@maxceem/agw 0.2.1 → 0.3.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.2.1", wrangler: "4.96.0", upgradeFrom: ["0.2.1", "0.2.0", "0.1.13", "0.1.12", "0.1.11", "0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.2.1/gateway-0.2.1.tar.gz", sha256: "09d5d34a924dedf99ca6268d2b699e3d524b72d07a6c6853629dc6c8c9a42307", manifest: "f0a1e385150b39c24707296f9618dea4bb21b73822bb976a58ac03a1482408a0" } };
+var define_AGW_MANIFEST_default = { version: "0.3.0", wrangler: "4.96.0", upgradeFrom: ["0.3.0", "0.2.1", "0.2.0", "0.1.13", "0.1.12", "0.1.11", "0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.3.0/gateway-0.3.0.tar.gz", sha256: "ead1f1da6ad0b2d2c35397fae2e58c640ffd2a5ba51a096b3a91facd877b6b61", manifest: "86b7799f57fe35aae0a372dd01e3cf32e3d6e7f8a3f3c8e6e1e207cf321c1c57" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -1418,18 +1418,18 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path = _path.map((seg2) => typeof seg2 === "object" ? seg2.key : seg2);
-  for (const seg2 of path) {
-    if (typeof seg2 === "number")
-      segs.push(`[${seg2}]`);
-    else if (typeof seg2 === "symbol")
-      segs.push(`[${JSON.stringify(String(seg2))}]`);
-    else if (/[^\w$]/.test(seg2))
-      segs.push(`[${JSON.stringify(seg2)}]`);
+  const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path) {
+    if (typeof seg === "number")
+      segs.push(`[${seg}]`);
+    else if (typeof seg === "symbol")
+      segs.push(`[${JSON.stringify(String(seg))}]`);
+    else if (/[^\w$]/.test(seg))
+      segs.push(`[${JSON.stringify(seg)}]`);
     else {
       if (segs.length)
         segs.push(".");
-      segs.push(seg2);
+      segs.push(seg);
     }
   }
   return segs.join("");
@@ -14525,12 +14525,64 @@ function date4(params) {
 // ../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../src/core/records.ts
+// ../src/shared/capabilities.ts
+var API_STYLES = [
+  "responses",
+  "chat_completions",
+  "anthropic_messages",
+  "gemini_native",
+  "audio_transcription",
+  /** A provider-native operation with no cross-provider contract of its own. */
+  "other"
+];
+var API_STYLE_PATHS = {
+  responses: "v1/responses",
+  chat_completions: "v1/chat/completions",
+  anthropic_messages: "v1/messages",
+  gemini_native: "v1beta/models/{model}:generateContent",
+  audio_transcription: "v1/audio/transcriptions"
+};
+var ENDPOINT_API_STYLES = ["responses", "transcription"];
+var OUTPUT_CLAMP_STYLES = [
+  "responses",
+  "chat_completions",
+  "gemini_native",
+  "anthropic",
+  "none"
+];
+var VERCEL_API_STYLES = [
+  "responses",
+  "chat_completions",
+  "anthropic_messages"
+];
+var VERCEL_ENDPOINT_STYLES = ["responses"];
+function vercelRoute(modelPrefix) {
+  return {
+    modelPrefix,
+    apiStyles: VERCEL_API_STYLES,
+    endpointStyles: VERCEL_ENDPOINT_STYLES
+  };
+}
+var VERCEL_ROUTES = {
+  openai: vercelRoute("openai/"),
+  anthropic: vercelRoute("anthropic/"),
+  // Google AI Studio's models are Google's, and Vercel namespaces them by
+  // author: `gemini-2.5-flash` goes out as `google/gemini-2.5-flash`.
+  gemini: vercelRoute("google/"),
+  xai: vercelRoute("spacexai/"),
+  perplexity: vercelRoute("perplexity/"),
+  deepseek: vercelRoute("deepseek/"),
+  // Moonshot's own IDs are the Kimi ones, and Vercel publishes them verbatim
+  // under the lab's name rather than the product's: `moonshotai/kimi-k3`.
