}
-function detectProvider(hostOrTarget) {
-  const { hostname } = hostAndPort(hostOrTarget);
-  const spec = PROVIDERS.find((p2) => p2.domains.some((domain) => inDomain(hostname, domain)));
-  return spec?.id ?? "generic";
-}
-function detectPooler(hostOrTarget) {
-  const { hostname, port } = hostAndPort(hostOrTarget);
-  const provider = detectProvider(hostOrTarget);
-  const spec = PROVIDERS.find((p2) => p2.id === provider);
-  if (spec?.isPooledHost?.(hostname)) {
-    const direct = spec.directTarget?.(hostOrTarget);
-    return direct === void 0 ? { provider, confidence: "host" } : { provider, direct, confidence: "host" };
-  }
-  if (POOLER_PORTS.has(port)) return { provider, confidence: "port" };
-  return null;
-}
-function logicalReplicationGuidance(provider) {
-  const spec = PROVIDERS.find((p2) => p2.id === provider);
-  if (spec) return spec.logicalReplication;
-  return `run the ALTER SYSTEM above, then restart Postgres (wal_level is not reloadable). On a managed host that refuses ALTER SYSTEM, set wal_level to logical in its dashboard instead`;
-}
-var PROVIDERS, POOLER_PORTS;
-var init_dbProvider = __esm({
-  "src/dbProvider.ts"() {
-    "use strict";
-    init_cjs_shims();
-    PROVIDERS = [
-      {
-        id: "neon",
-        domains: ["neon.tech"],
-        logicalReplication: `enable logical replication in your Neon project settings \u2014 it can't be set over SQL`,
-        // Neon encodes pooling in the endpoint id, so the direct host is the same
-        // name with the marker removed: a fix the reader applies without a lookup.
-        isPooledHost: (hostname) => hostname.includes("-pooler"),
-        directTarget: (hostOrTarget) => hostOrTarget.replace(/-pooler/i, "")
-      },
-      {
-        id: "supabase",
-        domains: ["supabase.co", "supabase.com"],
-        logicalReplication: `raise wal_level to logical in your Supabase project's database settings`,
-        // Supavisor is a separate host entirely (`aws-0-<region>.pooler.supabase.com`),
-        // so there is no direct host to derive from it.
-        isPooledHost: (hostname) => hostname.endsWith(".pooler.supabase.com")
-      },
-      {
-        id: "rds",
-        // Anchored to the real RDS domains, including the China partition, rather
-        // than a bare `.rds.` anywhere in the name.
-        domains: ["rds.amazonaws.com", "rds.amazonaws.com.cn"],
-        logicalReplication: `set rds.logical_replication = 1 in the instance's parameter group, then reboot`,
-        // RDS Proxy fronts the instance under a `.proxy-` subdomain.
-        isPooledHost: (hostname) => hostname.includes(".proxy-")
-      }
-    ];
-    POOLER_PORTS = /* @__PURE__ */ new Set(["6432", "6543"]);
-  }
-});
-
 // src/connectSetup.ts
 function hostLabel(connectionString) {
   try {
@@ -5280,12 +5295,26 @@ BEGIN
   END LOOP;
 END $$;`;
 }
+function replicationBypassSql(input) {
+  if (input.canGrantBypassRls) return [];
+  return input.tables.flatMap((table) => {
+    const qualified = `${quoteIdent(input.schema)}.${quoteIdent(table)}`;
+    const policy = quoteIdent(`${input.role}_snapshot`);
+    return [
+      // CREATE POLICY has no IF NOT EXISTS, and every step here is safe to
+      // re-run, so the drop carries the idempotency.
+      `DROP POLICY IF EXISTS ${policy} ON ${qualified};`,
+      `CREATE POLICY ${policy} ON ${qualified} FOR SELECT TO ${quoteIdent(input.role)} USING (true);`
+    ];
+  });
+}
 function connectSetupSql(input) {
   const role = input.role && input.role.length > 0 ? input.role : import_footprint.ABLO_REPLICATION_ROLE;
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : import_footprint.ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
   const schema = input.schema ?? "public";
   const publication = input.publication;
+  const canGrantBypassRls = input.canGrantBypassRls !== false;
   const qualifiedTables = tables.map((table) => `${quoteIdent(schema)}.${quoteIdent(table)}`);
   const publicationTarget = tables.length > 0 ? `FOR TABLE ${qualifiedTables.join(", ")}` : "FOR ALL TABLES";
   const tableList = qualifiedTables.join(", ");
@@ -5305,9 +5334,11 @@ function connectSetupSql(input) {
     // 3. A least-privilege role: it can stream replication and SELECT the
     // published tables, including the initial snapshot of RLS-protected tables.
     // Logical decoding already exposes every published row independently of
-    // RLS; BYPASSRLS makes the ordinary SELECT snapshot match that same scope.
-    `CREATE ROLE ${quoteIdent(role)} WITH NOSUPERUSER BYPASSRLS NOCREATEDB NOCREATEROLE REPLICATION NOINHERIT LOGIN PASSWORD '<password>';`,
+    // RLS, so the reader needs the ordinary SELECT snapshot to match that same
+    // scope. How it gets there depends on what this admin may grant.
+    `CREATE ROLE ${quoteIdent(role)} WITH NOSUPERUSER ${canGrantBypassRls ? "BYPASSRLS " : ""}NOCREATEDB NOCREATEROLE ${canGrantBypassRls ? "REPLICATION NOINHERIT" : "NOREPLICATION INHERIT"} LOGIN PASSWORD '<password>';`,
     ...replicationReadGrants,
+    ...replicationBypassSql({ role, tables, schema, canGrantBypassRls }),
     // 4. A distinct DML role: no replication, role administration, ownership,
     // schema creation, or DDL. It runs NOBYPASSRLS with row_security on, so on a
     // table that HAS row-level-security policies they govern its writes and it
@@ -5453,7 +5484,15 @@ On Neon enable Logical Replication in the project (Console \u2192 Settings \u219
     `SELECT rolreplication, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user`
   );
   const role = roleRows[0];
-  const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper));
+  const grantRole = opts.replicationGrantRole ?? null;
+  const viaGrant = grantRole ? (await sql.unsafe(
+    `SELECT EXISTS (
+             SELECT 1 FROM pg_roles r
+             WHERE r.rolname = $1 AND pg_has_role(current_user, r.oid, 'MEMBER')
+           ) AS member`,
+    [grantRole]
+  ))[0]?.member === true : false;
+  const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper)) || viaGrant;
   items.push(
     hasReplication ? {
       ok: true,
@@ -5473,6 +5512,20 @@ On RDS: GRANT rds_replication TO <your_role>;`
          JOIN pg_class c ON c.relnamespace = n.oid AND c.relname = pt.tablename
         WHERE pt.pubname = $1 AND pt.schemaname = $2
           AND row_security_active(c.oid)
+          AND NOT EXISTS (
+            SELECT 1 FROM pg_policies p
+             WHERE p.schemaname = pt.schemaname
+               AND p.tablename = pt.tablename
+               AND p.permissive = 'PERMISSIVE'
+               AND p.cmd IN ('ALL', 'SELECT')
+               AND p.qual = 'true'
+               -- Membership, not containment: pg_policies.roles is name[], while
+               -- ARRAY['public'] is text[]. Postgres has no name[] @> text[] operator, so
+               -- the containment spelling fails at execution rather than at parse time:
+               -- the probe threw instead of reporting, which reads as an unreachable
+               -- database rather than a readable one.
+               AND ('public' = ANY(p.roles) OR current_user = ANY(p.roles))
+          )
         ORDER BY table_name`,
       [publication, schema]
     );
@@ -5482,7 +5535,9 @@ On RDS: GRANT rds_replication TO <your_role>;`
         ok: false,
         label: `${rlsRelevant.length} published table${rlsRelevant.length === 1 ? "" : "s"} hide historical rows behind RLS`,
         fix: `ALTER ROLE current_user WITH BYPASSRLS;
-Logical replication already exposes every published row; this lets the ordinary initial SELECT read that same scope.`
+Where the provider reserves that attribute (Amazon RDS, Aurora), give the reader a policy instead:
+CREATE POLICY <reader>_snapshot ON <table> FOR SELECT TO <reader> USING (true);
+Logical replication already exposes every published row; either lets the ordinary initial SELECT read that same scope.`
       }
     );
     const badRows = await sql.unsafe(
@@ -6020,7 +6075,7 @@ async function fetchDataSourceState(apiUrl3, apiKey, timeoutMs = 4e3) {
 async function readLocalSchemaHash(schemaPath = DEFAULT_SCHEMA_PATH) {
   try {
     const schema = await loadSchema(schemaPath, DEFAULT_EXPORT);
-    return (0, import_schema4.schemaHash)(schema);
+    return (0, import_schema3.schemaHash)(schema);
   } catch {
     return null;
   }
@@ -6091,7 +6146,7 @@ function blockers(input) {
   }
   return found;
 }
-var import_wire5, import_schema4, WRITE_READY_VERDICT;
+var import_wire5, import_schema3, WRITE_READY_VERDICT;
 var init_readiness = __esm({
   "src/readiness.ts"() {
     "use strict";
@@ -6100,7 +6155,7 @@ var init_readiness = __esm({
     init_push();
     init_dbProvider();
     init_remoteValidation();
-    import_schema4 = require("@abloatai/transaction/schema");
+    import_schema3 = require("@abloatai/transaction/schema");
     WRITE_READY_VERDICT = "write infrastructure is ready. Your database constraints and row-level policies still apply.";
   }
 });
@@ -6128,7 +6183,17 @@ function connectApplyPlan(input) {
   const schema = input.schema ?? "public";
   const publication = input.publication;
   const provider = input.provider ?? "generic";
-  const recipe = connectSetupSql({ tables, role, writeRole, schema, publication });
+  const canGrantBypassRls = input.canGrantBypassRls !== false;
+  const canGrantReplication = input.canGrantReplication !== false;
+  const grantedReplicationRole = canGrantReplication ? null : replicationGrantRole(provider);
+  const recipe = connectSetupSql({
+    tables,
+    role,
+    writeRole,
+    schema,
+    publication,
+    canGrantBypassRls
+  });
   const isWal = (s) => s.startsWith("ALTER SYSTEM SET wal_level");
   const isPublication = (s) => s.startsWith("CREATE PUBLICATION");
   const isRoleCreate = (s) => s.startsWith("CREATE ROLE ");
@@ -6176,19 +6241,46 @@ END $$;`
     {
       key: "replication-role",
       title: "Create the read-only login Ablo reads with",
-      detail: `${role} \u2014 it can follow your changes and snapshot the same published rows, including through RLS`,
+      detail: canGrantBypassRls ? `${role} \u2014 it can follow your changes and snapshot the same published rows, including through RLS` : `${role} \u2014 it can follow your changes, and reads the published rows through a SELECT policy of its own, because this provider reserves BYPASSRLS`,
       sql: [
         idempotentRole(
           role,
-          "NOSUPERUSER BYPASSRLS NOCREATEDB NOCREATEROLE REPLICATION NOINHERIT",
+          // NOINHERIT everywhere the capability is an attribute: the reader
+          // should hold what it was given and nothing that arrives later.
+          // Where the provider lends REPLICATION as a role instead, the
+          // membership only confers it by inheriting — a NOINHERIT member holds
+          // it in name, `pg_has_role(..., 'USAGE')` is false, and replication
+          // fails while every "was it granted" check says yes. So the grant
+          // path inherits, and its only membership is the one granted below.
+          `NOSUPERUSER ${canGrantBypassRls ? "BYPASSRLS " : ""}NOCREATEDB NOCREATEROLE ${canGrantReplication ? "REPLICATION" : "NOREPLICATION"} ${grantedReplicationRole ? "INHERIT" : "NOINHERIT"}`,
           input.credentials.replicationClause,
           input.rotate === true
         ),
         // Unlike a password, this is a required invariant rather than secret
         // material owned by one plane. Re-assert it for an existing pre-snapshot
         // role so `connect apply` repairs the exact upgrade gap that otherwise
-        // certifies an RLS-filtered empty snapshot as complete.
-        `ALTER ROLE ${quoteIdent(role)} WITH BYPASSRLS;`
+        // certifies an RLS-filtered empty snapshot as complete. Where the
+        // attribute cannot be granted at all, the policies in the grants step
+        // carry the same invariant.
+        ...canGrantBypassRls ? [`ALTER ROLE ${quoteIdent(role)} WITH BYPASSRLS;`] : [],
+        // The provider keeps REPLICATION on an internal superuser and lends it
+        // through a role. Without this the reader authenticates and then cannot
+        // open a replication slot, which surfaces far from its cause.
+        ...grantedReplicationRole ? [
+          // WITH INHERIT TRUE, because Postgres 16 records inheritance on
+          // the MEMBERSHIP rather than only on the role. A member that does
+          // not inherit holds the grant without holding what it carries:
+          // `pg_has_role(..., 'MEMBER')` is true, `USAGE` is false, and
+          // replication does not work while every "was it granted" check
+          // says yes.
+          //
+          // Stated on the grant rather than left to the role's default so
+          // it also repairs a reader created before this path existed.
+          // `ALTER ROLE ... INHERIT` does not: it changes the default for
+          // FUTURE memberships and leaves the recorded one untouched, which
+          // is a fix that reports success and changes nothing.
+          `GRANT ${quoteIdent(grantedReplicationRole)} TO ${quoteIdent(role)} WITH INHERIT TRUE;`
+        ] : []
       ]
     },
     {
@@ -6288,14 +6380,14 @@ function reapplyBlocker(input) {
 }
 async function adminCanCreateRoles(sql) {
   const rows = await sql.unsafe(
-    `SELECT rolname, rolsuper, rolcreaterole FROM pg_roles WHERE rolname = current_user`
+    `SELECT rolname, rolsuper, rolcreaterole, rolbypassrls, rolreplication FROM pg_roles WHERE rolname = current_user`
   );
   return rows[0] ?? null;
 }
 async function schemaDeclaredTables() {
   try {
     const schema = await loadSchema(DEFAULT_SCHEMA_PATH, DEFAULT_EXPORT);
-    const json = JSON.parse((0, import_schema5.serializeSchema)(schema));
+    const json = JSON.parse((0, import_schema4.serializeSchema)(schema));
     const tables = Object.entries(json.models).map(([key, model]) => model.tableName ?? key);
     return tables.length > 0 ? tables : null;
   } catch {
@@ -6368,7 +6460,7 @@ function alreadyConnectedElsewhere(held) {
   const where = held.project ? `project ${held.project}, branch ${held.branch}` : `branch ${held.branch}`;
   return `This database schema is already connected to ${where}. A (database, schema) binding belongs to one plane at a time.`;
 }
-var import_wire6, import_schema5;
+var import_wire6, import_schema4;
 var init_connectPreflight = __esm({
   "src/connectPreflight.ts"() {
     "use strict";
@@ -6377,7 +6469,7 @@ var init_connectPreflight = __esm({
     import_wire6 = require("@abloatai/transaction/wire");
     init_controlPlane();
     init_push();
-    import_schema5 = require("@abloatai/transaction/schema");
+    import_schema4 = require("@abloatai/transaction/schema");
     init_readiness();
   }
 });
@@ -6709,7 +6801,16 @@ ${ambient}` : ""}`,
     walAlreadyLogical: walReady,
     provider,
     existingPublication,
-    inheritGrants
+    inheritGrants,
+    // Read off the connected admin rather than guessed from the hostname. A
+    // role can only hand out an attribute it holds, and on RDS and Aurora
+    // BYPASSRLS is reserved to `rdsadmin`, so the recipe substitutes explicit
+    // SELECT policies for the reader.
+    canGrantBypassRls: capability?.rolbypassrls === true,
+    // Same rule, second attribute: RDS and Aurora keep REPLICATION on
+    // rdsadmin and lend it as `rds_replication`, so the recipe grants that
+    // role rather than setting an attribute this admin cannot pass on.
+    canGrantReplication: capability?.rolreplication === true
   });
   const steps = buildPlan("scram-verifier");
   if (pubReconcile.removed.length > 0 || pubReconcile.recreated) {
@@ -6791,7 +6892,14 @@ ${ambient}` : ""}`,
   }
   const replicationProbe = await probeAsRole(
     replicationUrl,
-    (sql) => probeReadiness(sql, { coordinatedTables, schema: args.schema, publication })
+    (sql) => probeReadiness(sql, {
+      coordinatedTables,
+      schema: args.schema,
+      publication,
+      // The reader may hold REPLICATION through the provider's role rather than
+      // the attribute, which is the only shape available on RDS and Aurora.
+      replicationGrantRole: replicationGrantRole(provider)
+    })
   );
   const writeProbe = await probeAsRole(
     writeUrl,
@@ -7441,7 +7549,11 @@ ${ambient}` : ""}`,
 `);
   const replication = await probeAndReport(dbUrl, "replication", {
     schema: args.schema,
-    publication
+    publication,
+    // Derived from the host being dialled: where the provider lends REPLICATION
+    // as a role rather than granting the attribute, membership is what the
+    // reader actually holds.
+    replicationGrantRole: replicationGrantRole(detectProvider(dbUrl))
   });
   console.log(`
   ${import_picocolors12.default.bold("Direct-write role")}
@@ -7734,6 +7846,7 @@ var init_connect = __esm({
     init_cjs_shims();
     import_errors11 = require("@abloatai/transaction/errors");
     import_picocolors12 = __toESM(require_picocolors(), 1);
+    init_dbProvider();
     init_src();
     import_footprint3 = require("@abloatai/transaction/footprint");
     init_dbRole();
@@ -7980,7 +8093,7 @@ var require_util = __commonJS({
       return path;
     }
     exports2.normalize = normalize;
-    function join8(aRoot, aPath) {
+    function join9(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -8012,7 +8125,7 @@ var require_util = __commonJS({
       }
       return joined;
     }
-    exports2.join = join8;
+    exports2.join = join9;
     exports2.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -8185,7 +8298,7 @@ var require_util = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join8(urlGenerate(parsed), sourceURL);
+        sourceURL = join9(urlGenerate(parsed), sourceURL);
       }
       return normalize(sourceURL);
     }
@@ -28205,9 +28318,9 @@ ${lanes.join("\n")}
           return getSpanOfTokenAtPosition(sourceFile, node.pos);
         }
         Debug.assert(!isJSDoc(errorNode));
-        const isMissing = nodeIsMissing(errorNode);
-        const pos = isMissing || isJsxText(node) ? errorNode.pos : skipTrivia(sourceFile.text, errorNode.pos);
-        if (isMissing) {
+        const isMissing2 = nodeIsMissing(errorNode);
+        const pos = isMissing2 || isJsxText(node) ? errorNode.pos : skipTrivia(sourceFile.text, errorNode.pos);
+        if (isMissing2) {
           Debug.assert(pos === errorNode.pos, "This failure could trigger https://github.com/Microsoft/TypeScript/issues/20809");
           Debug.assert(pos === errorNode.end, "This failure could trigger https://github.com/Microsoft/TypeScript/issues/20809");
         } else {
@@ -132684,7 +132797,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve10 = factory2.createUniqueName("resolve");
+          const resolve11 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -132693,7 +132806,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve10
+              resolve11
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -132710,7 +132823,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve10, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve11, reject]
               )
             )
           ]);
@@ -172633,9 +172746,9 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           const sourceFile = getValidSourceFile(fileName);
           const span = createTextSpanFromBounds(start, end);
           const formatContext = ts_formatting_exports.getFormatContext(formatOptions, host);
-          return flatMap(deduplicate(errorCodes68, equateValues, compareValues), (errorCode) => {
+          return flatMap(deduplicate(errorCodes68, equateValues, compareValues), (errorCode2) => {
             cancellationToken.throwIfCancellationRequested();
-            return ts_codefix_exports.getFixes({ errorCode, sourceFile, span, program, host, cancellationToken, formatContext, preferences });
+            return ts_codefix_exports.getFixes({ errorCode: errorCode2, sourceFile, span, program, host, cancellationToken, formatContext, preferences });
           });
         }
         function getCombinedCodeFix(scope, fixId56, formatOptions, preferences = emptyOptions) {
@@ -174473,8 +174586,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         fixIds: [fixId2],
         errorCodes: errorCodes2,
         getCodeActions: function getCodeActionsToAddMissingAsync(context) {
-          const { sourceFile, errorCode, cancellationToken, program, span } = context;
-          const diagnostic = find(program.getTypeChecker().getDiagnostics(sourceFile, cancellationToken), getIsMatchingAsyncError(span, errorCode));
+          const { sourceFile, errorCode: errorCode2, cancellationToken, program, span } = context;
+          const diagnostic = find(program.getTypeChecker().getDiagnostics(sourceFile, cancellationToken), getIsMatchingAsyncError(span, errorCode2));
           const directSpan = diagnostic && diagnostic.relatedInformation && find(diagnostic.relatedInformation, (r2) => r2.code === Diagnostics.Did_you_mean_to_mark_this_function_as_async.code);
           const decl = getFixableErrorSpanDeclaration(sourceFile, directSpan);
           if (!decl) {
@@ -174536,8 +174649,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         });
         return decl;
       }
-      function getIsMatchingAsyncError(span, errorCode) {
-        return ({ start, length: length2, relatedInformation, code }) => isNumber(start) && isNumber(length2) && textSpansEqual({ start, length: length2 }, span) && code === errorCode && !!relatedInformation && some(relatedInformation, (related) => related.code === Diagnostics.Did_you_mean_to_mark_this_function_as_async.code);
+      function getIsMatchingAsyncError(span, errorCode2) {
+        return ({ start, length: length2, relatedInformation, code }) => isNumber(start) && isNumber(length2) && textSpansEqual({ start, length: length2 }, span) && code === errorCode2 && !!relatedInformation && some(relatedInformation, (related) => related.code === Diagnostics.Did_you_mean_to_mark_this_function_as_async.code);
       }
       var fixId3 = "addMissingAwait";
       var propertyAccessCode = Diagnostics.Property_0_does_not_exist_on_type_1.code;
@@ -174568,16 +174681,16 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         fixIds: [fixId3],
         errorCodes: errorCodes3,
         getCodeActions: function getCodeActionsToAddMissingAwait(context) {
-          const { sourceFile, errorCode, span, cancellationToken, program } = context;
-          const expression = getAwaitErrorSpanExpression(sourceFile, errorCode, span, cancellationToken, program);
+          const { sourceFile, errorCode: errorCode2, span, cancellationToken, program } = context;
+          const expression = getAwaitErrorSpanExpression(sourceFile, errorCode2, span, cancellationToken, program);
           if (!expression) {
             return;
           }
           const checker = context.program.getTypeChecker();
           const trackChanges = (cb) => ts_textChanges_exports.ChangeTracker.with(context, cb);
           return compact([
-            getDeclarationSiteFix(context, expression, errorCode, checker, trackChanges),
-            getUseSiteFix(context, expression, errorCode, checker, trackChanges)
+            getDeclarationSiteFix(context, expression, errorCode2, checker, trackChanges),
+            getUseSiteFix(context, expression, errorCode2, checker, trackChanges)
           ]);
         },
         getAllCodeActions: (context) => {
@@ -174594,18 +174707,18 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           });
         }
       });
-      function getAwaitErrorSpanExpression(sourceFile, errorCode, span, cancellationToken, program) {
+      function getAwaitErrorSpanExpression(sourceFile, errorCode2, span, cancellationToken, program) {
         const expression = getFixableErrorSpanExpression(sourceFile, span);
-        return expression && isMissingAwaitError(sourceFile, errorCode, span, cancellationToken, program) && isInsideAwaitableBody(expression) ? expression : void 0;
+        return expression && isMissingAwaitError(sourceFile, errorCode2, span, cancellationToken, program) && isInsideAwaitableBody(expression) ? expression : void 0;
       }
-      function getDeclarationSiteFix(context, expression, errorCode, checker, trackChanges, fixedDeclarations) {
+      function getDeclarationSiteFix(context, expression, errorCode2, checker, trackChanges, fixedDeclarations) {
         const { sourceFile, program, cancellationToken } = context;
         const awaitableInitializers = findAwaitableInitializers(expression, sourceFile, cancellationToken, program, checker);
         if (awaitableInitializers) {
           const initializerChanges = trackChanges((t) => {
-            forEach(awaitableInitializers.initializers, ({ expression: expression2 }) => makeChange3(t, errorCode, sourceFile, checker, expression2, fixedDeclarations));
+            forEach(awaitableInitializers.initializers, ({ expression: expression2 }) => makeChange3(t, errorCode2, sourceFile, checker, expression2, fixedDeclarations));
             if (fixedDeclarations && awaitableInitializers.needsSecondPassForFixAll) {
-              makeChange3(t, errorCode, sourceFile, checker, expression, fixedDeclarations);
+              makeChange3(t, errorCode2, sourceFile, checker, expression, fixedDeclarations);
             }
           });
           return createCodeFixActionWithoutFixAll(
@@ -174615,14 +174728,14 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           );
         }
       }
-      function getUseSiteFix(context, expression, errorCode, checker, trackChanges, fixedDeclarations) {
-        const changes = trackChanges((t) => makeChange3(t, errorCode, context.sourceFile, checker, expression, fixedDeclarations));
+      function getUseSiteFix(context, expression, errorCode2, checker, trackChanges, fixedDeclarations) {
+        const changes = trackChanges((t) => makeChange3(t, errorCode2, context.sourceFile, checker, expression, fixedDeclarations));
         return createCodeFixAction(fixId3, changes, Diagnostics.Add_await, fixId3, Diagnostics.Fix_all_expressions_possibly_missing_await);
       }
-      function isMissingAwaitError(sourceFile, errorCode, span, cancellationToken, program) {
+      function isMissingAwaitError(sourceFile, errorCode2, span, cancellationToken, program) {
         const checker = program.getTypeChecker();
         const diagnostics = checker.getDiagnostics(sourceFile, cancellationToken);
-        return some(diagnostics, ({ start, length: length2, relatedInformation, code }) => isNumber(start) && isNumber(length2) && textSpansEqual({ start, length: length2 }, span) && code === errorCode && !!relatedInformation && some(relatedInformation, (related) => related.code === Diagnostics.Did_you_forget_to_use_await.code));
+        return some(diagnostics, ({ start, length: length2, relatedInformation, code }) => isNumber(start) && isNumber(length2) && textSpansEqual({ start, length: length2 }, span) && code === errorCode2 && !!relatedInformation && some(relatedInformation, (related) => related.code === Diagnostics.Did_you_forget_to_use_await.code));
       }
       function findAwaitableInitializers(expression, sourceFile, cancellationToken, program, checker) {
         const identifiers = getIdentifiersFromErrorSpanExpression(expression, checker);
@@ -174707,7 +174820,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       function isInsideAwaitableBody(node) {
         return node.flags & 65536 || !!findAncestor(node, (ancestor) => ancestor.parent && isArrowFunction(ancestor.parent) && ancestor.parent.body === ancestor || isBlock(ancestor) && (ancestor.parent.kind === 262 || ancestor.parent.kind === 218 || ancestor.parent.kind === 219 || ancestor.parent.kind === 174));
       }
-      function makeChange3(changeTracker, errorCode, sourceFile, checker, insertionSite, fixedDeclarations) {
+      function makeChange3(changeTracker, errorCode2, sourceFile, checker, insertionSite, fixedDeclarations) {
         if (isForOfStatement(insertionSite.parent) && !insertionSite.parent.awaitModifier) {
           const exprType = checker.getTypeAtLocation(insertionSite);
           const asyncIter = checker.getAnyAsyncIterableType();
@@ -174732,7 +174845,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             const newNode = checker.getPromisedTypeOfPromise(type) ? factory.createAwaitExpression(side) : side;
             changeTracker.replaceNode(sourceFile, side, newNode);
           }
-        } else if (errorCode === propertyAccessCode && isPropertyAccessExpression(insertionSite.parent)) {
+        } else if (errorCode2 === propertyAccessCode && isPropertyAccessExpression(insertionSite.parent)) {
           if (fixedDeclarations && isIdentifier2(insertionSite.parent.expression)) {
             const symbol = checker.getSymbolAtLocation(insertionSite.parent.expression);
             if (symbol && fixedDeclarations.has(getSymbolId(symbol))) {
@@ -174745,7 +174858,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             factory.createParenthesizedExpression(factory.createAwaitExpression(insertionSite.parent.expression))
           );
           insertLeadingSemicolonIfNeeded(changeTracker, insertionSite.parent.expression, sourceFile);
-        } else if (contains(callableConstructableErrorCodes, errorCode) && isCallOrNewExpression(insertionSite.parent)) {
+        } else if (contains(callableConstructableErrorCodes, errorCode2) && isCallOrNewExpression(insertionSite.parent)) {
           if (fixedDeclarations && isIdentifier2(insertionSite)) {
             const symbol = checker.getSymbolAtLocation(insertionSite);
             if (symbol && fixedDeclarations.has(getSymbolId(symbol))) {
@@ -177518,10 +177631,10 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes19,
         getCodeActions(context) {
-          const { errorCode, preferences, sourceFile, span, program } = context;
+          const { errorCode: errorCode2, preferences, sourceFile, span, program } = context;
           const info = getFixInfos(
             context,
-            errorCode,
+            errorCode2,
             span.start,
             /*useAutoImportProvider*/
             true
@@ -178459,14 +178572,14 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           return { kind: 3, moduleSpecifierKind: void 0, moduleSpecifier, importKind, addAsTypeOnly, useRequire };
         }
       }
-      function getFixInfos(context, errorCode, pos, useAutoImportProvider) {
+      function getFixInfos(context, errorCode2, pos, useAutoImportProvider) {
         const symbolToken = getTokenAtPosition(context.sourceFile, pos);
         let info;
-        if (errorCode === Diagnostics._0_refers_to_a_UMD_global_but_the_current_file_is_a_module_Consider_adding_an_import_instead.code) {
+        if (errorCode2 === Diagnostics._0_refers_to_a_UMD_global_but_the_current_file_is_a_module_Consider_adding_an_import_instead.code) {
           info = getFixesInfoForUMDImport(context, symbolToken);
         } else if (!isIdentifier2(symbolToken)) {
           return void 0;
-        } else if (errorCode === Diagnostics._0_cannot_be_used_as_a_value_because_it_was_imported_using_import_type.code) {
+        } else if (errorCode2 === Diagnostics._0_cannot_be_used_as_a_value_because_it_was_imported_using_import_type.code) {
           const symbolName2 = single(getSymbolNamesToImport(context.sourceFile, context.program.getTypeChecker(), symbolToken, context.program.getCompilerOptions()));
           const fix = getTypeOnlyPromotionFix(context.sourceFile, symbolToken, symbolName2, context.program);
           return fix && [{ fix, symbolName: symbolName2, errorIdentifierText: symbolToken.text }];
@@ -179296,11 +179409,11 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes21,
         getCodeActions: function getCodeActionsToFixOverrideModifierIssues(context) {
-          const { errorCode, span } = context;
-          const info = errorCodeFixIdMap[errorCode];
+          const { errorCode: errorCode2, span } = context;
+          const info = errorCodeFixIdMap[errorCode2];
           if (!info) return emptyArray;
           const { descriptions, fixId: fixId56, fixAllDescriptions } = info;
-          const changes = ts_textChanges_exports.ChangeTracker.with(context, (changes2) => dispatchChanges(changes2, context, errorCode, span.start));
+          const changes = ts_textChanges_exports.ChangeTracker.with(context, (changes2) => dispatchChanges(changes2, context, errorCode2, span.start));
           return [
             createCodeFixActionMaybeFixAll(fixName, changes, descriptions, fixId56, fixAllDescriptions)
           ];
@@ -179315,8 +179428,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           dispatchChanges(changes, context, code, start);
         })
       });
-      function dispatchChanges(changeTracker, context, errorCode, pos) {
-        switch (errorCode) {
+      function dispatchChanges(changeTracker, context, errorCode2, pos) {
+        switch (errorCode2) {
           case Diagnostics.This_member_must_have_an_override_modifier_because_it_overrides_a_member_in_the_base_class_0.code:
           case Diagnostics.This_member_must_have_a_JSDoc_comment_with_an_override_tag_because_it_overrides_a_member_in_the_base_class_0.code:
           case Diagnostics.This_member_must_have_an_override_modifier_because_it_overrides_an_abstract_method_that_is_declared_in_the_base_class_0.code:
@@ -179329,7 +179442,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           case Diagnostics.This_member_cannot_have_a_JSDoc_comment_with_an_override_tag_because_its_containing_class_0_does_not_extend_another_class.code:
             return doRemoveOverrideModifierChange(changeTracker, context.sourceFile, pos);
           default:
-            Debug.fail("Unexpected error code: " + errorCode);
+            Debug.fail("Unexpected error code: " + errorCode2);
         }
       }
       function doAddOverrideModifierChange(changeTracker, sourceFile, pos) {
@@ -179702,8 +179815,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes26,
         getCodeActions(context) {
-          const { sourceFile, errorCode } = context;
-          const info = getInfo8(sourceFile, context.span.start, context, errorCode);
+          const { sourceFile, errorCode: errorCode2 } = context;
+          const info = getInfo8(sourceFile, context.span.start, context, errorCode2);
           if (!info) return void 0;
           const { node, suggestedSymbol } = info;
           const target = getEmitScriptTarget(context.host.getCompilationSettings());
@@ -179717,10 +179830,10 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           if (info) doChange18(changes, context.sourceFile, info.node, info.suggestedSymbol, target);
         })
       });
-      function getInfo8(sourceFile, pos, context, errorCode) {
+      function getInfo8(sourceFile, pos, context, errorCode2) {
         const node = getTokenAtPosition(sourceFile, pos);
         const parent2 = node.parent;
-        if ((errorCode === Diagnostics.No_overload_matches_this_call.code || errorCode === Diagnostics.Type_0_is_not_assignable_to_type_1.code) && !isJsxAttribute(parent2)) return void 0;
+        if ((errorCode2 === Diagnostics.No_overload_matches_this_call.code || errorCode2 === Diagnostics.Type_0_is_not_assignable_to_type_1.code) && !isJsxAttribute(parent2)) return void 0;
         const checker = context.program.getTypeChecker();
         let suggestedSymbol;
         if (isPropertyAccessExpression(parent2) && parent2.name === node) {
@@ -179811,8 +179924,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         errorCodes: errorCodes27,
         fixIds: [fixIdAddReturnStatement, fixRemoveBracesFromArrowFunctionBody, fixIdWrapTheBlockWithParen],
         getCodeActions: function getCodeActionsToCorrectReturnValue(context) {
-          const { program, sourceFile, span: { start }, errorCode } = context;
-          const info = getInfo9(program.getTypeChecker(), sourceFile, start, errorCode);
+          const { program, sourceFile, span: { start }, errorCode: errorCode2 } = context;
+          const info = getInfo9(program.getTypeChecker(), sourceFile, start, errorCode2);
           if (!info) return void 0;
           if (info.kind === 0) {
             return append(
@@ -179947,11 +180060,11 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         }
         return checker.isTypeAssignableTo(exprType, type);
       }
-      function getInfo9(checker, sourceFile, position, errorCode) {
+      function getInfo9(checker, sourceFile, position, errorCode2) {
         const node = getTokenAtPosition(sourceFile, position);
         if (!node.parent) return void 0;
         const declaration = findAncestor(node.parent, isFunctionLikeDeclaration);
-        switch (errorCode) {
+        switch (errorCode2) {
           case Diagnostics.A_function_whose_declared_type_is_neither_undefined_void_nor_any_must_return_a_value.code:
             if (!declaration || !declaration.body || !declaration.type || !rangeContainsRange(declaration.type, node)) return void 0;
             return getFixInfo(
@@ -180146,11 +180259,11 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           }));
         }
       });
-      function getInfo10(sourceFile, tokenPos, errorCode, checker, program) {
+      function getInfo10(sourceFile, tokenPos, errorCode2, checker, program) {
         var _a, _b;
         const token = getTokenAtPosition(sourceFile, tokenPos);
         const parent2 = token.parent;
-        if (errorCode === Diagnostics.Argument_of_type_0_is_not_assignable_to_parameter_of_type_1.code) {
+        if (errorCode2 === Diagnostics.Argument_of_type_0_is_not_assignable_to_parameter_of_type_1.code) {
           if (!(token.kind === 19 && isObjectLiteralExpression(parent2) && isCallExpression(parent2.parent))) return void 0;
           const argIndex = findIndex(parent2.parent.arguments, (arg) => arg === parent2);
           if (argIndex < 0) return void 0;
@@ -181007,10 +181120,10 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes31,
         getCodeActions: function getCodeActionsToFixNotFoundModule(context) {
-          const { host, sourceFile, span: { start }, errorCode } = context;
-          const packageName = errorCode === errorCannotFindImplicitJsxImport ? getJSXImplicitImportBase(context.program.getCompilerOptions(), sourceFile) : tryGetImportedPackageName(sourceFile, start);
+          const { host, sourceFile, span: { start }, errorCode: errorCode2 } = context;
+          const packageName = errorCode2 === errorCannotFindImplicitJsxImport ? getJSXImplicitImportBase(context.program.getCompilerOptions(), sourceFile) : tryGetImportedPackageName(sourceFile, start);
           if (packageName === void 0) return void 0;
-          const typesPackageName = getTypesPackageNameToInstall(packageName, host, errorCode);
+          const typesPackageName = getTypesPackageNameToInstall(packageName, host, errorCode2);
           return typesPackageName === void 0 ? [] : [createCodeFixAction(
             fixName2,
             /*changes*/
@@ -181582,7 +181695,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes43,
         getCodeActions(context) {
-          const { errorCode, sourceFile, program, cancellationToken } = context;
+          const { errorCode: errorCode2, sourceFile, program, cancellationToken } = context;
           const checker = program.getTypeChecker();
           const sourceFiles = program.getSourceFiles();
           const token = getTokenAtPosition(sourceFile, context.span.start);
@@ -181658,7 +181771,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
               result.push(createDeleteFix(deletion, [Diagnostics.Remove_unused_declaration_for_Colon_0, name.getText(sourceFile)]));
             }
           }
-          const prefix = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode, sourceFile, token));
+          const prefix = ts_textChanges_exports.ChangeTracker.with(context, (t) => tryPrefixDeclaration(t, errorCode2, sourceFile, token));
           if (prefix.length) {
             result.push(createCodeFixAction(fixName3, prefix, [Diagnostics.Prefix_0_with_an_underscore, token.getText(sourceFile)], fixIdPrefix, Diagnostics.Prefix_all_unused_declarations_with_where_possible));
           }
@@ -181784,8 +181897,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           changes.delete(sourceFile, parent2);
         }
       }
-      function tryPrefixDeclaration(changes, errorCode, sourceFile, token) {
-        if (errorCode === Diagnostics.Property_0_is_declared_but_its_value_is_never_read.code) return;
+      function tryPrefixDeclaration(changes, errorCode2, sourceFile, token) {
+        if (errorCode2 === Diagnostics.Property_0_is_declared_but_its_value_is_never_read.code) return;
         if (token.kind === 140) {
           token = cast(token.parent, isInferTypeNode).typeParameter.name;
         }
@@ -181925,14 +182038,14 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
         fixIds: [fixId34],
         getAllCodeActions: (context) => codeFixAll(context, errorCodes44, (changes, diag2) => doChange27(changes, diag2.file, diag2.start, diag2.length, diag2.code))
       });
-      function doChange27(changes, sourceFile, start, length2, errorCode) {
+      function doChange27(changes, sourceFile, start, length2, errorCode2) {
         const token = getTokenAtPosition(sourceFile, start);
         const statement = findAncestor(token, isStatement);
         if (statement.getStart(sourceFile) !== token.getStart(sourceFile)) {
           const logData = JSON.stringify({
             statementKind: Debug.formatSyntaxKind(statement.kind),
             tokenKind: Debug.formatSyntaxKind(token.kind),
-            errorCode,
+            errorCode: errorCode2,
             start,
             length: length2
           });
@@ -183255,7 +183368,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
       registerCodeFix({
         errorCodes: errorCodes51,
         getCodeActions(context) {
-          const { sourceFile, program, span: { start }, errorCode, cancellationToken, host, preferences } = context;
+          const { sourceFile, program, span: { start }, errorCode: errorCode2, cancellationToken, host, preferences } = context;
           const token = getTokenAtPosition(sourceFile, start);
           let declaration;
           const changes = ts_textChanges_exports.ChangeTracker.with(context, (changes2) => {
@@ -183263,7 +183376,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
               changes2,
               sourceFile,
               token,
-              errorCode,
+              errorCode2,
               program,
               cancellationToken,
               /*markSeen*/
@@ -183273,7 +183386,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             );
           });
           const name = declaration && getNameOfDeclaration(declaration);
-          return !name || changes.length === 0 ? void 0 : [createCodeFixAction(fixId40, changes, [getDiagnostic(errorCode, token), getTextOfNode(name)], fixId40, Diagnostics.Infer_all_types_from_usage)];
+          return !name || changes.length === 0 ? void 0 : [createCodeFixAction(fixId40, changes, [getDiagnostic(errorCode2, token), getTextOfNode(name)], fixId40, Diagnostics.Infer_all_types_from_usage)];
         },
         fixIds: [fixId40],
         getAllCodeActions(context) {
@@ -183284,8 +183397,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           });
         }
       });
-      function getDiagnostic(errorCode, token) {
-        switch (errorCode) {
+      function getDiagnostic(errorCode2, token) {
+        switch (errorCode2) {
           case Diagnostics.Parameter_0_implicitly_has_an_1_type.code:
           case Diagnostics.Parameter_0_implicitly_has_an_1_type_but_a_better_type_may_be_inferred_from_usage.code:
             return isSetAccessorDeclaration(getContainingFunction(token)) ? Diagnostics.Infer_type_of_0_from_usage : Diagnostics.Infer_parameter_types_from_usage;
@@ -183299,8 +183412,8 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             return Diagnostics.Infer_type_of_0_from_usage;
         }
       }
-      function mapSuggestionDiagnostic(errorCode) {
-        switch (errorCode) {
+      function mapSuggestionDiagnostic(errorCode2) {
+        switch (errorCode2) {
           case Diagnostics.Variable_0_implicitly_has_type_1_in_some_locations_but_a_better_type_may_be_inferred_from_usage.code:
             return Diagnostics.Variable_0_implicitly_has_type_1_in_some_locations_where_its_type_cannot_be_determined.code;
           case Diagnostics.Variable_0_implicitly_has_an_1_type_but_a_better_type_may_be_inferred_from_usage.code:
@@ -183318,16 +183431,16 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           case Diagnostics.Member_0_implicitly_has_an_1_type_but_a_better_type_may_be_inferred_from_usage.code:
             return Diagnostics.Member_0_implicitly_has_an_1_type.code;
         }
-        return errorCode;
+        return errorCode2;
       }
-      function doChange33(changes, sourceFile, token, errorCode, program, cancellationToken, markSeen, host, preferences) {
+      function doChange33(changes, sourceFile, token, errorCode2, program, cancellationToken, markSeen, host, preferences) {
         if (!isParameterPropertyModifier(token.kind) && token.kind !== 80 && token.kind !== 26 && token.kind !== 110) {
           return void 0;
         }
         const { parent: parent2 } = token;
         const importAdder = createImportAdder(sourceFile, program, preferences, host);
-        errorCode = mapSuggestionDiagnostic(errorCode);
-        switch (errorCode) {
+        errorCode2 = mapSuggestionDiagnostic(errorCode2);
+        switch (errorCode2) {
           // Variable and Property declarations
           case Diagnostics.Member_0_implicitly_has_an_1_type.code:
           case Diagnostics.Variable_0_implicitly_has_type_1_in_some_locations_where_its_type_cannot_be_determined.code:
@@ -183368,7 +183481,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
           return void 0;
         }
         let declaration;
-        switch (errorCode) {
+        switch (errorCode2) {
           // Parameter declarations
           case Diagnostics.Parameter_0_implicitly_has_an_1_type.code:
             if (isSetAccessorDeclaration(containingFunction)) {
@@ -183407,7 +183520,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             }
             break;
           default:
-            return Debug.fail(String(errorCode));
+            return Debug.fail(String(errorCode2));
         }
         importAdder.writeFixes(changes);
         return declaration;
@@ -219319,8 +219432,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request3 = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve10, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve10, reject });
+          const promise = new Promise((resolve11, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve11, reject });
           });
           this.installer.send(request3);
           return promise;
@@ -221621,7 +221734,7 @@ var require_path_browserify = __commonJS({
     }
     var posix = {
       // path.resolve([from ...], to)
-      resolve: function resolve10() {
+      resolve: function resolve11() {
         var resolvedPath = "";
         var resolvedAbsolute = false;
         var cwd;
@@ -221668,7 +221781,7 @@ var require_path_browserify = __commonJS({
         assertPath(path);
         return path.length > 0 && path.charCodeAt(0) === 47;
       },
-      join: function join8() {
+      join: function join9() {
         if (arguments.length === 0)
           return ".";
         var joined;
@@ -226521,41 +226634,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push2(value) {
-        var p2 = new Promise(function(resolve10, reject) {
+        var p2 = new Promise(function(resolve11, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve10(result);
+            resolve11(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function unshift(value) {
-        var p2 = new Promise(function(resolve10, reject) {
+        var p2 = new Promise(function(resolve11, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve10(result);
+            resolve11(result);
           });
         });
         p2.catch(noop3);
         return p2;
       }
       function drained() {
-        var p2 = new Promise(function(resolve10) {
+        var p2 = new Promise(function(resolve11) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve10();
+              resolve11();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve10();
+                resolve11();
                 queue.drain = previousDrain;
               };
             }
@@ -227052,9 +227165,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve10(stats) : reject(error);
+            return error === null ? resolve11(stats) : reject(error);
           });
         });
       }
@@ -227079,10 +227192,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve10(entries);
+              resolve11(entries);
             } else {
               reject(error);
             }
@@ -227092,10 +227205,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve10(entries));
+          stream.once("end", () => resolve11(entries));
         });
       }
     };
@@ -260001,12 +260114,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
     };
     var NodeRuntimeFileSystem = class {
       delete(path2) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           fs__namespace.rm(path2, { recursive: true }, (err) => {
             if (err)
               reject(err);
             else
-              resolve10();
+              resolve11();
           });
         });
       }
@@ -260025,12 +260138,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         }));
       }
       readFile(filePath, encoding = "utf-8") {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           fs__namespace.readFile(filePath, encoding, (err, data) => {
             if (err)
               reject(err);
             else
-              resolve10(data);
+              resolve11(data);
           });
         });
       }
@@ -260038,12 +260151,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         return fs__namespace.readFileSync(filePath, encoding);
       }
       async writeFile(filePath, fileText) {
-        await new Promise((resolve10, reject) => {
+        await new Promise((resolve11, reject) => {
           fs__namespace.writeFile(filePath, fileText, (err) => {
             if (err)
               reject(err);
             else
-              resolve10();
+              resolve11();
           });
         });
       }
@@ -260057,12 +260170,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.mkdirSync(dirPath, { recursive: true });
       }
       move(srcPath, destPath) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           fs__namespace.rename(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve10();
+              resolve11();
           });
         });
       }
@@ -260070,12 +260183,12 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.renameSync(srcPath, destPath);
       }
       copy(srcPath, destPath) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           fs__namespace.copyFile(srcPath, destPath, (err) => {
             if (err)
               reject(err);
             else
-              resolve10();
+              resolve11();
           });
         });
       }
@@ -260083,15 +260196,15 @@ type XMLHttpRequestResponseType = "" | "arraybuffer" | "blob" | "document" | "js
         fs__namespace.copyFileSync(srcPath, destPath);
       }
       stat(path2) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           fs__namespace.stat(path2, (err, stat) => {
             if (err) {
               if (err.code === "ENOENT" || err.code === "ENOTDIR")
-                resolve10(void 0);
+                resolve11(void 0);
               else
                 reject(err);
             } else {
-              resolve10(stat);
+              resolve11(stat);
             }
           });
         });
@@ -283768,7 +283881,7 @@ Node text: ${this.#forgottenText}`;
 