+  moonshot: vercelRoute("moonshotai/")
+};
+
+// ../src/shared/records.ts
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 
-// ../src/core/cost-report.ts
+// ../src/shared/cost-report.ts
 function finiteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -14595,133 +14647,29 @@ var OPENROUTER_COST_REPORT = {
   }
 };
 
-// ../src/shared/provider-auth.ts
-var PROVIDER_AUTH = {
-  openai: { header: "authorization", scheme: "Bearer " },
-  anthropic: { header: "x-api-key" },
-  xai: { header: "authorization", scheme: "Bearer " },
-  gemini: { header: "x-goog-api-key" },
-  perplexity: { header: "authorization", scheme: "Bearer " },
-  deepseek: { header: "authorization", scheme: "Bearer " },
-  groq: { header: "authorization", scheme: "Bearer " },
-  mistral: { header: "authorization", scheme: "Bearer " },
-  together: { header: "authorization", scheme: "Bearer " },
-  fireworks: { header: "authorization", scheme: "Bearer " },
-  cerebras: { header: "authorization", scheme: "Bearer " },
-  moonshot: { header: "authorization", scheme: "Bearer " },
-  huggingface: { header: "authorization", scheme: "Bearer " },
-  baseten: { header: "authorization", scheme: "Bearer " },
-  bytedance: { header: "authorization", scheme: "Bearer " },
-  openrouter: { header: "authorization", scheme: "Bearer " }
-};
-var PROVIDER_CREDENTIAL_HEADERS = [
-  ...new Set(Object.values(PROVIDER_AUTH).map((auth) => auth.header.toLowerCase()))
-];
-
-// ../src/shared/capabilities.ts
-var PROVIDER_TYPES = [
-  "openai",
-  "anthropic",
-  "xai",
-  "gemini",
-  "perplexity",
-  "deepseek",
-  "groq",
-  "mistral",
-  "together",
-  "fireworks",
-  "cerebras",
-  "moonshot",
-  "huggingface",
-  "baseten",
-  "bytedance",
-  "openrouter"
-];
-var API_STYLES = [
-  "responses",
-  "chat_completions",
-  "anthropic_messages",
-  "gemini_native",
-  "audio_transcription",
-  /** A provider-native operation with no cross-provider contract of its own. */
-  "other"
-];
-var PASSTHROUGH_CAPABILITY = {
-  apiStyles: API_STYLES,
-  endpointStyles: []
-};
-var PROVIDER_CAPABILITY_EXCEPTIONS = {
-  // The two types whose Responses and transcription request shapes the gateway
-  // composes itself for named endpoints.
-  openai: { apiStyles: API_STYLES, endpointStyles: ["responses", "transcription"] },
-  xai: { apiStyles: API_STYLES, endpointStyles: ["responses", "transcription"] },
-  // The one narrowed API surface, and it is a metering constraint rather than a
-  // missing one: OpenRouter also serves `/responses` and `/messages`, but only
-  // its chat-completions response carries `usage.cost`, and its slugs have no
-  // local price. Any other style would proxy traffic nothing could bill —
-  // exactly the silent $0 the fail-closed gate exists to prevent — so it is
-  // refused at the edge instead.