 // src/index.ts
 init_cjs_shims();
-var import_picocolors31 = __toESM(require_picocolors(), 1);
+var import_picocolors32 = __toESM(require_picocolors(), 1);
 
 // src/migrate.ts
 init_cjs_shims();
@@ -283778,7 +283891,7 @@ var import_picocolors6 = __toESM(require_picocolors(), 1);
 var import_fs5 = require("fs");
 init_src();
 init_dbRole();
-var import_schema3 = require("@abloatai/transaction/schema");
+var import_schema2 = require("@abloatai/transaction/schema");
 var import_source = require("@abloatai/transaction/source");
 init_push();
 var MIGRATE_USAGE = `  ablo migrate \u2014 create the tables your schema needs in your own database (DATABASE_URL)
@@ -283825,8 +283938,8 @@ function parseMigrateArgs(argv) {
   return { schemaPath, exportName, targetSchema, dryRun, outputFile };
 }
 function planFor(schema, targetSchema = "public") {
-  const schemaJson = JSON.parse((0, import_schema3.serializeSchema)(schema));
-  const plan = (0, import_schema3.generateProvisionPlan)(schemaJson, targetSchema, {
+  const schemaJson = JSON.parse((0, import_schema2.serializeSchema)(schema));
+  const plan = (0, import_schema2.generateProvisionPlan)(schemaJson, targetSchema, {
     foreignKeys: targetSchema === "public"
   });
   const adapterTables = (0, import_source.adapterTableMigrations)().map((m2) => m2.up);
@@ -283848,8 +283961,8 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [],
   } });
   const total = statements.length;
   const startedAt = Date.now();
-  const lockTimeout = (0, import_schema3.resolveDdlLockTimeout)();
-  const maxLockAttempts = (0, import_schema3.resolveDdlMaxLockAttempts)();
+  const lockTimeout = (0, import_schema2.resolveDdlLockTimeout)();
+  const maxLockAttempts = (0, import_schema2.resolveDdlMaxLockAttempts)();
   if (!observer.quiet) log.info("applying migration plan", { targetSchema, statements: total });
   try {
     for (let attempt = 1; ; attempt++) {
@@ -283863,7 +283976,7 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [],
               observer.onStatement?.(index + 1, total);
             } catch (err) {
               const pg = err ?? {};
-              if (pg.code === import_schema3.PG_LOCK_NOT_AVAILABLE) throw err;
+              if (pg.code === import_schema2.PG_LOCK_NOT_AVAILABLE) throw err;
               log.error("migration plan failed", {
                 code: "migration_failed",
                 durationMs: Date.now() - startedAt,
@@ -283881,10 +283994,10 @@ async function applyStatements(dbUrl, targetSchema, statements, concurrent = [],
         break;
       } catch (err) {
         const pg = err ?? {};
-        if (pg.code === import_schema3.PG_LOCK_NOT_AVAILABLE && attempt < maxLockAttempts) {
-          const backoffMs = (0, import_schema3.ddlLockRetryBackoffMs)(attempt);
+        if (pg.code === import_schema2.PG_LOCK_NOT_AVAILABLE && attempt < maxLockAttempts) {
+          const backoffMs = (0, import_schema2.ddlLockRetryBackoffMs)(attempt);
           log.warn("schema change blocked by a lock; backing off and retrying", { targetSchema, attempt, backoffMs });
-          await new Promise((resolve10) => setTimeout(resolve10, backoffMs));
+          await new Promise((resolve11) => setTimeout(resolve11, backoffMs));
           continue;
         }
         throw err;
@@ -284226,11 +284339,11 @@ function parseFeedbackArgs(argv) {
   const positional2 = [];
   let detail;
   let command;
-  let errorCode;
+  let errorCode2;
   let from;
   let yes = false;
   let json = false;
-  const flagValue = (flag2, value) => {
+  const flagValue2 = (flag2, value) => {
     if (value === void 0 || value.startsWith("--")) {
       throw new import_errors12.AbloValidationError(`\`${flag2}\` needs a value.`, {
         code: "cli_invalid_arguments"
@@ -284242,16 +284355,16 @@ function parseFeedbackArgs(argv) {
     const arg = argv[i];
     switch (arg) {
       case "--detail":
-        detail = flagValue("--detail", argv[++i]);
+        detail = flagValue2("--detail", argv[++i]);
         break;
       case "--command":
-        command = flagValue("--command", argv[++i]);
+        command = flagValue2("--command", argv[++i]);
         break;
       case "--error-code":
-        errorCode = flagValue("--error-code", argv[++i]);
+        errorCode2 = flagValue2("--error-code", argv[++i]);
         break;
       case "--from":
-        from = flagValue("--from", argv[++i]);
+        from = flagValue2("--from", argv[++i]);
         break;
       case "--yes":
         yes = true;
@@ -284286,7 +284399,7 @@ function parseFeedbackArgs(argv) {
     summary,
     ...detail !== void 0 ? { detail } : {},
     ...command !== void 0 ? { command } : {},
-    ...errorCode !== void 0 ? { errorCode } : {},
+    ...errorCode2 !== void 0 ? { errorCode: errorCode2 } : {},
     ...from !== void 0 ? { from } : {},
     yes,
     json
@@ -284407,8 +284520,8 @@ init_controlPlane();
 init_config();
 var BRANCH_USAGE = `Usage:
   ablo branch list [--json]
-  ablo branch create <slug> [--from <id|slug>] [--kind dev|preview|test|long_lived] [--credential]
-  ablo branch ensure <slug> [--from <id|slug>] [--kind dev|preview|test|long_lived] [--credential]
+  ablo branch create <slug> [--from <id|slug>] [--kind dev|preview|test|long_lived] [--hosted] [--credential]
+  ablo branch ensure <slug> [--from <id|slug>] [--kind dev|preview|test|long_lived] [--hosted] [--credential]
   ablo branch credential <id|slug> [--ttl-hours <1-168>] [--json]
   ablo branch status <branch-id|slug> [--json]
   ablo branch check <branch-id|slug> [--json]
@@ -284421,7 +284534,7 @@ function requireKey2(explicit) {
   const key = explicit ?? resolveManagementKey();
   if (!key) {
     throw new Error(
-      "No project management credential. Run `npx ablo login` or set ABLO_MANAGEMENT_KEY."
+      "No project management credential. Run `npx ablo login` or set ABLO_API_KEY to an mk_ credential."
     );
   }
   return key;
@@ -284561,7 +284674,8 @@ async function create(slug, argv, idempotent, context = {}) {
       slug: parsedSlug.data,
       ...parentId ? { parent_branch_id: parentId } : {},
       ...valueAfter(argv, "--kind") ? { kind: valueAfter(argv, "--kind") } : {},
-      ...valueAfter(argv, "--expires-at") ? { expires_at: valueAfter(argv, "--expires-at") } : {}
+      ...valueAfter(argv, "--expires-at") ? { expires_at: valueAfter(argv, "--expires-at") } : {},
+      ...argv.includes("--hosted") ? { storage: "hosted" } : {}
     }
   }, context);
   if (response.status !== 201) {
@@ -284659,29 +284773,118 @@ async function branches(argv) {
 
 // src/branchDev.ts
 init_cjs_shims();
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_node_child_process = require("child_process");
 var import_branches2 = require("@abloatai/transaction/branches");
-var import_errors14 = require("@abloatai/transaction/errors");
+var import_errors15 = require("@abloatai/transaction/errors");
 init_config();
 init_telemetry();
 
 // src/dev.ts
 init_cjs_shims();
-var import_errors13 = require("@abloatai/transaction/errors");
+var import_errors14 = require("@abloatai/transaction/errors");
 var import_credentialPolicy2 = require("@abloatai/transaction/auth/credentialPolicy");
 var import_picocolors16 = __toESM(require_picocolors(), 1);
 init_dist2();
 var import_fs7 = require("fs");
 var import_path5 = require("path");
-var import_schema6 = require("@abloatai/transaction/schema");
+var import_schema5 = require("@abloatai/transaction/schema");
 init_push();
 init_controlPlane();
+var import_wire8 = require("@abloatai/transaction/wire");
 init_config();
 init_readiness();
 init_theme();
 init_dbRole();
 var import_source3 = require("@abloatai/transaction/source");
+
+// src/localConnectorLease.ts
+init_cjs_shims();
+var import_node_crypto5 = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = require("path");
+var import_errors13 = require("@abloatai/transaction/errors");
+function acquireLocalConnectorLease(identity, options = {}) {
+  const directory = options.directory ?? (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), "ablo-source-connectors");
+  const pid = options.pid ?? process.pid;
+  const isProcessAlive = options.isProcessAlive ?? processIsAlive;
+  const key = (0, import_node_crypto5.createHash)("sha256").update(`${(0, import_node_path2.resolve)(identity.cwd)}\0${identity.baseUrl}\0${identity.branch}`).digest("hex").slice(0, 24);
+  const path = (0, import_node_path2.join)(directory, `${key}.lock`);
+  const token = (0, import_node_crypto5.randomUUID)();
+  const record = { pid, token };
+  (0, import_node_fs3.mkdirSync)(directory, { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const fd = (0, import_node_fs3.openSync)(path, "wx", 384);
+      try {
+        (0, import_node_fs3.writeFileSync)(fd, JSON.stringify(record));
+      } finally {
+        (0, import_node_fs3.closeSync)(fd);
+      }
+      let released = false;
+      return {
+        release() {
+          if (released) return;
+          released = true;
+          try {
+            const current = readLease(path);
+            if (current?.token === token) (0, import_node_fs3.unlinkSync)(path);
+          } catch {
+          }
+        }
+      };
+    } catch (error) {
+      if (!isAlreadyExists(error)) throw error;
+      const owner = readLease(path);
+      if (owner && isProcessAlive(owner.pid)) {
+        throw new import_errors13.AbloValidationError(
+          `Another ablo dev --local process (PID ${owner.pid}) already owns this branch's local Data Source. Stop it before starting another connector.`,
+          { code: "cli_invalid_arguments" }
+        );
+      }
+      try {
+        (0, import_node_fs3.unlinkSync)(path);
+      } catch (unlinkError) {
+        if (!isMissing(unlinkError)) throw unlinkError;
+      }
+    }
+  }
+  throw new import_errors13.AbloValidationError(
+    "Could not acquire this branch's local Data Source connector lease. Retry after the other connector exits.",
+    { code: "cli_invalid_arguments" }
+  );
+}
+function readLease(path) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    return typeof parsed.pid === "number" && typeof parsed.token === "string" ? { pid: parsed.pid, token: parsed.token } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !isNoSuchProcess(error);
+  }
+}
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+}
+function isAlreadyExists(error) {
+  return errorCode(error) === "EEXIST";
+}
+function isMissing(error) {
+  return errorCode(error) === "ENOENT";
+}
+function isNoSuchProcess(error) {
+  return errorCode(error) === "ESRCH";
+}
+
+// src/dev.ts
 function parseDevArgs(argv) {
   let schemaPath = DEFAULT_SCHEMA_PATH;
   let exportName = DEFAULT_EXPORT;
@@ -284714,7 +284917,7 @@ function parseDevArgs(argv) {
         sourcePath = argv[++i] ?? sourcePath;
         break;
       default:
-        throw new import_errors13.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors14.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   url = apiBaseUrl(url);
@@ -284732,7 +284935,7 @@ function parseDevArgs(argv) {
 async function loadLocalSourceHandler(sourcePath) {
   const abs = (0, import_path5.resolve)(process.cwd(), sourcePath);
   if (!(0, import_fs7.existsSync)(abs)) {
-    throw new import_errors13.AbloValidationError(
+    throw new import_errors14.AbloValidationError(
       `local Data Source not found at ${import_picocolors16.default.bold(sourcePath)}. Add the signed Data Source handler described by ${import_picocolors16.default.bold("npx ablo docs data-sources")}, or pass ${import_picocolors16.default.bold("--source <path>")}.`,
       { code: "cli_invalid_arguments" }
     );
@@ -284743,7 +284946,7 @@ async function loadLocalSourceHandler(sourcePath) {
   const nested = mod.default && typeof mod.default === "object" ? mod.default : void 0;
   const handler = mod.POST ?? nested?.POST;
   if (typeof handler !== "function") {
-    throw new import_errors13.AbloValidationError(
+    throw new import_errors14.AbloValidationError(
       `${import_picocolors16.default.bold(sourcePath)} must export a ${import_picocolors16.default.bold("POST(request)")} Data Source handler.`,
       { code: "cli_invalid_arguments" }
     );
@@ -284751,27 +284954,20 @@ async function loadLocalSourceHandler(sourcePath) {
   return handler;
 }
 async function registerLocalSource(args) {
-  const response = await fetch(`${args.url}/v1/datasources`, {
+  await requestControlPlane({
+    path: "/v1/datasources",
     method: "POST",
-    headers: {
-      authorization: `Bearer ${args.apiKey}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({
+    ...args.apiKey ? { apiKey: args.apiKey } : {},
+    baseUrl: args.url,
+    body: {
       connection: "endpoint",
       endpoint: "http://localhost/ablo-dev/reverse-channel",
       signingKey: args.apiKey,
       reverseChannel: true,
       metadata: { managed_by: "ablo dev --local" }
-    })
+    },
+    responseSchema: import_wire8.datasourceSummarySchema
   });
-  if (!response.ok) {
-    const body = await response.text();
-    throw new import_errors13.AbloValidationError(
-      `Could not register the local Data Source (${response.status}): ${body}`,
-      { code: "cli_invalid_arguments" }
-    );
-  }
 }
 function classifyKey(apiKey) {
   if (!apiKey) {
@@ -284928,7 +285124,7 @@ async function dev(argv, runtime = {}) {
   else if (!args.apiKey) args.apiKey = resolveRuntimeApiKey("sandbox").key;
   if (runtime.branch) args.planeLabel = runtime.branch.slug;
   if (args.local && !args.watch) {
-    throw new import_errors13.AbloValidationError(
+    throw new import_errors14.AbloValidationError(
       `${import_picocolors16.default.bold("--local")} opens a long-lived secure connector and cannot be combined with ${import_picocolors16.default.bold("--no-watch")}.`,
       { code: "cli_invalid_arguments" }
     );
@@ -284950,6 +285146,7 @@ async function dev(argv, runtime = {}) {
     );
   }
   let localAbort = null;
+  let localLease = null;
   if (args.local) {
     process.env.ABLO_API_KEY = args.apiKey;
     if (!process.env.DATABASE_URL) {
@@ -284957,7 +285154,18 @@ async function dev(argv, runtime = {}) {
       if (databaseUrl) process.env.DATABASE_URL = databaseUrl.value;
     }
     const handler = await loadLocalSourceHandler(args.sourcePath);
-    await registerLocalSource(args);
+    localLease = acquireLocalConnectorLease({
+      cwd: process.cwd(),
+      baseUrl: args.url,
+      branch: args.planeLabel
+    });
+    try {
+      await registerLocalSource(args);
+    } catch (error) {
+      localLease.release();
+      localLease = null;
+      throw error;
+    }
     localAbort = new AbortController();
     const connector = (0, import_source3.createSourceConnector)({
       apiKey: args.apiKey,
@@ -284975,13 +285183,16 @@ async function dev(argv, runtime = {}) {
     });
     void connector.run(localAbort.signal).catch((error) => {
       console.error(import_picocolors16.default.red(`  local connector stopped: ${error instanceof Error ? error.message : String(error)}`));
+    }).finally(() => {
+      localLease?.release();
+      localLease = null;
     });
     console.log(`  ${import_picocolors16.default.dim("source")}  ${args.sourcePath} ${import_picocolors16.default.dim("(outbound connector; no public URL)")}`);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors16.default.dim("schema")}  ${import_picocolors16.default.bold(args.schemaPath)} ${import_picocolors16.default.dim(`(${modelCount} models, hash ${(0, import_schema6.schemaHash)(schema)})`)}`
+    `  ${import_picocolors16.default.dim("schema")}  ${import_picocolors16.default.bold(args.schemaPath)} ${import_picocolors16.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
   );
   if (!runtime.branch) {
     console.log(`  ${import_picocolors16.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
@@ -284994,6 +285205,7 @@ async function dev(argv, runtime = {}) {
   s.stop(first.message, first.ok ? 0 : 1);
   if (!first.ok) {
     localAbort?.abort();
+    localLease?.release();
     process.exit(1);
   }
   if (runtime.branch) {
@@ -285050,6 +285262,7 @@ async function dev(argv, runtime = {}) {
   const stop = () => {
     watcher.close();
     localAbort?.abort();
+    localLease?.release();
     console.log(`
   ${import_picocolors16.default.dim("stopped.")}`);
     process.exit(0);
@@ -285079,7 +285292,7 @@ function parseBranchDevArgs(argv) {
     const arg = argv[index];
     if (!arg) continue;
     if (arg === "--no-branch") {
-      throw new import_errors14.AbloValidationError(
+      throw new import_errors15.AbloValidationError(
         "--no-branch was removed: development is branch-isolated. Use --branch <slug> to select explicitly.",
         { code: "cli_invalid_arguments" }
       );
@@ -285087,7 +285300,7 @@ function parseBranchDevArgs(argv) {
     if (arg === "--branch") {
       branchSlug = argv[++index];
       if (!branchSlug) {
-        throw new import_errors14.AbloValidationError("--branch requires a slug", {
+        throw new import_errors15.AbloValidationError("--branch requires a slug", {
           code: "cli_invalid_arguments"
         });
       }
@@ -285096,7 +285309,7 @@ function parseBranchDevArgs(argv) {
     if (arg === "--branch-ttl-hours") {
       const value = Number(argv[++index]);
       if (!Number.isInteger(value) || value < 1 || value > 168) {
-        throw new import_errors14.AbloValidationError("--branch-ttl-hours must be between 1 and 168", {
+        throw new import_errors15.AbloValidationError("--branch-ttl-hours must be between 1 and 168", {
           code: "cli_invalid_arguments"
         });
       }
@@ -285114,12 +285327,12 @@ function parseBranchDevArgs(argv) {
 function branchSlugFromRef(ref) {
   const base = ref.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   if (!base) {
-    throw new import_errors14.AbloValidationError(`cannot derive an Ablo branch slug from "${ref}"`, {
+    throw new import_errors15.AbloValidationError(`cannot derive an Ablo branch slug from "${ref}"`, {
       code: "cli_invalid_arguments"
     });
   }
   const nonRoot = base === "production" ? "production-dev" : base;
-  const shortened = nonRoot.length <= 40 ? nonRoot : `${nonRoot.slice(0, 31).replace(/-+$/g, "")}-${(0, import_node_crypto5.createHash)("sha256").update(nonRoot).digest("hex").slice(0, 8)}`;
+  const shortened = nonRoot.length <= 40 ? nonRoot : `${nonRoot.slice(0, 31).replace(/-+$/g, "")}-${(0, import_node_crypto6.createHash)("sha256").update(nonRoot).digest("hex").slice(0, 8)}`;
   return import_branches2.branchSlugSchema.parse(shortened);
 }
 function gitBranch() {
@@ -285136,7 +285349,7 @@ function gitBranch() {
 function discoverBranchRef(explicit, env = process.env, readGitBranch = gitBranch) {
   const value = explicit ?? env.ABLO_BRANCH ?? env.GITHUB_HEAD_REF ?? env.GITHUB_REF_NAME ?? env.VERCEL_GIT_COMMIT_REF ?? env.CI_COMMIT_REF_NAME ?? readGitBranch();
   if (!value) {
-    throw new import_errors14.AbloValidationError(
+    throw new import_errors15.AbloValidationError(
       "Could not determine the Git branch. Pass --branch <slug> or set ABLO_BRANCH.",
       { code: "cli_invalid_arguments" }
     );
@@ -285154,13 +285367,13 @@ async function runBranchDev(argv, dependencies = {}) {
   const slug = branchSlugFromRef(ref);
   const managementKey = dependencies.resolveManagementKey?.() ?? resolveManagementKey();
   if (!managementKey) {
-    throw new import_errors14.AbloValidationError(
-      "Creating a development branch needs a project management credential. Run `npx ablo login` or set ABLO_MANAGEMENT_KEY.",
+    throw new import_errors15.AbloValidationError(
+      "Creating a development branch needs a project management credential. Run `npx ablo login` or set ABLO_API_KEY to an mk_ credential.",
       { code: "cli_invalid_arguments" }
     );
   }
   if (!managementKey.startsWith("mk_")) {
-    throw new import_errors14.AbloValidationError(
+    throw new import_errors15.AbloValidationError(
       "Branch creation needs the active project management credential (mk_\u2026). Run `npx ablo login` to refresh it.",
       { code: "cli_invalid_arguments" }
     );
@@ -285189,7 +285402,7 @@ async function runBranchDev(argv, dependencies = {}) {
 // src/whoami.ts
 init_cjs_shims();
 var import_picocolors17 = __toESM(require_picocolors(), 1);
-var import_errors15 = require("@abloatai/transaction/errors");
+var import_errors16 = require("@abloatai/transaction/errors");
 init_config();
 init_controlPlane();
 
@@ -285264,7 +285477,7 @@ function parseWhoamiArgs(argv) {
       case "--key": {
         const value = argv[++i];
         if (!value || value.startsWith("--")) {
-          throw new import_errors15.AbloValidationError("`--key` needs a credential value.", {
+          throw new import_errors16.AbloValidationError("`--key` needs a credential value.", {
             code: "cli_invalid_arguments"
           });
         }
@@ -285274,12 +285487,12 @@ function parseWhoamiArgs(argv) {
       case "--key-env": {
         const value = argv[++i];
         if (!value || value.startsWith("--")) {
-          throw new import_errors15.AbloValidationError("`--key-env` needs an environment variable name.", {
+          throw new import_errors16.AbloValidationError("`--key-env` needs an environment variable name.", {
             code: "cli_invalid_arguments"
           });
         }
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
-          throw new import_errors15.AbloValidationError(
+          throw new import_errors16.AbloValidationError(
             `\`${value}\` is not a valid environment variable name.`,
             { code: "cli_invalid_arguments" }
           );
@@ -285288,13 +285501,13 @@ function parseWhoamiArgs(argv) {
         break;
       }
       default:
-        throw new import_errors15.AbloValidationError(`unknown whoami flag: ${arg}`, {
+        throw new import_errors16.AbloValidationError(`unknown whoami flag: ${arg}`, {
           code: "cli_invalid_arguments"
         });
     }
   }
   if (key && keyEnv) {
-    throw new import_errors15.AbloValidationError("Choose one credential source: `--key` or `--key-env`.", {
+    throw new import_errors16.AbloValidationError("Choose one credential source: `--key` or `--key-env`.", {
       code: "cli_invalid_arguments"
     });
   }
@@ -285305,7 +285518,7 @@ function selectWhoamiCredential(args, cwd = process.cwd()) {
   if (args.keyEnv) {
     const found = readProjectEnvVariable(args.keyEnv, cwd);
     if (!found) {
-      throw new import_errors15.AbloAuthenticationError(
+      throw new import_errors16.AbloAuthenticationError(
         `${args.keyEnv} is not set in the process environment, .env.local, or .env.`,
         { code: "cli_api_key_missing" }
       );
@@ -285329,12 +285542,12 @@ function selectWhoamiCredential(args, cwd = process.cwd()) {
   if (managementKey) {
     return {
       key: managementKey,
-      source: process.env.ABLO_MANAGEMENT_KEY ? "env:ABLO_MANAGEMENT_KEY" : "stored login",
-      targetSource: process.env.ABLO_MANAGEMENT_KEY ? "env" : "stored"
+      source: "stored login",
+      targetSource: "stored"
     };
   }
   const ambient = ambientEnvKeyNote();
-  throw new import_errors15.AbloAuthenticationError(
+  throw new import_errors16.AbloAuthenticationError(
     `No credential found. Run \`ablo login\`, set ABLO_API_KEY, or pass \`--key-env <NAME>\`.${ambient ? `
 
 ${ambient}` : ""}`,
@@ -285352,7 +285565,7 @@ async function whoami(argv) {
   });
   const confirmed = target.confirmed;
   if (!confirmed) {
-    throw new import_errors15.AbloAuthenticationError(
+    throw new import_errors16.AbloAuthenticationError(
       "The server did not confirm an identity for this credential.",
       { code: "identity_resolve_failed" }
     );
@@ -285410,15 +285623,15 @@ init_push();
 // src/setup/run.ts
 init_cjs_shims();
 var import_picocolors19 = __toESM(require_picocolors(), 1);
-var import_errors16 = require("@abloatai/transaction/errors");
+var import_errors17 = require("@abloatai/transaction/errors");
 init_theme();
 
 // src/setup/discover.ts
 init_cjs_shims();
-var import_node_fs3 = require("fs");
-var import_node_crypto6 = require("crypto");
+var import_node_fs4 = require("fs");
+var import_node_crypto7 = require("crypto");
 var import_node_child_process2 = require("child_process");
-var import_node_path2 = require("path");
+var import_node_path3 = require("path");
 init_controlPlane();
 init_config();
 
@@ -286477,7 +286690,7 @@ function tryGit(cwd, args) {
   }
 }
 function resolveRepositoryRoot(cwd = process.cwd()) {
-  return (0, import_node_path2.resolve)(tryGit(cwd, ["rev-parse", "--show-toplevel"]) || cwd);
+  return (0, import_node_path3.resolve)(tryGit(cwd, ["rev-parse", "--show-toplevel"]) || cwd);
 }
 function walkFiles(root, maxDepth = 5) {
   const files = [];
@@ -286486,13 +286699,13 @@ function walkFiles(root, maxDepth = 5) {
     const current = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs3.readdirSync)(current.path, { withFileTypes: true });
+      entries = (0, import_node_fs4.readdirSync)(current.path, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries.slice(0, 1e4)) {
       if (files.length >= MAX_DISCOVERY_FILES) break;
-      const path = (0, import_node_path2.join)(current.path, entry.name);
+      const path = (0, import_node_path3.join)(current.path, entry.name);
       if (entry.isDirectory()) {
         if (current.depth < maxDepth && !IGNORED_DIRECTORIES.has(entry.name)) {
           stack.push({ path, depth: current.depth + 1 });
@@ -286506,9 +286719,9 @@ function walkFiles(root, maxDepth = 5) {
 }
 function readManifest(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
     return {
-      root: (0, import_node_path2.resolve)(path, ".."),
+      root: (0, import_node_path3.resolve)(path, ".."),
       name: typeof parsed.name === "string" ? parsed.name : null,
       dependencies: { ...parsed.dependencies, ...parsed.devDependencies },
       scripts: { ...parsed.scripts }
@@ -286518,14 +286731,14 @@ function readManifest(path) {
   }
 }
 function packageManifests(root, files) {
-  return files.filter((path) => (0, import_node_path2.basename)(path) === "package.json").flatMap((path) => {
+  return files.filter((path) => (0, import_node_path3.basename)(path) === "package.json").flatMap((path) => {
     const manifest = readManifest(path);
     return manifest ? [manifest] : [];
   }).sort((a, b4) => a.root.localeCompare(b4.root));
 }
 function pathInside(root, target) {
-  const fromRoot = (0, import_node_path2.relative)(root, target);
-  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${import_node_path2.sep}`);
+  const fromRoot = (0, import_node_path3.relative)(root, target);
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${import_node_path3.sep}`);
 }
 function packageOwnedFiles(manifest, manifests, files) {
   const nestedPackageRoots = manifests.filter(({ root }) => root !== manifest.root && pathInside(manifest.root, root));
@@ -286583,8 +286796,8 @@ function detectedPersistence(manifest, files) {
     if (!SOURCE_EXTENSIONS.has(sourceExtension(path))) continue;
     let source;
     try {
-      if ((0, import_node_fs3.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
-      source = (0, import_node_fs3.readFileSync)(path, "utf8");
+      if ((0, import_node_fs4.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
+      source = (0, import_node_fs4.readFileSync)(path, "utf8");
     } catch {
       continue;
     }
@@ -286612,17 +286825,17 @@ function coordinationAdoptionReason(disposition, persistence) {
   }
 }
 function packageManager(root) {
-  if ((0, import_node_fs3.existsSync)((0, import_node_path2.join)(root, "pnpm-lock.yaml"))) return "pnpm";
-  if ((0, import_node_fs3.existsSync)((0, import_node_path2.join)(root, "yarn.lock"))) return "yarn";
-  if ((0, import_node_fs3.existsSync)((0, import_node_path2.join)(root, "bun.lockb")) || (0, import_node_fs3.existsSync)((0, import_node_path2.join)(root, "bun.lock"))) return "bun";
+  if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(root, "pnpm-lock.yaml"))) return "pnpm";
+  if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(root, "yarn.lock"))) return "yarn";
+  if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(root, "bun.lockb")) || (0, import_node_fs4.existsSync)((0, import_node_path3.join)(root, "bun.lock"))) return "bun";
   return "npm";
 }
 function environmentKeyNames(root) {
   const names = [".env.local", ".env.development.local", ".env.development", ".env"];
   return names.flatMap((name) => {
-    const path = (0, import_node_path2.join)(root, name);
-    if (!(0, import_node_fs3.existsSync)(path)) return [];
-    const keys = (0, import_node_fs3.readFileSync)(path, "utf8").split(/\r?\n/).flatMap((line) => {
+    const path = (0, import_node_path3.join)(root, name);
+    if (!(0, import_node_fs4.existsSync)(path)) return [];
+    const keys = (0, import_node_fs4.readFileSync)(path, "utf8").split(/\r?\n/).flatMap((line) => {
       const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
       return match ? [match[1]] : [];
     });
@@ -286637,8 +286850,8 @@ function abloSourceFiles(root, files) {
   return files.flatMap((path) => {
     if (!SOURCE_EXTENSIONS.has(sourceExtension(path))) return [];
     try {
-      if ((0, import_node_fs3.lstatSync)(path).size > MAX_SOURCE_BYTES) return [];
-      return (0, import_node_fs3.readFileSync)(path, "utf8").includes("@abloatai/") ? [(0, import_node_path2.relative)(root, path) || "."] : [];
+      if ((0, import_node_fs4.lstatSync)(path).size > MAX_SOURCE_BYTES) return [];
+      return (0, import_node_fs4.readFileSync)(path, "utf8").includes("@abloatai/") ? [(0, import_node_path3.relative)(root, path) || "."] : [];
     } catch {
       return [];
     }
@@ -286665,12 +286878,12 @@ function discoverMutationSites(root, files) {
     if (!SOURCE_EXTENSIONS.has(sourceExtension(path))) continue;
     let source;
     try {
-      if ((0, import_node_fs3.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
-      source = (0, import_node_fs3.readFileSync)(path, "utf8");
+      if ((0, import_node_fs4.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
+      source = (0, import_node_fs4.readFileSync)(path, "utf8");
     } catch {
       continue;
     }
-    const locator = (0, import_node_path2.relative)(root, path) || ".";
+    const locator = (0, import_node_path3.relative)(root, path) || ".";
     for (const match of source.matchAll(/\b(?:(?:[A-Za-z_$][\w$]*)\.query|query|q)\s*\(\s*(?:`|['"])\s*(INSERT\s+INTO|UPDATE|DELETE\s+FROM)\s+([A-Za-z_$][\w$.[\]"`]*|"[^"]+"|`[^`]+`)/gi)) {
       const rawTable = match[2] ?? "";
       const modelHint = rawTable.replace(/["`\[\]]/g, "").split(".").at(-1)?.toLowerCase() || null;
@@ -286702,13 +286915,13 @@ function discoverMutationSites(root, files) {
   return sites.sort((a, b4) => a.path.localeCompare(b4.path) || a.line - b4.line);
 }
 function isProductionMutationFile(root, path) {
-  const locator = (0, import_node_path2.relative)(root, path).replaceAll("\\", "/");
+  const locator = (0, import_node_path3.relative)(root, path).replaceAll("\\", "/");
   return !/(?:^|\/)(?:test|tests|__tests__|scripts)(?:\/|$)/.test(locator) && !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(locator);
 }
 function digestFile(path) {
-  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  if (!(0, import_node_fs4.existsSync)(path)) return null;
   try {
-    return (0, import_node_crypto6.createHash)("sha256").update((0, import_node_fs3.readFileSync)(path)).digest("hex");
+    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs4.readFileSync)(path)).digest("hex");
   } catch {
     return null;
   }
@@ -286739,7 +286952,7 @@ function localDiscoveryStep(state) {
   const appFiles = selected ? packageOwnedFiles(selected, state.packageManifests, files) : files.filter((path) => pathInside(envRoot, path));
   const persistence = selected ? detectedPersistence(selected, appFiles) : [];
   const coordinationAdoption = coordinationAdoptionDisposition(persistence);
-  const excludedNestedPackages = selected ? state.packageManifests.filter(({ root: packageRoot2 }) => packageRoot2 !== selected.root && pathInside(selected.root, packageRoot2)).map(({ root: packageRoot2, name }) => ({ root: (0, import_node_path2.relative)(root, packageRoot2), name })) : [];
+  const excludedNestedPackages = selected ? state.packageManifests.filter(({ root: packageRoot2 }) => packageRoot2 !== selected.root && pathInside(selected.root, packageRoot2)).map(({ root: packageRoot2, name }) => ({ root: (0, import_node_path3.relative)(root, packageRoot2), name })) : [];
   const mutationSites = discoverMutationSites(
     envRoot,
     appFiles.filter((path) => isProductionMutationFile(envRoot, path))
@@ -286752,17 +286965,17 @@ function localDiscoveryStep(state) {
     if (!SOURCE_EXTENSIONS.has(sourceExtension(path))) continue;
     let source;
     try {
-      if ((0, import_node_fs3.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
-      source = (0, import_node_fs3.readFileSync)(path, "utf8");
+      if ((0, import_node_fs4.lstatSync)(path).size > MAX_SOURCE_BYTES) continue;
+      source = (0, import_node_fs4.readFileSync)(path, "utf8");
     } catch {
       continue;
     }
     databaseColumns.push(...discoverDatabaseColumnsFromSqlSource({
-      path: (0, import_node_path2.relative)(envRoot, path),
+      path: (0, import_node_path3.relative)(envRoot, path),
       source
     }));
     transactionalRequirements.push(...discoverTransactionalRequirementsFromSqlSource({
-      path: (0, import_node_path2.relative)(envRoot, path),
+      path: (0, import_node_path3.relative)(envRoot, path),
       source
     }));
   }
@@ -286794,8 +287007,8 @@ function localDiscoveryStep(state) {
     "src/app/providers.tsx",
     "app/api/ablo-session/route.ts",
     "src/app/api/ablo-session/route.ts"
-  ].filter((path) => (0, import_node_fs3.existsSync)((0, import_node_path2.join)(envRoot, path)));
-  const localSchemaPath = [(0, import_node_path2.join)(envRoot, "ablo", "schema.ts"), (0, import_node_path2.join)(envRoot, "src", "ablo", "schema.ts")].find((path) => (0, import_node_fs3.existsSync)(path)) ?? (0, import_node_path2.join)(envRoot, "ablo", "schema.ts");
+  ].filter((path) => (0, import_node_fs4.existsSync)((0, import_node_path3.join)(envRoot, path)));
+  const localSchemaPath = [(0, import_node_path3.join)(envRoot, "ablo", "schema.ts"), (0, import_node_path3.join)(envRoot, "src", "ablo", "schema.ts")].find((path) => (0, import_node_fs4.existsSync)(path)) ?? (0, import_node_path3.join)(envRoot, "ablo", "schema.ts");
   state.localSchemaDigest = digestFile(localSchemaPath);
   const facts = [
     fact("repository.root", root, "git", tryGit(root, ["rev-parse", "--show-toplevel"]) ? "Resolved from Git." : "No Git root was available; using the requested directory.", root),
@@ -286804,9 +287017,9 @@ function localDiscoveryStep(state) {
     fact("repository.dirtyPathCount", dirtyEntries.length, "git", "Count from porcelain status; path names are intentionally omitted.", root),
     fact("repository.scanTruncated", files.length >= MAX_DISCOVERY_FILES, "filesystem", `Scanned at most ${MAX_DISCOVERY_FILES} files to depth 5.`, root),
     fact("package.manager", packageManager(root), "filesystem", "Detected from the repository lockfile.", root),
-    fact("application.candidates", candidates.map(({ manifest, frameworks, dataAccess, runtimeEntrypoint }) => ({ root: (0, import_node_path2.relative)(root, manifest.root) || ".", name: manifest.name, frameworks, dataAccess, runtimeEntrypoint })), "package_manifest", `${candidates.length} runnable application candidate(s) found.`, root),
-    fact("application.selectedRoot", state.applicationRoot ? (0, import_node_path2.relative)(root, state.applicationRoot) || "." : null, "inference", state.applicationRoot ? "Exactly one usable application root was selected." : "Application selection is ambiguous.", root, state.applicationRoot ? "high" : "low"),
-    fact("application.packageName", state.packageName, "package_manifest", "Read from the selected package manifest.", state.applicationRoot ? (0, import_node_path2.join)((0, import_node_path2.relative)(root, state.applicationRoot), "package.json") : "package.json"),
+    fact("application.candidates", candidates.map(({ manifest, frameworks, dataAccess, runtimeEntrypoint }) => ({ root: (0, import_node_path3.relative)(root, manifest.root) || ".", name: manifest.name, frameworks, dataAccess, runtimeEntrypoint })), "package_manifest", `${candidates.length} runnable application candidate(s) found.`, root),
+    fact("application.selectedRoot", state.applicationRoot ? (0, import_node_path3.relative)(root, state.applicationRoot) || "." : null, "inference", state.applicationRoot ? "Exactly one usable application root was selected." : "Application selection is ambiguous.", root, state.applicationRoot ? "high" : "low"),
+    fact("application.packageName", state.packageName, "package_manifest", "Read from the selected package manifest.", state.applicationRoot ? (0, import_node_path3.join)((0, import_node_path3.relative)(root, state.applicationRoot), "package.json") : "package.json"),
     fact("application.frameworks", selected ? selectedFrameworks : candidates.flatMap(({ frameworks }) => frameworks), "package_manifest", "Detected only from declared package dependencies.", root),
     fact("application.kinds", selectedApplicationKinds, "package_manifest", "Detected from runtime scripts and declared framework or database dependencies.", root),
     fact("application.excludedNestedPackages", excludedNestedPackages, "package_manifest", "Independently manifested nested packages are excluded from the selected package's lexical mutation inventory; an agent may still follow application imports across that boundary.", root),
@@ -286827,16 +287040,16 @@ function localDiscoveryStep(state) {
     fact("application.databaseSchemaEvidence", uniqueDatabaseColumns, "filesystem", "Conservative database-column evidence derived from application-owned CREATE TABLE statements. Database catalogs remain authoritative.", envRoot, "medium"),
     fact("application.transactionalRequirements", uniqueRequirements, "filesystem", "Transaction shapes whose atomic predicates or exact RETURNING rows must be preserved.", envRoot, "medium"),
     fact("application.compatibilityDisposition", state.compatibility, "inference", "Compared database and transaction evidence with the current canonical Ablo contracts.", envRoot, uniqueDatabaseColumns.length > 0 ? "medium" : "low"),
-    fact("application.localSchemaDigest", state.localSchemaDigest, "filesystem", state.localSchemaDigest ? "SHA-256 of the local schema source file." : "No local ablo/schema.ts was found.", (0, import_node_path2.relative)(root, localSchemaPath))
+    fact("application.localSchemaDigest", state.localSchemaDigest, "filesystem", state.localSchemaDigest ? "SHA-256 of the local schema source file." : "No local ablo/schema.ts was found.", (0, import_node_path3.relative)(root, localSchemaPath))
   ];
   const applicationChoices = candidates.map(({ manifest, frameworks, dataAccess }) => ({
-    value: (0, import_node_path2.relative)(root, manifest.root) || ".",
-    label: manifest.name ?? ((0, import_node_path2.relative)(root, manifest.root) || "."),
+    value: (0, import_node_path3.relative)(root, manifest.root) || ".",
+    label: manifest.name ?? ((0, import_node_path3.relative)(root, manifest.root) || "."),
     consequence: `Setup will modify only this ${[...frameworks, ...dataAccess].join("/")} application.`
   }));
-  if (state.applicationRoot && !applicationChoices.some(({ value }) => value === ((0, import_node_path2.relative)(root, state.applicationRoot) || "."))) {
+  if (state.applicationRoot && !applicationChoices.some(({ value }) => value === ((0, import_node_path3.relative)(root, state.applicationRoot) || "."))) {
     applicationChoices.push({
-      value: (0, import_node_path2.relative)(root, state.applicationRoot) || ".",
+      value: (0, import_node_path3.relative)(root, state.applicationRoot) || ".",
       label: state.packageName ?? ".",
       consequence: "Setup will treat this package as the application root; framework support remains unconfirmed."
     });
@@ -286847,7 +287060,7 @@ function localDiscoveryStep(state) {
       question: "Which application should Ablo set up?",
       status: state.applicationRoot ? "resolved" : "unresolved",
       choices: applicationChoices,
-      ...state.applicationRoot ? { selected: (0, import_node_path2.relative)(root, state.applicationRoot) || "." } : {},
+      ...state.applicationRoot ? { selected: (0, import_node_path3.relative)(root, state.applicationRoot) || "." } : {},
       reason: state.applicationRoot ? dataApplications.length === 1 ? "Exactly one runnable package owns database access, so it is the coordination boundary." : runtimeOwners.length === 1 ? "Exactly one package owns a concrete runtime entrypoint, so it is the application boundary." : "The repository has one unambiguous application target." : "More than one or no runnable application was identified."
     },
     {
@@ -287197,7 +287410,7 @@ function parseSetupArgs(args) {
     if (arg === "--root") {
       const next = args[index + 1];
       if (!next || next.startsWith("-")) {
-        throw new import_errors16.AbloValidationError("`--root` requires a directory.", {
+        throw new import_errors17.AbloValidationError("`--root` requires a directory.", {
           code: "cli_invalid_arguments"
         });
       }
@@ -287206,7 +287419,7 @@ function parseSetupArgs(args) {
       continue;
     }
     if (!allowedFlags.has(arg)) {
-      throw new import_errors16.AbloValidationError(`Unknown setup option: ${arg}`, {
+      throw new import_errors17.AbloValidationError(`Unknown setup option: ${arg}`, {
         code: "cli_invalid_arguments"
       });
     }
@@ -287292,7 +287505,7 @@ function renderHumanPlan(plan) {
 async function runSetup(args) {
   const options = parseSetupArgs(args);
   if (options.json && !options.plan) {
-    throw new import_errors16.AbloValidationError(
+    throw new import_errors17.AbloValidationError(
       "`--json` is a plan renderer. Use `ablo setup --plan --json`.",
       { code: "cli_invalid_arguments" }
     );
@@ -287306,11 +287519,13 @@ async function runSetup(args) {
 }
 