-  openrouter: { apiStyles: ["chat_completions"], endpointStyles: [] }
-};
-function providerCapability(provider) {
-  const exceptions = PROVIDER_CAPABILITY_EXCEPTIONS;
-  return exceptions[provider] ?? PASSTHROUGH_CAPABILITY;
-}
-var ENDPOINT_PROVIDER_TYPES = PROVIDER_TYPES.filter(
-  (type) => providerCapability(type).endpointStyles.length > 0
-);
-var VERCEL_API_STYLES = [
-  "responses",
-  "chat_completions",
-  "anthropic_messages"
-];
-var VERCEL_ENDPOINT_STYLES = ["responses"];
-function vercelRoute(modelPrefix) {
-  return {
-    modelPrefix,
-    apiStyles: VERCEL_API_STYLES,
-    endpointStyles: VERCEL_ENDPOINT_STYLES
-  };
-}
-var VERCEL_ROUTES = {
-  openai: vercelRoute("openai/"),
-  anthropic: vercelRoute("anthropic/"),
-  // Google AI Studio's models are Google's, and Vercel namespaces them by
-  // author: `gemini-2.5-flash` goes out as `google/gemini-2.5-flash`.
-  gemini: vercelRoute("google/"),
-  xai: vercelRoute("spacexai/"),
-  perplexity: vercelRoute("perplexity/"),
-  deepseek: vercelRoute("deepseek/"),
-  // Moonshot's own IDs are the Kimi ones, and Vercel publishes them verbatim
-  // under the lab's name rather than the product's: `moonshotai/kimi-k3`.
-  moonshot: vercelRoute("moonshotai/")
-};
-
-// ../src/shared/app-config.ts
-var ISSUER_PROVIDERS = ["firebase", "supabase", "auth0", "clerk", "custom"];
-var ENTITLEMENT_CHECKS = ["revenuecat", "custom"];
-var ENDPOINT_SLUG = /^[a-z0-9-]{1,64}$/;
-var PROVIDER_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
-var HTTP_FIELD_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
-var RESERVED_END_USER_HEADERS = /* @__PURE__ */ new Set([
-  "authorization",
-  ...PROVIDER_CREDENTIAL_HEADERS,
-  "x-app-version",
-  "content-type",
-  "content-length",
-  "host"
-]);
-
-// ../src/core/providers.ts
-var PROVIDER_REGISTRY = {
+// ../src/shared/providers.ts
+var PROVIDER_DESCRIPTORS = {
   openai: {
     directBaseUrl: "https://api.openai.com/",
-    auth: PROVIDER_AUTH.openai,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "responses",
+    probePath: "v1/models",
+    examplePath: "v1/responses",
+    // OpenAI's chat-completions surface deprecated `max_tokens` in favour of
+    // `max_completion_tokens`; every other OpenAI-compatible service still
+    // reads the older field.
+    chatCompletionsCapField: "max_completion_tokens",
+    // The two types whose Responses and transcription request shapes the
+    // gateway composes itself for named endpoints.
+    endpointPaths: { responses: "v1/responses", transcription: "v1/audio/transcriptions" },
     modelAuthor: "OpenAI"
   },
   anthropic: {
     directBaseUrl: "https://api.anthropic.com/",
-    auth: PROVIDER_AUTH.anthropic,
+    auth: { header: "x-api-key" },
+    nativeClampStyle: "anthropic",
+    probePath: "v1/models",
+    examplePath: "v1/messages",
     modelAuthor: "Anthropic",
     // Anthropic refuses any request without a version header, probe included —
     // and a probe has no client to send one for it. Deliberately not a
@@ -14732,17 +14680,31 @@ var PROVIDER_REGISTRY = {
   },
   xai: {
     directBaseUrl: "https://api.x.ai/",
-    auth: PROVIDER_AUTH.xai,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "responses",
+    probePath: "v1/models",
+    // Native provider paths: xAI transcribes at `v1/stt`, where OpenAI serves
+    // `v1/audio/transcriptions`.
+    endpointPaths: { responses: "v1/responses", transcription: "v1/stt" },
     modelAuthor: "xAI"
   },
   gemini: {
     directBaseUrl: "https://generativelanguage.googleapis.com/",
-    auth: PROVIDER_AUTH.gemini,
+    auth: { header: "x-goog-api-key" },
+    nativeClampStyle: "gemini_native",
+    probePath: "v1beta/models",
+    // Native Gemini generation requests carry the model in the URL rather than
+    // in the JSON body, so there is no example path without a model and a
+    // request on one has its model captured from the path.
+    modelInPath: true,
     modelAuthor: "Google"
   },
   perplexity: {
     directBaseUrl: "https://api.perplexity.ai/",
-    auth: PROVIDER_AUTH.perplexity,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "responses",
+    // No `probePath`: Perplexity has no unmetered authenticated endpoint.
+    examplePath: "chat/completions",
     modelAuthor: "Perplexity"
   },
   // OpenAI-compatible chat-completions services. `modelAuthor` is set only
@@ -14753,41 +14715,62 @@ var PROVIDER_REGISTRY = {
     // No `v1` segment: DeepSeek documents the bare origin as its OpenAI base
     // URL, and `https://api.deepseek.com/anthropic` for the Anthropic format.
     directBaseUrl: "https://api.deepseek.com/",
-    auth: PROVIDER_AUTH.deepseek,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    // DeepSeek's OpenAI base URL carries no `v1` segment.
+    probePath: "models",
+    examplePath: "chat/completions",
     modelAuthor: "DeepSeek"
   },
   groq: {
     // Groq's OpenAI-compatible surface lives under `openai/v1/`, so the client
     // path is `openai/v1/chat/completions` rather than `v1/chat/completions`.
     directBaseUrl: "https://api.groq.com/",
-    auth: PROVIDER_AUTH.groq
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    // Groq's OpenAI-compatible surface is namespaced under `openai/`.
+    probePath: "openai/v1/models",
+    examplePath: "openai/v1/chat/completions"
   },
   mistral: {
     directBaseUrl: "https://api.mistral.ai/",
-    auth: PROVIDER_AUTH.mistral,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    probePath: "v1/models",
     modelAuthor: "Mistral"
   },
   together: {
     // `api.together.ai`, not the `.xyz` host older SDKs default to: the current
     // OpenAI-compatibility guide names this one and warns against the other.
     directBaseUrl: "https://api.together.ai/",
-    auth: PROVIDER_AUTH.together
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    probePath: "v1/models"
   },
   fireworks: {
     // The inference plane is `/inference/v1`; `/v1` on the same host is the
     // control plane, so the client path is `inference/v1/chat/completions`.
     directBaseUrl: "https://api.fireworks.ai/",
-    auth: PROVIDER_AUTH.fireworks
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    // No `probePath`: its list-models call is `v1/accounts/{account}/models`,
+    // and the account id cannot be derived from the key. Nothing under
+    // `inference/v1/` is documented as a GET.
+    examplePath: "inference/v1/chat/completions"
   },
   cerebras: {
     directBaseUrl: "https://api.cerebras.ai/",
-    auth: PROVIDER_AUTH.cerebras
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    probePath: "v1/models"
   },
   moonshot: {
     // The international host. `api.moonshot.cn` is the separate China platform
     // and is not reachable with a key issued for this one.
     directBaseUrl: "https://api.moonshot.ai/",
-    auth: PROVIDER_AUTH.moonshot,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    probePath: "v1/models",
     modelAuthor: "Moonshot AI"
   },
   huggingface: {
@@ -14797,22 +14780,34 @@ var PROVIDER_REGISTRY = {
     // order of magnitude more on some of them than others. It ships with no
     // catalog section for that reason; see `catalogPrice` in usage.ts.
     directBaseUrl: "https://router.huggingface.co/",
-    auth: PROVIDER_AUTH.huggingface
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions"
+    // No `probePath`: `router.huggingface.co/v1/models` is public — it answers
+    // 200 to a garbage token, so probing it would validate every key. The
+    // endpoint that does check a token lives on a different origin
+    // (`huggingface.co`), which a path under this base URL cannot express.