 // src/commands.ts
+init_theme();
 var CORE_GROUPS = ["Start", "Every day", "More"];
 var FULL_GROUPS = [
   "Set up",
   "Your database",
   "Your schema",
+  "Your writes",
   "Read the docs",
   "See what's happening",
   "Workspace"
@@ -287349,8 +287564,8 @@ var COMMANDS = [
     full: {
       group: "Set up",
       rows: [
-        { run: "login", does: "Authorize in your browser \u2014 stores one mk_ management credential" },
-        { run: "login --project <slug>", does: "Same, for one project \u2014 it becomes active" }
+        { run: "login", does: "Authorize in your browser, pick a project \u2014 stores its mk_ management credential" },
+        { run: "login --project <slug>", does: "Same, without the picker \u2014 the named project becomes active" }
       ]
     }
   },
@@ -287441,6 +287656,28 @@ var COMMANDS = [
       ]
     }
   },
+  {
+    name: "claims",
+    core: {
+      group: "Every day",
+      does: "Say what you are editing, so another writer waits instead of clobbering it"
+    },
+    full: {
+      group: "Your writes",
+      rows: [
+        { run: "claims acquire <model> <id>", does: "Take the lease on one row" },
+        { run: "claims acquire <model> <id> -- <cmd>", does: "Hold it only while <cmd> runs, then release" },
+        { run: "claims acquire <model> <id> --queue", does: "Wait in line when it is held, instead of failing" },
+        { run: "claims acquire <model> <id> --ttl 5m", does: "Lease length: 30s, 5m, 2h (default 60s)" },
+        { run: "claims acquire <model> <id> --description <t>", does: "What you are doing, shown to whoever waits" },
+        { run: "claims release <model> <id>", does: "Give the lease back" },
+        { run: "claims heartbeat <model> <id>", does: "Extend a lease you already hold" },
+        { run: "claims list [<model> [<id>]]", does: "Who holds what, and who waits" },
+        { run: "claims list --actor <id>", does: "Narrow a listing to one holder" },
+        { run: "claims list --json", does: "Same, machine-readable" }
+      ]
+    }
+  },
   {
     name: "generate",
     full: {
@@ -287586,7 +287823,9 @@ var REDIRECTS = /* @__PURE__ */ new Map([
   ["disconnect", "connect deregister"],
   ["deregister", "connect deregister"],
   ["register", "connect register"],
-  ["rotate", "connect rotate"]
+  ["rotate", "connect rotate"],
+  ["claim", "claims acquire"],
+  ["release", "claims release"]
 ]);
 function editDistance(a, b4) {
   const cols = b4.length + 1;
@@ -287623,7 +287862,22 @@ function suggestCommand(raw) {
   return REDIRECTS.get(best.name) ?? best.name;
 }
 function usageFor(name) {
-  return BY_NAME.get(name)?.usage;
+  const command = BY_NAME.get(name);
+  if (command === void 0) return void 0;
+  if (command.usage !== void 0) return command.usage;
+  const rows = command.full?.rows ?? [];
+  const described = rows.filter((row) => row.does !== void 0);
+  if (described.length === 0) return void 0;
+  const width = Math.max(...described.map((row) => row.run.length)) + 2;
+  const headline = command.core?.does;
+  return [
+    `  ${brand(`ablo ${name}`)}${headline !== void 0 ? ` \u2014 ${headline}` : ""}`,
+    "",
+    ...rows.map(
+      (row) => row.does === void 0 ? `       ${row.run}` : `  ablo ${row.run.padEnd(width)}${row.does}`
+    ),
+    ""
+  ].join("\n");
 }
 function coreRows(group) {
   return ALL.filter((c) => c.core?.group === group).map((c) => ({
@@ -287636,16 +287890,16 @@ function fullRows(group) {
 }
 
 // src/index.ts
-var import_errors25 = require("@abloatai/transaction/errors");
+var import_errors26 = require("@abloatai/transaction/errors");
 init_push();
 
 // src/generate.ts
 init_cjs_shims();
-var import_errors17 = require("@abloatai/transaction/errors");
+var import_errors18 = require("@abloatai/transaction/errors");
 var import_fs8 = require("fs");
 var import_path6 = require("path");
 var import_picocolors20 = __toESM(require_picocolors(), 1);
-var import_schema7 = require("@abloatai/transaction/schema");
+var import_schema6 = require("@abloatai/transaction/schema");
 init_push();
 var DEFAULT_SCHEMA_PATH4 = "ablo/schema.ts";
 var DEFAULT_EXPORT3 = "schema";
@@ -287667,7 +287921,7 @@ function parseGenerateArgs(argv) {
         out = argv[++i] ?? out;
         break;
       default:
-        throw new import_errors17.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors18.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, out };
@@ -287683,8 +287937,8 @@ async function generate(argv) {
   let source;
   try {
     const schema = await loadSchema(args.schemaPath, args.exportName);
-    const schemaJson = JSON.parse((0, import_schema7.serializeSchema)(schema));
-    source = (0, import_schema7.generateTypes)(schemaJson);
+    const schemaJson = JSON.parse((0, import_schema6.serializeSchema)(schema));
+    source = (0, import_schema6.generateTypes)(schemaJson);
   } catch (err) {
     console.error(import_picocolors20.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
@@ -287700,9 +287954,10 @@ init_cjs_shims();
 var import_child_process2 = require("child_process");
 var import_picocolors21 = __toESM(require_picocolors(), 1);
 init_dist2();
-var import_errors18 = require("@abloatai/transaction/errors");
-var import_wire8 = require("@abloatai/transaction/wire");
+var import_errors19 = require("@abloatai/transaction/errors");
+var import_wire9 = require("@abloatai/transaction/wire");
 init_config();
+init_projects();
 init_theme();
 var CLIENT_ID = "ablo-cli";
 var stripSlash = (u2) => u2.replace(/\/+$/, "");
@@ -287728,11 +287983,52 @@ function parseSlugFlag(argv, flag2) {
   const eq = argv.find((a) => a.startsWith(`${flag2}=`));
   return eq ? eq.slice(flag2.length + 1) || void 0 : void 0;
 }
+function projectSlugOrDefault(slug) {
+  return slug === DEFAULT_PROFILE ? void 0 : slug;
+}
+async function listProjectsForSession(accessToken) {
+  const res = await fetch(`${DASHBOARD_URL}/api/cli/projects`, {
+    headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" }
+  }).catch(() => null);
+  if (!res) return { ok: false, reason: `${DASHBOARD_URL} could not be reached` };
+  return projectListResult(res.status, await res.json().catch(() => null));
+}
+async function pickProject(accessToken) {
+  const active = getActiveProject();
+  const s = Y2();
+  s.start("Listing projects\u2026");
+  const listed = await listProjectsForSession(accessToken);
+  if (!listed.ok) {
+    const fallback = projectSlugOrDefault(active?.slug);
+    s.stop(
+      `Couldn't list projects (${listed.reason}); continuing with ${fallback ? `project ${import_picocolors21.default.bold(fallback)}` : "the organization default"}.`
+    );
+    return fallback;
+  }
+  if (listed.projects.every((p2) => p2.default)) {
+    s.stop("One project, the organization default.");
+    return void 0;
+  }
+  s.stop(`${listed.projects.length} projects`);
+  const current = active ? listed.projects.find((p2) => p2.id === active.id) : void 0;
+  const choice = await ve({
+    message: "Project",
+    options: listed.projects.map((p2) => {
+      const hint = projectDisplayName(p2) ?? (p2.default ? "organization default" : void 0);
+      return { value: p2, label: p2.slug, ...hint ? { hint } : {} };
+    }),
+    ...current ? { initialValue: current } : {}
+  });
+  if (pD(choice)) {
+    xe("Cancelled.");
+    process.exit(0);
+  }
+  return choice.default ? void 0 : choice.slug;
+}
 async function deviceLogin(argv, deps = {}) {
   const openUrl = deps.openUrl ?? openBrowser;
   Ie(`${brand("ablo")} login`);
-  const requested = parseSlugFlag(argv, "--project") ?? getActiveProject()?.slug;
-  const targetProject = requested === DEFAULT_PROFILE ? void 0 : requested;
+  const flagged = parseSlugFlag(argv, "--project");
   const targetOrg = parseSlugFlag(argv, "--org");
   const interactive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
   let account = "login";
@@ -287811,30 +288107,33 @@ ${import_picocolors21.default.dim(url)}`, "Approve in your browser");
     s.stop("Timed out waiting for approval.");
     process.exit(1);
   }
-  s.message(
+  s.stop("Approved.");
+  const targetProject = flagged !== void 0 ? projectSlugOrDefault(flagged) : interactive ? await pickProject(accessToken) : projectSlugOrDefault(getActiveProject()?.slug);
+  const mint = Y2();
+  mint.start(
     targetProject ? `Provisioning project access for ${targetProject}\u2026` : "Provisioning project access\u2026"
   );
   const provRes = await fetch(`${DASHBOARD_URL}/api/cli/provision-key`, {
     method: "POST",
     headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-    // Scope the minted keys to the chosen project (`--project`/active), with
-    // the device_code as a legacy fallback for the /cli picker. Both harmless
-    // if absent → org-default keys.
+    // Scope the minted keys to the chosen project, with the device_code as a
+    // legacy fallback for the /cli picker. Both harmless if absent →
+    // org-default keys.
     body: JSON.stringify({
       device_code: code.device_code,
       ...targetProject ? { project_slug: targetProject } : {}
     })
   }).catch(() => null);
   if (!provRes) {
-    s.stop("Could not provision a key.");
+    mint.stop("Could not provision a key.");
     M2.error(
       `Could not reach ${DASHBOARD_URL} to finish the handoff. Check your connection and run \`ablo login\` again.`
     );
     process.exit(1);
   }
   if (!provRes.ok) {
-    s.stop("Could not provision a key.");
-    const err = (0, import_errors18.translateHttpError)(
+    mint.stop("Could not provision a key.");
+    const err = (0, import_errors19.translateHttpError)(
       provRes.status,
       await provRes.json().catch(() => null),
       provRes.headers.get("x-request-id") ?? void 0
@@ -287851,11 +288150,11 @@ ${import_picocolors21.default.dim(url)}`, "Approve in your browser");
     }
     process.exit(1);
   }
-  const parsedProv = import_wire8.provisionKeyResponseSchema.safeParse(
+  const parsedProv = import_wire9.provisionKeyResponseSchema.safeParse(
     await provRes.json().catch(() => null)
   );
   if (!parsedProv.success) {
-    s.stop("Could not provision a key.");
+    mint.stop("Could not provision a key.");
     M2.error("The key handoff returned something this version does not recognize.");
     M2.error(`Try again, or upgrade with ${import_picocolors21.default.bold("npm i -g @abloatai/ablo")}.`);
     process.exit(1);
@@ -287880,7 +288179,7 @@ ${import_picocolors21.default.dim(url)}`, "Approve in your browser");
     },
     { mode: "sandbox", activeProject: prov.project ?? void 0 }
   );
-  s.stop(`Saved project credential to ${path}`);
+  mint.stop(`Saved project credential to ${path}`);
   const orgLabel = prov.organizationSlug ? ` to ${import_picocolors21.default.bold(prov.organizationSlug)}` : "";
   const where = prov.project ? ` ${import_picocolors21.default.dim(`(project ${prov.project.slug})`)}` : "";
   Se(
@@ -287897,10 +288196,10 @@ function logout() {
   } else {
     console.log(`  ${import_picocolors21.default.dim("\u25CB")} Not logged in \u2014 nothing to remove.`);
   }
-  if (process.env.ABLO_MANAGEMENT_KEY) {
+  if (process.env.ABLO_API_KEY?.startsWith("mk_")) {
     console.log(
       import_picocolors21.default.dim(
-        `  Note: ${import_picocolors21.default.bold("ABLO_MANAGEMENT_KEY")} is still set in this shell and takes precedence.`
+        `  Note: ${import_picocolors21.default.bold("ABLO_API_KEY")} still contains an ${import_picocolors21.default.bold("mk_")} credential in this shell and takes precedence.`
       )
     );
   }
@@ -287916,7 +288215,6 @@ init_config();
 init_target();
 init_theme();
 init_controlPlane();
-var import_schema8 = require("@abloatai/transaction/coordination/schema");
 init_readiness();
 function expiryLabel(iso) {
   const ms = Date.parse(iso) - Date.now();
@@ -287939,13 +288237,6 @@ async function ping2(apiUrl3) {
     clearTimeout(t);
   }
 }
-function formatConflict(conflict) {
-  if (!conflict) return "";
-  const parts = import_schema8.participantKindSchema.options.flatMap(
-    (k3) => conflict[k3] ? [`${k3}:${conflict[k3]}`] : []
-  );
-  return parts.length ? `{${parts.join(",")}}` : "";
-}
 function printTargetLines(target, localProject, storedOrganizationId, storedOrganizationSlug) {
   const confirmed = target?.confirmed ?? null;
   const org = confirmed?.organizationId ?? storedOrganizationId;
@@ -288166,9 +288457,7 @@ async function status(args = []) {
       );
       for (const m2 of pushed.models) {
         const tn = m2.typename === m2.key ? import_picocolors22.default.dim(`typename=${m2.typename}`) : import_picocolors22.default.yellow(`typename=${m2.typename}`);
-        const conflict = formatConflict(m2.conflict);
-        const conflictStr2 = conflict ? `  ${import_picocolors22.default.dim(`conflict=${conflict}`)}` : "";
-        console.log(`          ${import_picocolors22.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}${conflictStr2}`);
+        console.log(`          ${import_picocolors22.default.dim("\u2022")} ${m2.key.padEnd(14)} ${tn}`);
       }
     } else if (pushed && !pushed.active) {
       console.log(
@@ -288210,8 +288499,8 @@ async function status(args = []) {
 
 // src/logs.ts
 init_cjs_shims();
-var import_errors19 = require("@abloatai/transaction/errors");
-var import_wire9 = require("@abloatai/transaction/wire");
+var import_errors20 = require("@abloatai/transaction/errors");
+var import_wire10 = require("@abloatai/transaction/wire");
 var import_picocolors23 = __toESM(require_picocolors(), 1);
 init_config();
 init_theme();
@@ -288252,12 +288541,12 @@ function parseLogsArgs(argv) {
         args.json = true;
         break;
       case "--mode":
-        throw new import_errors19.AbloValidationError(
+        throw new import_errors20.AbloValidationError(
           "--mode was removed. Logs follow the branch bound to ABLO_API_KEY; select a different branch by supplying its key.",
           { code: "cli_invalid_arguments" }
         );
       default:
-        throw new import_errors19.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors20.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return args;
@@ -288322,7 +288611,7 @@ async function logs(argv) {
     const json = await res.json();
     return {
       events: json.data ?? json.events ?? [],
-      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire9.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire9.formatFeedCursor)(import_wire9.FEED_CURSOR_START))
+      cursor: json.next_cursor ?? (json.cursor != null ? (0, import_wire10.formatFeedCursor)({ log: json.cursor, claims: 0 }) : (0, import_wire10.formatFeedCursor)(import_wire10.FEED_CURSOR_START))
     };
   }
   if (!args.json) {
@@ -288354,9 +288643,9 @@ async function logs(argv) {
     });
     if (!page) continue;
     for (const e2 of page.events) render2(e2, args.json);
-    const prev = (0, import_wire9.parseFeedCursor)(cursor);
-    const next = (0, import_wire9.parseFeedCursor)(page.cursor);
-    if (prev && next && (0, import_wire9.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
+    const prev = (0, import_wire10.parseFeedCursor)(cursor);
+    const next = (0, import_wire10.parseFeedCursor)(page.cursor);
+    if (prev && next && (0, import_wire10.feedCursorAdvanced)(prev, next)) cursor = page.cursor;
   }
 }
 
@@ -288536,10 +288825,10 @@ async function webhooks(argv) {
 
 // src/check.ts
 init_cjs_shims();
-var import_errors20 = require("@abloatai/transaction/errors");
+var import_errors21 = require("@abloatai/transaction/errors");
 var import_picocolors25 = __toESM(require_picocolors(), 1);
 init_src();
-var import_schema9 = require("@abloatai/transaction/schema");
+var import_schema8 = require("@abloatai/transaction/schema");
 init_push();
 
 // src/schemaIr.ts
@@ -288614,14 +288903,15 @@ function emitSchemaSource(schema, importPath) {
 
 // src/schemaSource.ts
 init_cjs_shims();
+var import_schema7 = require("@abloatai/transaction/schema");
 var TENANCY_COLUMN = "organization_id";
-var BASE_FIELDS = /* @__PURE__ */ new Set(["id", "organizationId", "createdBy", "createdAt", "updatedAt"]);
+var BASE_FIELDS = /* @__PURE__ */ new Set([
+  ...import_schema7.BASE_FIELDS,
+  "organizationId"
+]);
 var BASE_COLUMNS = /* @__PURE__ */ new Set([
-  "id",
-  "organization_id",
-  "created_by",
-  "created_at",
-  "updated_at"
+  ...import_schema7.BASE_FIELDS.map(camelToSnake),
+  TENANCY_COLUMN
 ]);
 function fieldNameForColumn(column) {
   const camel2 = column.replace(/_([a-z0-9])/g, (_3, c) => c.toUpperCase());
@@ -288684,7 +288974,7 @@ function parseCheckArgs(argv) {
         appSchema = argv[++i] ?? appSchema;
         break;
       default:
-        throw new import_errors20.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors21.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { schemaPath, exportName, appSchema };
@@ -288766,7 +289056,10 @@ async function check(argv) {
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
-  const schemaJson = JSON.parse((0, import_schema9.serializeSchema)(schema));
+  const schemaJson = JSON.parse((0, import_schema8.serializeSchema)(schema));
+  const accessFindings = new Map(
+    (0, import_schema8.auditSchemaAccessPolicies)(schemaJson).map((finding) => [finding.model, finding])
+  );
   console.log(`
   ${brand("ablo")} ${import_picocolors25.default.dim("check")}  ${import_picocolors25.default.dim(`schema "${args.appSchema}"`)}
 `);
@@ -288807,8 +289100,14 @@ async function check(argv) {
     }
     const problems = [];
     const warns = [];
+    const accessFinding = accessFindings.get(key);
+    if (accessFinding) {
+      problems.push(
+        `[${accessFinding.code}] ${accessFinding.message} Fix: ${accessFinding.fix}`
+      );
+    }
     if (!present.has("id")) problems.push('missing primary key "id"');
-    const orgCol = (0, import_schema9.tenancyColumn)((0, import_schema9.resolveTenancy)(model));
+    const orgCol = (0, import_schema8.tenancyColumn)((0, import_schema8.resolveTenancy)(model));
     if (orgCol && !present.has(orgCol)) {
       problems.push(
         `missing "${orgCol}" \u2014 Ablo isolates tenants (RLS) and routes realtime by it, so a table without it has no safe boundary. Add the column, or use a Data Source endpoint.`
@@ -288858,9 +289157,244 @@ async function check(argv) {
   process.exit(errors > 0 ? 1 : 0);
 }
 
-// src/upgrade.ts
+// src/claims.ts
 init_cjs_shims();
+var import_node_child_process3 = require("child_process");
 var import_picocolors26 = __toESM(require_picocolors(), 1);
+var import_contract = require("@abloatai/transaction/claims/contract");
+var import_routes = require("@abloatai/transaction/claims/routes");
+init_controlPlane();
+init_config();
+function requireRuntimeKey() {
+  const { key } = resolveRuntimeApiKey();
+  if (!key) {
+    console.error(
+      import_picocolors26.default.red("  No runtime credential.") + import_picocolors26.default.dim(
+        ` Run ${import_picocolors26.default.bold("npx ablo login")}, or set ${import_picocolors26.default.bold("ABLO_API_KEY")} to a runtime key.`
+      )
+    );
+    process.exit(1);
+  }
+  return key;
+}
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["--ttl", "--description", "--actor"]);
+function flagValue(argv, name) {
+  const at = argv.indexOf(`--${name}`);
+  return at === -1 ? void 0 : argv[at + 1];
+}
+function parseFlags(argv) {
+  return {
+    json: argv.includes("--json") || process.env.ABLO_JSON === "1",
+    queue: argv.includes("--queue"),
+    ttl: flagValue(argv, "ttl"),
+    description: flagValue(argv, "description"),
+    actor: flagValue(argv, "actor")
+  };
+}
+function splitAtCommand(argv) {
+  const at = argv.indexOf("--");
+  return at === -1 ? { args: argv, command: [] } : { args: argv.slice(0, at), command: argv.slice(at + 1) };
+}
+function positionals(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === void 0) continue;
+    if (VALUE_FLAGS.has(arg)) {
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    out.push(arg);
+  }
+  return out;
+}
+async function acquireClaim(model, id, flags, apiKey) {
+  return requestControlPlane({
+    path: (0, import_routes.claimOnModelPath)({ model, id }),
+    method: "POST",
+    apiKey,
+    body: {
+      ...flags.ttl !== void 0 ? { ttl: flags.ttl } : {},
+      ...flags.description !== void 0 ? { description: flags.description } : {},
+      ...flags.queue ? { queue: true } : {}
+    },
+    responseSchema: import_contract.claimAcquireResponseSchema
+  });
+}
+async function releaseClaim(model, id, apiKey) {
+  const reply = await requestControlPlane({
+    path: (0, import_routes.claimOnModelPath)({ model, id }),
+    method: "DELETE",
+    apiKey,
+    responseSchema: import_contract.claimReleaseReplySchema
+  });
+  return reply.released;
+}
+async function beat(model, id, ttl, apiKey) {
+  await requestControlPlane({
+    path: (0, import_routes.claimHeartbeatOnModelPath)({ model, id }),
+    method: "POST",
+    apiKey,
+    body: ttl !== void 0 ? { ttl } : {},
+    responseSchema: import_contract.claimHeartbeatReplySchema
+  });
+}
+async function pollClaim(claimId, apiKey) {
+  return requestControlPlane({
+    path: (0, import_routes.claimByIdPath)(claimId),
+    apiKey,
+    responseSchema: import_contract.claimStateSchema
+  });
+}
+async function waitForGrant(claimId, ttl, apiKey) {
+  const everyMs = Math.max(1e3, Math.floor((0, import_contract.claimTtlMs)(ttl) / 4));
+  for (; ; ) {
+    await new Promise((resolve11) => setTimeout(resolve11, everyMs));
+    const state = await pollClaim(claimId, apiKey);
+    if (state.status === "active") return;
+    if (state.status !== "queued") {
+      throw new Error(`the wait ended without the lease (${state.status})`);
+    }
+  }
+}
+function describeAcquired(model, id, granted) {
+  if (granted.status === "queued") {
+    const ahead = granted.position;
+    return `  ${import_picocolors26.default.yellow("\xB7")} Waiting for ${import_picocolors26.default.bold(`${model} ${id}`)}. ` + import_picocolors26.default.dim(ahead === 0 ? "Next in line." : `${ahead} ahead of you.`);
+  }
+  return `  ${import_picocolors26.default.green("\u2713")} Holding ${import_picocolors26.default.bold(`${model} ${id}`)}.`;
+}
+async function holdWhile(model, id, flags, apiKey, command) {
+  const granted = await acquireClaim(model, id, flags, apiKey);
+  if (granted.status === "queued") {
+    if (!flags.json) console.error(describeAcquired(model, id, granted));
+    await waitForGrant(granted.id, flags.ttl, apiKey);
+  }
+  if (!flags.json) console.error(`  ${import_picocolors26.default.green("\u2713")} Holding ${import_picocolors26.default.bold(`${model} ${id}`)}.`);
+  const everyMs = Math.max(1e3, Math.floor((0, import_contract.claimTtlMs)(flags.ttl) / 3));
+  const timer2 = setInterval(() => {
+    void beat(model, id, flags.ttl, apiKey).catch(() => {
+    });
+  }, everyMs);
+  let released = false;
+  const giveBack = async () => {
+    if (released) return;
+    released = true;
+    clearInterval(timer2);
+    try {
+      await releaseClaim(model, id, apiKey);
+    } catch {
+    }
+  };
+  const [head, ...rest] = command;
+  if (head === void 0) {
+    await giveBack();
+    throw new Error("no command was given after `--`");
+  }
+  const code = await new Promise((resolve11) => {
+    const child = (0, import_node_child_process3.spawn)(head, rest, { stdio: "inherit" });
+    const forward = (signal) => {
+      child.kill(signal);
+    };
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    child.on("error", () => {
+      process.off("SIGINT", forward);
+      process.off("SIGTERM", forward);
+      resolve11(127);
+    });
+    child.on("close", (status2) => {
+      process.off("SIGINT", forward);
+      process.off("SIGTERM", forward);
+      resolve11(status2 ?? 1);
+    });
+  });
+  await giveBack();
+  if (!flags.json) console.error(`  ${import_picocolors26.default.dim("\xB7")} ${import_picocolors26.default.dim(`Released ${model} ${id}.`)}`);
+  return code;
+}
+function renderList(rows) {
+  if (rows.length === 0) {
+    console.log(`  ${import_picocolors26.default.dim("Nothing is held right now.")}`);
+    return;
+  }
+  const held = rows.filter((row) => row.status !== "queued").length;
+  const waiting = rows.length - held;
+  console.log();
+  for (const row of rows) {
+    const where = `${row.target.model} ${row.target.id}`;
+    const state = row.status === "queued" ? import_picocolors26.default.yellow(row.position === void 0 ? "waiting" : `waiting (${row.position} ahead)`) : import_picocolors26.default.green("held");
+    console.log(
+      `  ${import_picocolors26.default.bold(where.padEnd(28))} ${state.padEnd(28)} ${import_picocolors26.default.dim(row.description ?? row.actor)}`
+    );
+  }
+  console.log();
+  console.log(import_picocolors26.default.dim(`  ${held} held, ${waiting} waiting.`));
+  console.log();
+}
+async function claims(argv = []) {
+  const { args, command } = splitAtCommand(argv);
+  const flags = parseFlags(args);
+  const [verb, ...rest] = positionals(args);
+  if (verb === void 0 || verb === "help" || args.includes("--help")) {
+    console.log(usageFor("claims"));
+    return;
+  }
+  const apiKey = requireRuntimeKey();
+  if (verb === "list") {
+    const [model2, id2] = rest;
+    const query = new URLSearchParams();
+    if (model2 !== void 0) query.set("model", model2);
+    if (id2 !== void 0) query.set("id", id2);
+    if (flags.actor !== void 0) query.set("actorId", flags.actor);
+    const suffix = query.toString();
+    const page = await requestControlPlane({
+      path: `${import_routes.CLAIM_ROUTES.collection}${suffix ? `?${suffix}` : ""}`,
+      apiKey,
+      responseSchema: import_contract.claimListResponseSchema
+    });
+    if (flags.json) console.log(JSON.stringify(page, null, 2));
+    else renderList(page.data);
+    return;
+  }
+  const [model, id] = rest;
+  if (model === void 0 || id === void 0) {
+    console.error(`  ${import_picocolors26.default.red("\u2717")} Name the row: ${import_picocolors26.default.bold(`ablo claims ${verb} <model> <id>`)}.`);
+    process.exitCode = 1;
+    return;
+  }
+  if (verb === "acquire") {
+    if (command.length > 0) {
+      process.exitCode = await holdWhile(model, id, flags, apiKey, command);
+      return;
+    }
+    const granted = await acquireClaim(model, id, flags, apiKey);
+    if (flags.json) console.log(JSON.stringify(granted, null, 2));
+    else console.log(describeAcquired(model, id, granted));
+    return;
+  }
+  if (verb === "release") {
+    const released = await releaseClaim(model, id, apiKey);
+    if (flags.json) console.log(JSON.stringify({ object: "claim_release", released }, null, 2));
+    else if (released) console.log(`  ${import_picocolors26.default.green("\u2713")} Released ${import_picocolors26.default.bold(`${model} ${id}`)}.`);
+    else console.log(`  ${import_picocolors26.default.dim("\xB7")} ${import_picocolors26.default.dim(`You were not holding ${model} ${id}.`)}`);
+    return;
+  }
+  if (verb === "heartbeat") {
+    await beat(model, id, flags.ttl, apiKey);
+    if (flags.json) console.log(JSON.stringify({ object: "claim_heartbeat", ok: true }, null, 2));
+    else console.log(`  ${import_picocolors26.default.green("\u2713")} Still holding ${import_picocolors26.default.bold(`${model} ${id}`)}.`);
+    return;
+  }
+  console.error(`  ${import_picocolors26.default.red("\u2717")} Unknown: ${import_picocolors26.default.bold(`ablo claims ${verb}`)}.`);
+  console.error(usageFor("claims"));
+  process.exitCode = 1;
+}
+
+// src/upgrade.ts
+init_cjs_shims();
+var import_picocolors27 = __toESM(require_picocolors(), 1);
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 var DEFAULT_GLOBS = ["app/**/*.{ts,tsx}", "src/**/*.{ts,tsx}", "ablo/**/*.{ts,tsx}", "lib/**/*.{ts,tsx}"];
 var VERB_ARGS = {
@@ -288902,12 +289436,14 @@ function verbRewrite(call, verb) {
   const args = call.getArguments();
   const first = args[0];
   if (first === void 0) return null;
-  const calleeText = call.getExpression().getText();
+  const calleeText = verb === "retrieve" ? `${call.getExpression().getText().slice(0, -"retrieve".length)}get` : call.getExpression().getText();
   if (verb === "create") {
     if (import_ts_morph.Node.isObjectLiteralExpression(first) && hasKey2(first, "data")) return null;
     return `${calleeText}({ data: ${first.getText()}${spreadOpts(args[1])} })`;
   }
-  if (import_ts_morph.Node.isObjectLiteralExpression(first)) return null;
+  if (import_ts_morph.Node.isObjectLiteralExpression(first)) {
+    return verb === "retrieve" ? `${calleeText}(${first.getText()})` : null;
+  }
   const keyed = params.map((key, i) => args[i] ? `${key}: ${args[i].getText()}` : null).filter(Boolean);
   return `${calleeText}({ ${keyed.join(", ")}${spreadOpts(args[params.length])} })`;
 }
@@ -288923,7 +289459,7 @@ function loadRewrite(call) {
       if (import_ts_morph.Node.isObjectLiteralExpression(whereVal)) {
         const idProp = whereVal.getProperty("id");
         if (idProp && whereVal.getProperties().length === 1 && import_ts_morph.Node.isPropertyAssignment(idProp)) {
-          return `${base}.retrieve({ id: ${idProp.getInitializerOrThrow().getText()} })`;
+          return `${base}.get({ id: ${idProp.getInitializerOrThrow().getText()} })`;
         }
       }
       return `${base}.list({ where: ${whereVal.getText()} })`;
@@ -288938,7 +289474,7 @@ async function upgrade(argv) {
   project.addSourceFilesAtPaths(globs.length > 0 ? globs : DEFAULT_GLOBS);
   const files = project.getSourceFiles();
   if (files.length === 0) {
-    console.log(import_picocolors26.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
+    console.log(import_picocolors27.default.yellow('  No .ts/.tsx files found. Pass a glob, e.g. `ablo upgrade "src/**/*.tsx"`.'));
     return;
   }
   const edits = [];
@@ -288986,7 +289522,7 @@ async function upgrade(argv) {
       } else if (method === "load") {
         const next = loadRewrite(call);
         if (next) {
-          record(call, "load\u2192retrieve/list", (call.getText().split("\n")[0] ?? "").slice(0, 80), next.slice(0, 80));
+          record(call, "load\u2192get/list", (call.getText().split("\n")[0] ?? "").slice(0, 80), next.slice(0, 80));
           call.replaceWithText(next);
         }
       }
@@ -289012,39 +289548,39 @@ async function upgrade(argv) {
   const rel = (f) => f.replace(cwd + "/", "");
   console.log();
   if (edits.length === 0 && manual.length === 0) {
-    console.log(import_picocolors26.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
+    console.log(import_picocolors27.default.green("  \u2713 Nothing to migrate \u2014 your code is already on the current API."));
     return;
   }
   if (edits.length > 0) {
-    console.log(import_picocolors26.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
+    console.log(import_picocolors27.default.bold(`  ${write ? "Applied" : "Would apply"} ${edits.length} change${edits.length === 1 ? "" : "s"}:`));
     for (const e2 of edits) {
-      console.log(`    ${import_picocolors26.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors26.default.cyan(e2.rule)}`);
-      console.log(`      ${import_picocolors26.default.red("-")} ${e2.before}`);
-      console.log(`      ${import_picocolors26.default.green("+")} ${e2.after}`);
+      console.log(`    ${import_picocolors27.default.dim(`${rel(e2.file)}:${e2.line}`)}  ${import_picocolors27.default.cyan(e2.rule)}`);
+      console.log(`      ${import_picocolors27.default.red("-")} ${e2.before}`);
+      console.log(`      ${import_picocolors27.default.green("+")} ${e2.after}`);
     }
   }
   if (manual.length > 0) {
     console.log();
-    console.log(import_picocolors26.default.bold(import_picocolors26.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
+    console.log(import_picocolors27.default.bold(import_picocolors27.default.yellow(`  ${manual.length} spot${manual.length === 1 ? "" : "s"} need manual review (structural):`)));
     for (const m2 of manual) {
-      console.log(`    ${import_picocolors26.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors26.default.yellow(m2.rule)}`);
-      console.log(`      ${import_picocolors26.default.dim(m2.snippet)}`);
+      console.log(`    ${import_picocolors27.default.dim(`${rel(m2.file)}:${m2.line}`)}  ${import_picocolors27.default.yellow(m2.rule)}`);
+      console.log(`      ${import_picocolors27.default.dim(m2.snippet)}`);
       console.log(`      \u2192 ${m2.hint}`);
     }
   }
   console.log();
   if (write) {
     await project.save();
-    console.log(import_picocolors26.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
+    console.log(import_picocolors27.default.green(`  \u2713 Wrote ${edits.length} change${edits.length === 1 ? "" : "s"}. Review the diff, run your typecheck.`));
   } else {
-    console.log(import_picocolors26.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
+    console.log(import_picocolors27.default.dim("  Dry run. Re-run with `--write` to apply the auto-fixes above (manual items are never auto-written)."));
   }
 }
 
 // src/pull.ts
 init_cjs_shims();
-var import_errors21 = require("@abloatai/transaction/errors");
-var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_errors22 = require("@abloatai/transaction/errors");
+var import_picocolors28 = __toESM(require_picocolors(), 1);
 init_src();
 var import_fs10 = require("fs");
 init_theme();
@@ -289072,7 +289608,7 @@ function parsePullArgs(argv) {
         force = true;
         break;
       default:
-        throw new import_errors21.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        throw new import_errors22.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
   return { out, appSchema, importPath, force };
@@ -289142,56 +289678,56 @@ async function pull(argv) {
   try {
     args = parsePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors27.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors28.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   const dbUrl = readProjectAdminDatabaseUrl();
   if (!dbUrl) {
     console.error(
-      import_picocolors27.default.red(`  No database.`) + import_picocolors27.default.dim(` Set ${import_picocolors27.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
+      import_picocolors28.default.red(`  No database.`) + import_picocolors28.default.dim(` Set ${import_picocolors28.default.bold(ADMIN_URL_VAR)} to the Postgres to pull from.`)
     );
     process.exit(1);
   }
   if ((0, import_fs10.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors27.default.red(`  ${args.out} already exists.`) + import_picocolors27.default.dim(` Re-run with ${import_picocolors27.default.bold("--force")} to overwrite.`)
+      import_picocolors28.default.red(`  ${args.out} already exists.`) + import_picocolors28.default.dim(` Re-run with ${import_picocolors28.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors27.default.dim("pull")}  ${import_picocolors27.default.dim(`schema "${args.appSchema}"`)}
+  ${brand("ablo")} ${import_picocolors28.default.dim("pull")}  ${import_picocolors28.default.dim(`schema "${args.appSchema}"`)}
 `);
   let result;
   try {
     result = await buildSchemaSourceFromDb({ dbUrl, appSchema: args.appSchema, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors27.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors28.default.red(`  Couldn't read the database: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors27.default.yellow(`  No adoptable tables found`) + import_picocolors27.default.dim(` (a model needs an ${import_picocolors27.default.bold("id")} + ${import_picocolors27.default.bold("organization_id")} column).`)
+      import_picocolors28.default.yellow(`  No adoptable tables found`) + import_picocolors28.default.dim(` (a model needs an ${import_picocolors28.default.bold("id")} + ${import_picocolors28.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs10.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors27.default.green("\u2713")} wrote ${import_picocolors27.default.bold(args.out)} ${import_picocolors27.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors27.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors28.default.green("\u2713")} wrote ${import_picocolors28.default.bold(args.out)} ${import_picocolors28.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors28.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors27.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors27.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors28.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors28.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors27.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors27.default.bold("ablo check")}.
+  ${import_picocolors28.default.dim("Introspection is lossy (enums, JSON shape, relations). Review the file, then")} ${import_picocolors28.default.bold("ablo check")}.
 `
   );
 }
 
 // src/prismaPull.ts
 init_cjs_shims();
-var import_errors22 = require("@abloatai/transaction/errors");
-var import_picocolors28 = __toESM(require_picocolors(), 1);
+var import_errors23 = require("@abloatai/transaction/errors");
+var import_picocolors29 = __toESM(require_picocolors(), 1);
 var import_fs11 = require("fs");
 init_theme();
 var DEFAULT_SCHEMA = "prisma/schema.prisma";
@@ -289388,7 +289924,7 @@ function parsePrismaPullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors22.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors23.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -289399,56 +289935,56 @@ async function prismaPull(argv) {
   try {
     args = parsePrismaPullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors28.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors29.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!(0, import_fs11.existsSync)(args.schema)) {
     console.error(
-      import_picocolors28.default.red(`  No Prisma schema at ${import_picocolors28.default.bold(args.schema)}.`) + import_picocolors28.default.dim(` Pass a path: ${import_picocolors28.default.bold("ablo pull prisma <path>")}.`)
+      import_picocolors29.default.red(`  No Prisma schema at ${import_picocolors29.default.bold(args.schema)}.`) + import_picocolors29.default.dim(` Pass a path: ${import_picocolors29.default.bold("ablo pull prisma <path>")}.`)
     );
     process.exit(1);
   }
   if ((0, import_fs11.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors28.default.red(`  ${args.out} already exists.`) + import_picocolors28.default.dim(` Re-run with ${import_picocolors28.default.bold("--force")} to overwrite.`)
+      import_picocolors29.default.red(`  ${args.out} already exists.`) + import_picocolors29.default.dim(` Re-run with ${import_picocolors29.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors28.default.dim("pull prisma")}  ${import_picocolors28.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors29.default.dim("pull prisma")}  ${import_picocolors29.default.dim(args.schema)}
 `);
   let result;
   try {
     const src = (0, import_fs11.readFileSync)(args.schema, "utf8");
     result = buildSchemaSourceFromPrisma({ src, importPath: args.importPath });
   } catch (err) {
-    console.error(import_picocolors28.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors29.default.red(`  Couldn't parse the schema: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors28.default.yellow(`  No adoptable models found`) + import_picocolors28.default.dim(` (a model needs an ${import_picocolors28.default.bold("id")} + ${import_picocolors28.default.bold("organizationId")} / ${import_picocolors28.default.bold("organization_id")}).`)
+      import_picocolors29.default.yellow(`  No adoptable models found`) + import_picocolors29.default.dim(` (a model needs an ${import_picocolors29.default.bold("id")} + ${import_picocolors29.default.bold("organizationId")} / ${import_picocolors29.default.bold("organization_id")}).`)
     );
     process.exit(1);
   }
   (0, import_fs11.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors28.default.green("\u2713")} wrote ${import_picocolors28.default.bold(args.out)} ${import_picocolors28.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors28.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors29.default.green("\u2713")} wrote ${import_picocolors29.default.bold(args.out)} ${import_picocolors29.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors29.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors28.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors28.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors29.default.dim(`${result.skipped.length} model(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors29.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors28.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors28.default.bold("ablo check")}.
+  ${import_picocolors29.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors29.default.bold("ablo check")}.
 `
   );
 }
 
 // src/drizzlePull.ts
 init_cjs_shims();
-var import_picocolors29 = __toESM(require_picocolors(), 1);
-var import_errors23 = require("@abloatai/transaction/errors");
+var import_picocolors30 = __toESM(require_picocolors(), 1);
+var import_errors24 = require("@abloatai/transaction/errors");
 var import_fs12 = require("fs");
 var import_path7 = require("path");
 init_theme();
@@ -289555,7 +290091,7 @@ function parseDrizzlePullArgs(argv) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) throw new import_errors23.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
+        if (arg.startsWith("--")) throw new import_errors24.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
         schema = arg;
     }
   }
@@ -289572,27 +290108,27 @@ async function drizzlePull(argv) {
   try {
     args = parseDrizzlePullArgs(argv);
   } catch (err) {
-    console.error(import_picocolors29.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors30.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   if (!args.schema) {
     console.error(
-      import_picocolors29.default.red(`  No Drizzle schema given.`) + import_picocolors29.default.dim(` Pass the module: ${import_picocolors29.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
+      import_picocolors30.default.red(`  No Drizzle schema given.`) + import_picocolors30.default.dim(` Pass the module: ${import_picocolors30.default.bold("ablo pull drizzle src/db/schema.ts")}.`)
     );
     process.exit(1);
   }
   if (!(0, import_fs12.existsSync)(args.schema)) {
-    console.error(import_picocolors29.default.red(`  No file at ${import_picocolors29.default.bold(args.schema)}.`));
+    console.error(import_picocolors30.default.red(`  No file at ${import_picocolors30.default.bold(args.schema)}.`));
     process.exit(1);
   }
   if ((0, import_fs12.existsSync)(args.out) && !args.force) {
     console.error(
-      import_picocolors29.default.red(`  ${args.out} already exists.`) + import_picocolors29.default.dim(` Re-run with ${import_picocolors29.default.bold("--force")} to overwrite.`)
+      import_picocolors30.default.red(`  ${args.out} already exists.`) + import_picocolors30.default.dim(` Re-run with ${import_picocolors30.default.bold("--force")} to overwrite.`)
     );
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors29.default.dim("pull drizzle")}  ${import_picocolors29.default.dim(args.schema)}
+  ${brand("ablo")} ${import_picocolors30.default.dim("pull drizzle")}  ${import_picocolors30.default.dim(args.schema)}
 `);
   let result;
   try {
@@ -289600,26 +290136,26 @@ async function drizzlePull(argv) {
     result = await buildSchemaSourceFromDrizzle({ mod, importPath: args.importPath });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors29.default.dim(` (install ${import_picocolors29.default.bold("drizzle-orm")} in this project)`) : "";
-    console.error(import_picocolors29.default.red(`  Couldn't load the schema: ${msg}`) + hint);
+    const hint = msg.includes("Cannot find package 'drizzle-orm'") ? import_picocolors30.default.dim(` (install ${import_picocolors30.default.bold("drizzle-orm")} in this project)`) : "";
+    console.error(import_picocolors30.default.red(`  Couldn't load the schema: ${msg}`) + hint);
     process.exit(1);
   }
   if (result.models.length === 0) {
     console.error(
-      import_picocolors29.default.yellow(`  No adoptable tables found`) + import_picocolors29.default.dim(` (a table needs an ${import_picocolors29.default.bold("id")} + ${import_picocolors29.default.bold("organization_id")} column).`)
+      import_picocolors30.default.yellow(`  No adoptable tables found`) + import_picocolors30.default.dim(` (a table needs an ${import_picocolors30.default.bold("id")} + ${import_picocolors30.default.bold("organization_id")} column).`)
     );
     process.exit(1);
   }
   (0, import_fs12.writeFileSync)(args.out, result.source);
-  console.log(`  ${import_picocolors29.default.green("\u2713")} wrote ${import_picocolors29.default.bold(args.out)} ${import_picocolors29.default.dim(`(${result.models.length} models)`)}`);
-  console.log(`  ${import_picocolors29.default.dim(`models: ${result.models.join(", ")}`)}`);
+  console.log(`  ${import_picocolors30.default.green("\u2713")} wrote ${import_picocolors30.default.bold(args.out)} ${import_picocolors30.default.dim(`(${result.models.length} models)`)}`);
+  console.log(`  ${import_picocolors30.default.dim(`models: ${result.models.join(", ")}`)}`);
   if (result.skipped.length > 0) {
-    console.log(`  ${import_picocolors29.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
-    for (const s of result.skipped) console.log(`    ${import_picocolors29.default.dim(`- ${s.name}: ${s.reason}`)}`);
+    console.log(`  ${import_picocolors30.default.dim(`${result.skipped.length} table(s) skipped:`)}`);
+    for (const s of result.skipped) console.log(`    ${import_picocolors30.default.dim(`- ${s.name}: ${s.reason}`)}`);
   }
   console.log(
     `
-  ${import_picocolors29.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors29.default.bold("ablo check")}.
+  ${import_picocolors30.default.dim("Enums and relations were preserved. Review the file, then")} ${import_picocolors30.default.bold("ablo check")}.
 `
   );
 }
@@ -289632,8 +290168,8 @@ init_telemetry();
 
 // src/init/options.ts
 init_cjs_shims();
-var import_node_fs4 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
 var INIT_FRAMEWORKS = ["nextjs", "vite", "remix", "vanilla"];
 var INIT_AUTHS = [
   "apikey",
@@ -289672,7 +290208,7 @@ function parseInitArgs(args) {
 function detectOrm(override, root = process.cwd()) {
   if (override === "prisma" || override === "drizzle" || override === "none") return override;
   try {
-    const pkg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path3.resolve)(root, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.resolve)(root, "package.json"), "utf8"));
     const dependencies = { ...pkg.dependencies, ...pkg.devDependencies };
     if (dependencies["@prisma/client"] || dependencies.prisma) return "prisma";
     if (dependencies["drizzle-orm"]) return "drizzle";
@@ -289681,24 +290217,24 @@ function detectOrm(override, root = process.cwd()) {
   return "none";
 }
 function detectNextLayout(root = process.cwd()) {
-  const useSrc = (0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "src", "app")) || !(0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "app")) && (0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "src"));
-  return useSrc ? { appBase: (0, import_node_path3.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
+  const useSrc = (0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "src", "app")) || !(0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "app")) && (0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "src"));
+  return useSrc ? { appBase: (0, import_node_path4.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
 }
 function detectPackageManager(root = process.cwd()) {
-  if ((0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "pnpm-lock.yaml"))) return "pnpm";
-  if ((0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "yarn.lock"))) return "yarn";
-  if ((0, import_node_fs4.existsSync)((0, import_node_path3.resolve)(root, "bun.lockb"))) return "bun";
+  if ((0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "pnpm-lock.yaml"))) return "pnpm";
+  if ((0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "yarn.lock"))) return "yarn";
+  if ((0, import_node_fs5.existsSync)((0, import_node_path4.resolve)(root, "bun.lockb"))) return "bun";
   return "npm";
 }
 
 // src/init/run.ts
 init_cjs_shims();
-var import_node_child_process3 = require("child_process");
-var import_node_fs6 = require("fs");
-var import_node_path5 = require("path");
+var import_node_child_process4 = require("child_process");
+var import_node_fs7 = require("fs");
+var import_node_path6 = require("path");
 init_dist2();
-var import_picocolors30 = __toESM(require_picocolors(), 1);
-var import_errors24 = require("@abloatai/transaction/errors");
+var import_picocolors31 = __toESM(require_picocolors(), 1);
+var import_errors25 = require("@abloatai/transaction/errors");
 init_dbRole();
 init_config();
 init_projects();
@@ -289751,8 +290287,21 @@ export async function POST(request: Request): Promise<Response> {
     );
   }
 
+  const authorizedScope = await authorizeActiveWorkspace(user.id);
+  if (!authorizedScope) {
+    return Response.json(
+      credentialEndpointErrorSchema.parse({
+        error: { code: 'policy_denied', message: 'Workspace membership is stale or revoked' },
+      }),
+      { status: 403, headers: noStore },
+    );
+  }
+
   const { token, expiresAt } = await sync.sessions.create({
     user: { id: user.id },
+    // These ids came from the server-side membership lookup below. Never take
+    // organization, workspace, team, or group ids from the request body.
+    syncGroups: authorizedScope.syncGroups,
     can: { records: ['read', 'create', 'update'] },
   });
   return Response.json(
@@ -289776,6 +290325,27 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
   const session = await auth.api.getSession({ headers: await headers() });
   return session?.user ? { id: session.user.id } : null;
 }
+
+type AuthorizedWorkspace = {
+  workspaceId: string;
+  syncGroups: readonly [\`workspace:\${string}\`, ...\`\${string}:\${string}\`[]];
+};
+
+async function authorizeActiveWorkspace(userId: string): Promise<AuthorizedWorkspace | null> {
+  void userId;
+  // REQUIRED: query your membership table here, immediately before minting.
+  // Read the active workspace from the server-side session, verify this user has
+  // an active membership, and derive every team/group id on the server. Return
+  // null for a stale or revoked membership. This refusal keeps a newly generated
+  // route from turning "signed in" into workspace authorization by accident.
+  //
+  // Example after your membership query:
+  // return {
+  //   workspaceId: membership.workspaceId,
+  //   syncGroups: [\`workspace:\${membership.workspaceId}\`],
+  // };
+  return null;
+}
 `;
 }
 
@@ -289808,7 +290378,7 @@ export const schema = defineSchema({
 });
 `;
 }
-function generateSyncConfig(auth) {
+function generateSyncConfig(auth, options = {}) {
   const authLine = auth === "apikey" ? "" : auth === "firebase" ? `
   auth: async () => {
     const { getAuth } = await import('firebase/auth');
@@ -289820,7 +290390,7 @@ function generateSyncConfig(auth) {
   // auth: async () => { const { data } = await supabase.auth.getSession(); return data.session?.access_token ?? ''; },` : auth === "betterauth" ? `
   // auth: async () => { const session = await authClient.getSession(); return session?.token ?? ''; },` : `
   // auth: () => 'your-jwt-token', // replace with your auth provider`;
-  return `import Ablo from '@abloatai/ablo';
+  return `${options.serverOnly ? "import 'server-only';\n\n" : ""}import Ablo from '@abloatai/ablo';
 import { schema } from './schema';
 
 // SERVER-ONLY client \u2014 it holds your \`sk_\` key. Use it from server code: the
@@ -289982,7 +290552,10 @@ export async function POST(req: Request): Promise<Response> {
     const model: unknown = Reflect.get(prisma, event.model); // prisma.record, prisma.task, \u2026
     if (!isModelDelegate(model)) continue; // a model you don't mirror locally \u2014 skip it
     if (event.data === null) {
-      await model.delete({ where: { id: event.objectId } }).catch(() => {}); // already gone
+      await model.delete({ where: { id: event.objectId } }).catch((error) => {
+        // Idempotent replay: a missing local row is already the desired state.
+        void error;
+      });
     } else {
       await model.upsert({ where: { id: event.objectId }, create: event.data, update: event.data });
     }
@@ -290046,12 +290619,12 @@ async function main() {
   // Triage the urgent one to the top. We write based on the version we just
   // read (\`readAt\`), so if a human edits the same row at the same moment the
   // write is rejected instead of silently clobbering them.
-  const snap = ablo.snapshot({ records: urgent.id });
+  const current = await ablo.records.read({ id: urgent.id });
+  if (!current) throw new Error('urgent record was not found');
   await ablo.records.update({
     id: urgent.id,
     data: { priority: 10 },
-    readAt: snap.stamp,
-    onStale: 'reject',
+    reads: [current],
   });
   console.log('prioritized:', urgent.title);
 
@@ -290062,7 +290635,7 @@ async function main() {
 main().catch((err) => {
   // Ablo errors stringify to one clean line (code + message + docs link),
   // never a stack/object dump \u2014 see AbloError.toString().
-  console.error(String(err));
+  process.stderr.write(String(err) + '\\n');
   process.exit(1);
 });
 `;
@@ -290121,9 +290694,9 @@ export function RecordList() {
 
 // src/init/writer.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
-var import_node_crypto7 = require("crypto");
+var import_node_fs6 = require("fs");
+var import_node_path5 = require("path");
+var import_node_crypto8 = require("crypto");
 function projectInitWritePlan(plan) {
   return setupInitPlanProjectionSchema.parse({
     root: plan.root,
@@ -290137,18 +290710,18 @@ function projectInitWritePlan(plan) {
   });
 }
 function absolute(root, path) {
-  const target = (0, import_node_path4.resolve)(root, path);
-  const fromRoot = (0, import_node_path4.relative)(root, target);
-  if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${import_node_path4.sep}`) || (0, import_node_path4.isAbsolute)(fromRoot)) {
+  const target = (0, import_node_path5.resolve)(root, path);
+  const fromRoot = (0, import_node_path5.relative)(root, target);
+  if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${import_node_path5.sep}`) || (0, import_node_path5.isAbsolute)(fromRoot)) {
     throw new Error(`Init target must stay inside the project root: ${path}`);
   }
   return target;
 }
 function sha2562(content) {
-  return (0, import_node_crypto7.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto8.createHash)("sha256").update(content).digest("hex");
 }
 function readIfPresent(path) {
-  return (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : void 0;
+  return (0, import_node_fs6.existsSync)(path) ? (0, import_node_fs6.readFileSync)(path, "utf8") : void 0;
 }
 function mergeEnvironmentTemplate(existing, template) {
   const assignments = template.split(/\r?\n/).map((line) => {
@@ -290172,7 +290745,7 @@ function mergeEnvironmentTemplate(existing, template) {
   };
 }
 function planInitWrites(input) {
-  const root = (0, import_node_path4.resolve)(input.root ?? process.cwd());
+  const root = (0, import_node_path5.resolve)(input.root ?? process.cwd());
   const actions = [];
   const conflicts = [];
   for (const file of input.files) {
@@ -290217,18 +290790,18 @@ function planInitWrites(input) {
   return { root, actions, conflicts };
 }
 function writeAtomic(path, content, kind) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
-  const temporary = (0, import_node_path4.join)((0, import_node_path4.dirname)(path), `.${(0, import_node_crypto7.randomUUID)()}.ablo-init.tmp`);
-  (0, import_node_fs5.writeFileSync)(temporary, content, { flag: "wx" });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
+  const temporary = (0, import_node_path5.join)((0, import_node_path5.dirname)(path), `.${(0, import_node_crypto8.randomUUID)()}.ablo-init.tmp`);
+  (0, import_node_fs6.writeFileSync)(temporary, content, { flag: "wx" });
   try {
     if (kind === "create") {
-      (0, import_node_fs5.linkSync)(temporary, path);
-      (0, import_node_fs5.unlinkSync)(temporary);
+      (0, import_node_fs6.linkSync)(temporary, path);
+      (0, import_node_fs6.unlinkSync)(temporary);
     } else {
-      (0, import_node_fs5.renameSync)(temporary, path);
+      (0, import_node_fs6.renameSync)(temporary, path);
     }
   } catch (error) {
-    if ((0, import_node_fs5.existsSync)(temporary)) (0, import_node_fs5.unlinkSync)(temporary);
+    if ((0, import_node_fs6.existsSync)(temporary)) (0, import_node_fs6.unlinkSync)(temporary);
     throw error;
   }
 }
@@ -290259,23 +290832,23 @@ function bailIfCancelled(value) {
     process.exit(0);
   }
 }
-async function chooseOption(name, flagValue, fallback, allowed, interactive, prompt) {
-  if (flagValue !== void 0) {
-    if (!allowed.includes(flagValue)) {
-      throw new import_errors24.AbloValidationError(
-        `Invalid --${name} "${flagValue}". Allowed: ${allowed.join(", ")}`,
+async function chooseOption(name, flagValue2, fallback, allowed, interactive, prompt) {
+  if (flagValue2 !== void 0) {
+    if (!allowed.includes(flagValue2)) {
+      throw new import_errors25.AbloValidationError(
+        `Invalid --${name} "${flagValue2}". Allowed: ${allowed.join(", ")}`,
         { code: "cli_invalid_arguments" }
       );
     }
-    return flagValue;
+    return flagValue2;
   }
   if (!interactive) return fallback;
   const value = await prompt();
   bailIfCancelled(value);
   return value;
 }
-async function chooseBool(flagValue, fallback, interactive, prompt) {
-  if (flagValue !== void 0) return flagValue;
+async function chooseBool(flagValue2, fallback, interactive, prompt) {
+  if (flagValue2 !== void 0) return flagValue2;
   if (!interactive) return fallback;
   const value = await prompt();
   bailIfCancelled(value);
@@ -290286,7 +290859,7 @@ async function ensureInitProject(opts) {
   const slug = opts.project ?? projectSlugFromPackageName(
     (() => {
       try {
-        return JSON.parse((0, import_node_fs6.readFileSync)("package.json", "utf8")).name;
+        return JSON.parse((0, import_node_fs7.readFileSync)("package.json", "utf8")).name;
       } catch {
         return void 0;
       }
@@ -290296,7 +290869,7 @@ async function ensureInitProject(opts) {
   const ensured = await ensureProject(slug);
   if (ensured) {
     console.log(
-      `  ${import_picocolors30.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors30.default.bold(ensured.slug)} ${import_picocolors30.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
+      `  ${import_picocolors31.default.green("\u2713")} ${ensured.created ? "Created" : "Using"} project ${import_picocolors31.default.bold(ensured.slug)} ${import_picocolors31.default.dim(`(${ensured.id})`)} \u2014 keys you mint for it are isolated from the org's other apps.`
     );
   }
 }
@@ -290308,16 +290881,16 @@ function renderWritePlan(actions) {
 }
 function renderAppliedWrites(actions) {
   return actions.map((action) => {
-    const status2 = action.kind === "create" ? import_picocolors30.default.green("created") : action.kind === "update" ? import_picocolors30.default.yellow("updated") : import_picocolors30.default.dim("unchanged");
-    return `${import_picocolors30.default.green("\u2713")} ${action.path}${action.note ?? ""} ${import_picocolors30.default.dim(`(${status2})`)}`;
+    const status2 = action.kind === "create" ? import_picocolors31.default.green("created") : action.kind === "update" ? import_picocolors31.default.yellow("updated") : import_picocolors31.default.dim("unchanged");
+    return `${import_picocolors31.default.green("\u2713")} ${action.path}${action.note ?? ""} ${import_picocolors31.default.dim(`(${status2})`)}`;
   }).join("\n");
 }
 async function runInit(args = []) {
   const opts = parseInitArgs(args);
   const interactive = Boolean(process.stdin.isTTY) && !opts.yes && !process.env.CI;
-  Ie(`${brand("ablo")} ${import_picocolors30.default.dim("sync engine")}`);
-  if (!(0, import_node_fs6.existsSync)("package.json")) {
-    throw new import_errors24.AbloValidationError("No package.json found. Run this from your project root.", {
+  Ie(`${brand("ablo")} ${import_picocolors31.default.dim("sync engine")}`);
+  if (!(0, import_node_fs7.existsSync)("package.json")) {
+    throw new import_errors25.AbloValidationError("No package.json found. Run this from your project root.", {
       code: "cli_invalid_arguments"
     });
   }
@@ -290386,14 +290959,14 @@ async function runInit(args = []) {
     );
   }
   const layout = framework === "nextjs" ? detectNextLayout() : { appBase: "app", aliasBase: "." };
-  const abloDir = (0, import_node_path5.join)(layout.aliasBase, "ablo");
+  const abloDir = (0, import_node_path6.join)(layout.aliasBase, "ablo");
   const files = [];
   let schemaSource = generateSchema();
   let schemaNote = "";
   if (pullExisting) {
     const dbUrl = readProjectAdminDatabaseUrl();
     if (!dbUrl) {
-      schemaNote = import_picocolors30.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
+      schemaNote = import_picocolors31.default.dim(` (no ${ADMIN_URL_VAR} \u2014 wrote starter; run \`ablo pull\` later)`);
     } else {
       try {
         const pulled = await buildSchemaSourceFromDb({
@@ -290403,56 +290976,59 @@ async function runInit(args = []) {
         });
         if (pulled.models.length > 0) {
           schemaSource = pulled.source;
-          schemaNote = import_picocolors30.default.dim(` (pulled ${pulled.models.length} models)`);
+          schemaNote = import_picocolors31.default.dim(` (pulled ${pulled.models.length} models)`);
         } else {
-          schemaNote = import_picocolors30.default.dim(" (no adoptable tables \u2014 wrote starter)");
+          schemaNote = import_picocolors31.default.dim(" (no adoptable tables \u2014 wrote starter)");
         }
       } catch {
-        schemaNote = import_picocolors30.default.dim(" (pull failed \u2014 wrote starter)");
+        schemaNote = import_picocolors31.default.dim(" (pull failed \u2014 wrote starter)");
       }
     }
   }
-  files.push({ path: (0, import_node_path5.join)(abloDir, "schema.ts"), content: schemaSource, note: schemaNote });
-  files.push({ path: (0, import_node_path5.join)(abloDir, "index.ts"), content: generateSyncConfig(auth) });
-  files.push({ path: (0, import_node_path5.join)(abloDir, "register.ts"), content: generateRegister() });
+  files.push({ path: (0, import_node_path6.join)(abloDir, "schema.ts"), content: schemaSource, note: schemaNote });
+  files.push({
+    path: (0, import_node_path6.join)(abloDir, "index.ts"),
+    content: generateSyncConfig(auth, { serverOnly: framework === "nextjs" })
+  });
+  files.push({ path: (0, import_node_path6.join)(abloDir, "register.ts"), content: generateRegister() });
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
     files.push({
-      path: (0, import_node_path5.join)(abloDir, "data-source.ts"),
+      path: (0, import_node_path6.join)(abloDir, "data-source.ts"),
       content: generateDataSource(orm),
       note: orm === "drizzle" ? " (Drizzle)" : " (Prisma)"
     });
   }
   const envFile = framework === "nextjs" ? ".env.local" : ".env";
   const envBody = generateEnv(storage);
-  if (agent) files.push({ path: (0, import_node_path5.join)(abloDir, "agent.ts"), content: generateAgent() });
+  if (agent) files.push({ path: (0, import_node_path6.join)(abloDir, "agent.ts"), content: generateAgent() });
   if (framework === "nextjs") {
     if (storage === "endpoint") {
-      const webhookDir = (0, import_node_path5.join)(layout.appBase, "api", "ablo", "webhooks");
+      const webhookDir = (0, import_node_path6.join)(layout.appBase, "api", "ablo", "webhooks");
       files.push({
-        path: (0, import_node_path5.join)(webhookDir, "route.ts"),
+        path: (0, import_node_path6.join)(webhookDir, "route.ts"),
         content: generateWebhookRoute(orm),
         note: orm === "prisma" ? " (Prisma mirror)" : " (add your database write)"
       });
     }
     files.push({
-      path: (0, import_node_path5.join)(layout.appBase, "providers.tsx"),
+      path: (0, import_node_path6.join)(layout.appBase, "providers.tsx"),
       content: generateProviders(),
-      note: ` (wrap ${(0, import_node_path5.join)(layout.appBase, "layout.tsx")} in <Providers>)`
+      note: ` (wrap ${(0, import_node_path6.join)(layout.appBase, "layout.tsx")} in <Providers>)`
     });
     files.push({
-      path: (0, import_node_path5.join)(layout.appBase, "api", "ablo-session", "route.ts"),
+      path: (0, import_node_path6.join)(layout.appBase, "api", "ablo-session", "route.ts"),
       content: generateSessionRoute(),
       note: " (wire your auth)"
     });
   }
   if (framework !== "vanilla") {
-    files.push({ path: (0, import_node_path5.join)(abloDir, "RecordList.tsx"), content: generateComponent() });
+    files.push({ path: (0, import_node_path6.join)(abloDir, "RecordList.tsx"), content: generateComponent() });
   }
   const writePlan = planInitWrites({ files, environment: { path: envFile, template: envBody } });
   if (writePlan.conflicts.length > 0) {
     const occupied = writePlan.conflicts.map(({ path }) => `  - ${path}`).join("\n");
-    throw new import_errors24.AbloValidationError(
+    throw new import_errors25.AbloValidationError(
       `Ablo init did not change any files because these application-owned paths already contain different contents:
 ${occupied}
 
@@ -290462,7 +291038,7 @@ Move them, reconcile Ablo manually, or rerun after they match the generated scaf
   }
   if (opts.plan) {
     Me(renderWritePlan(writePlan.actions), "Plan (no files changed)");
-    Se(`Dry run complete. Re-run without ${import_picocolors30.default.bold("--plan")} to apply it.`);
+    Se(`Dry run complete. Re-run without ${import_picocolors31.default.bold("--plan")} to apply it.`);
     return setupInitResultSchema.parse({
       status: "planned",
       plan: projectInitWritePlan(writePlan)
@@ -290479,32 +291055,32 @@ Move them, reconcile Ablo manually, or rerun after they match the generated scaf
     const progress = Y2();
     progress.start("Installing @abloatai/ablo");
     try {
-      (0, import_node_child_process3.execFileSync)(packageManager2, ["add", "@abloatai/ablo"], { stdio: "ignore" });
+      (0, import_node_child_process4.execFileSync)(packageManager2, ["add", "@abloatai/ablo"], { stdio: "ignore" });
       progress.stop("Installed @abloatai/ablo");
     } catch {
       progress.stop(
-        `${import_picocolors30.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors30.default.bold(`${packageManager2} install @abloatai/ablo`)}`
+        `${import_picocolors31.default.yellow("!")} Couldn't auto-install \u2014 run ${import_picocolors31.default.bold(`${packageManager2} install @abloatai/ablo`)}`
       );
     }
   }
   const steps = [
-    `Run ${import_picocolors30.default.bold("npx ablo login")} to authorize branch management`,
-    `Set ${import_picocolors30.default.bold("DATABASE_URL")} in ${import_picocolors30.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
-    `Run ${import_picocolors30.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
+    `Run ${import_picocolors31.default.bold("npx ablo login")} to authorize branch management`,
+    `Set ${import_picocolors31.default.bold("DATABASE_URL")} in ${import_picocolors31.default.bold(envFile)} \u2014 your Postgres is the system of record; rows live there, never with Ablo`,
+    `Run ${import_picocolors31.default.bold("npx ablo dev")} \u2014 pushes your schema definition and watches for changes`,
     ...storage === "replication" ? [
-      `Connect your database \u2014 ${import_picocolors30.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
-      `Verify it \u2014 ${import_picocolors30.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
-      `Register it \u2014 ${import_picocolors30.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
+      `Connect your database \u2014 ${import_picocolors31.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
+      `Verify it \u2014 ${import_picocolors31.default.bold("npx ablo connect check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
+      `Register it \u2014 ${import_picocolors31.default.bold("npx ablo connect register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
     ] : [
-      `Provision your DB: ${import_picocolors30.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors30.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors30.default.bold("/api/ablo/source")}`
+      `Provision your DB: ${import_picocolors31.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors31.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors31.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors30.default.bold((0, import_node_path5.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors30.default.bold("<Providers>")} (${(0, import_node_path5.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors30.default.bold((0, import_node_path5.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
+      `Wrap ${import_picocolors31.default.bold((0, import_node_path6.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors31.default.bold("<Providers>")} (${(0, import_node_path6.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors31.default.bold((0, import_node_path6.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
-    `Run ${import_picocolors30.default.bold(`${packageManager2} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
+    `Run ${import_picocolors31.default.bold(`${packageManager2} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
-      `Run ${import_picocolors30.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same records`,
-      `Run ${import_picocolors30.default.bold("npx ablo logs")} to watch human + agent commits stream by`
+      `Run ${import_picocolors31.default.bold(`npx tsx ${abloDir}/agent.ts`)} \u2014 an AI teammate edits the same records`,
+      `Run ${import_picocolors31.default.bold("npx ablo logs")} to watch human + agent commits stream by`
     ] : []
   ];
   Me(steps.map((step, index) => `${index + 1}. ${step}`).join("\n"), "Next steps");
@@ -290512,26 +291088,26 @@ Move them, reconcile Ablo manually, or rerun after they match the generated scaf
   if (existingKey) {
     await ensureInitProject(opts);
     Se(
-      `Already authorized ${import_picocolors30.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors30.default.bold("npx ablo dev")} next. ${import_picocolors30.default.dim("Docs:")} https://abloatai.com/docs`
+      `Already authorized ${import_picocolors31.default.dim(`(${existingKey.slice(0, 11)}\u2026)`)}. Run ${import_picocolors31.default.bold("npx ablo dev")} next. ${import_picocolors31.default.dim("Docs:")} https://abloatai.com/docs`
     );
     return initResult;
   }
   if (interactive && opts.login) {
     const loginNow = await ye({ message: "Log in now? (opens your browser)", initialValue: true });
     if (!pD(loginNow) && loginNow) {
-      Se(`${import_picocolors30.default.dim("Docs:")} https://abloatai.com/docs`);
+      Se(`${import_picocolors31.default.dim("Docs:")} https://abloatai.com/docs`);
       await login();
       await ensureInitProject(opts);
       return initResult;
     }
   }
-  Se(`Run ${import_picocolors30.default.bold("npx ablo login")} when ready. ${import_picocolors30.default.dim("Docs:")} https://abloatai.com/docs`);
+  Se(`Run ${import_picocolors31.default.bold("npx ablo login")} when ready. ${import_picocolors31.default.dim("Docs:")} https://abloatai.com/docs`);
   return initResult;
 }
 
 // src/index.ts
 var LOGO = `
-  ${brand("ablo")} ${import_picocolors31.default.dim("sync engine")}
+  ${brand("ablo")} ${import_picocolors32.default.dim("sync engine")}
 `;
 var HANDLERS = {
   setup: (argv) => runSetup(argv),
@@ -290547,6 +291123,7 @@ var HANDLERS = {
   whoami: (argv) => whoami([...argv]),
   doctor: (argv) => doctor([...argv]),
   logs: (argv) => logs([...argv]),
+  claims: (argv) => claims([...argv]),
   webhooks: (argv) => webhooks([...argv]),
   check: (argv) => check([...argv]),
   docs: (argv) => docs([...argv]),
@@ -290564,7 +291141,7 @@ async function runDev(argv) {
   const devArgs = [...argv];
   const oneShot = devArgs.includes("--no-watch");
   console.log(
-    import_picocolors31.default.dim(
+    import_picocolors32.default.dim(
       oneShot ? "  `ablo dev --no-watch` prepares this Git branch and pushes once." : "  `ablo dev` prepares this Git branch and watches the schema."
     )
   );
@@ -290582,7 +291159,7 @@ async function runPush2(argv) {
 }
 function runRenamedSchema(argv) {
   const forwarded = argv.slice(1).join(" ");
-  console.error(`  ${import_picocolors31.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
+  console.error(`  ${import_picocolors32.default.red("\u2717")} \`ablo schema push\` was renamed to \`${brand("ablo push")}\`.`);
   console.error(`    Run \`ablo push${forwarded ? " " + forwarded : ""}\` instead.`);
   process.exitCode = 1;
 }
@@ -290592,7 +291169,7 @@ async function main() {
   const argv = process.argv.slice(3);
   if (!command && raw !== void 0 && raw !== "help" && !raw.startsWith("-")) {
     const suggestion = suggestCommand(raw);
-    throw new import_errors25.AbloValidationError(
+    throw new import_errors26.AbloValidationError(
       `\`${raw}\` isn't an ablo command.` + (suggestion ? ` Did you mean \`ablo ${suggestion}\`?` : " Run `ablo help --all` to see every command."),
       { code: "cli_invalid_arguments" }
     );
@@ -290633,7 +291210,7 @@ function printCoreHelp() {
   const width = Math.max(...rows.map((r2) => r2.run.length)) + 4;
   console.log(LOGO);
   for (const group of CORE_GROUPS) {
-    console.log(`  ${import_picocolors31.default.bold(group)}`);
+    console.log(`  ${import_picocolors32.default.bold(group)}`);
     const printed = group === "More" ? [...coreRows(group), ...extra] : coreRows(group);
     for (const row of printed) console.log(`    npx ablo ${row.run.padEnd(width)}${row.does}`);
     console.log();
@@ -290642,7 +291219,7 @@ function printCoreHelp() {
 }
 function printSchemaReminder() {
   console.log(
-    import_picocolors31.default.dim(`  Edit ${import_picocolors31.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors31.default.yellow("server_execute_unknown_model") + import_picocolors31.default.dim(".")
+    import_picocolors32.default.dim(`  Edit ${import_picocolors32.default.bold("ablo/schema.ts")}, then push \u2014 writes to models you haven't pushed fail with `) + import_picocolors32.default.yellow("server_execute_unknown_model") + import_picocolors32.default.dim(".")
   );
   console.log();
 }
@@ -290652,7 +291229,7 @@ function printFullHelp() {
   ) + 2;
   console.log(LOGO);
   for (const group of FULL_GROUPS) {
-    console.log(`  ${import_picocolors31.default.bold(group)}`);
+    console.log(`  ${import_picocolors32.default.bold(group)}`);
     for (const row of fullRows(group)) {
       console.log(row.does === void 0 ? `    ${" ".repeat(9)}${row.run}` : `    npx ablo ${row.run.padEnd(width)}${row.does}`);
     }