   },
   baseten: {
     // The Model APIs inference host. `api.baseten.co` is the management plane
     // for dedicated deployments and answers to different paths entirely.
     directBaseUrl: "https://inference.baseten.co/",
-    auth: PROVIDER_AUTH.baseten
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    probePath: "v1/models"
   },
   bytedance: {
     // BytePlus ModelArk, the international edition: `/api/v3` is its version
     // segment, so client paths carry no `v1`. `ark.cn-beijing.volces.com` is
     // the separate China platform, and `ark.eu-west.bytepluses.com` is a second
     // region — keys and catalogs are region-isolated, so reaching either needs
-    // the per-row base URL override that Stage 6 introduces.
+    // the per-row base URL override.
     directBaseUrl: "https://ark.ap-southeast.bytepluses.com/api/v3/",
-    auth: PROVIDER_AUTH.bytedance
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    // No `probePath`: ModelArk publishes no list-models call, and its own SDK
+    // has no models resource. It also authenticates before it routes, so every
+    // path answers the same 401 and a probe would prove nothing about the key.
+    examplePath: "chat/completions"
   },
   openrouter: {
     // An aggregator treated as a provider type: it is the counterparty that
@@ -14821,19 +14816,57 @@ var PROVIDER_REGISTRY = {
     // `/api/v1` is its documented server URL, so the client path is
     // `v1/chat/completions` under this origin.
     directBaseUrl: "https://openrouter.ai/api/",
-    auth: PROVIDER_AUTH.openrouter,
+    auth: { header: "authorization", scheme: "Bearer " },
+    nativeClampStyle: "chat_completions",
+    // OpenRouter's key-status call, not its model list: `v1/models` is public
+    // and answers 200 to any token, exactly the trap `huggingface` has no
+    // probe for. `v1/key` answers 401 to a key that does not exist.
+    probePath: "v1/key",
+    // The one narrowed API surface, and it is a metering constraint rather than
+    // a missing one: OpenRouter also serves `/responses` and `/messages`, but
+    // only its chat-completions response carries `usage.cost`, and its slugs
+    // have no local price. Any other style would proxy traffic nothing could
+    // bill — exactly the silent $0 the fail-closed gate exists to prevent — so
+    // it is refused at the edge instead.
+    apiStyles: ["chat_completions"],
     // Every chat-completions response carries `usage.cost`: what OpenRouter
     // actually charged for that request, which beats any local estimate of a
     // catalog this deployment does not track. It is also the only way to bill
     // the type at all, since no static price list covers 400 models across
     // every lab. The declaration owns the parsing and the header that asks for
-    // the routing metadata — see `src/core/cost-report.ts`.
+    // the routing metadata — see `src/shared/cost-report.ts`.
     costReport: OPENROUTER_COST_REPORT,
     // No `modelAuthor`: an aggregator serves everyone's models, and the slug
     // namespace answers per model instead.
     authorNamespacedModels: true
   }
 };
+var PROVIDER_TYPES = Object.keys(PROVIDER_DESCRIPTORS);
+function providerDescriptor(type) {
+  return PROVIDER_DESCRIPTORS[type];
+}
+function isProviderType(value) {
+  return typeof value === "string" && Object.hasOwn(PROVIDER_DESCRIPTORS, value);
+}
+var PROVIDER_CREDENTIAL_HEADERS = [
+  ...new Set(
+    PROVIDER_TYPES.map((type) => providerDescriptor(type).auth.header.toLowerCase())
+  )
+];
+function providerCapability(provider) {
+  const descriptor = providerDescriptor(provider);
+  return {
+    apiStyles: descriptor.apiStyles ?? API_STYLES,
+    endpointStyles: Object.keys(descriptor.endpointPaths ?? {})
+  };
+}
+var ENDPOINT_PROVIDER_TYPES = PROVIDER_TYPES.filter(
+  (type) => providerCapability(type).endpointStyles.length > 0
+);
+function reportsCost(type) {
+  return isProviderType(type) && providerDescriptor(type).costReport !== void 0;
+}
+var COST_REPORTING_PROVIDER_TYPES = PROVIDER_TYPES.filter(reportsCost);
 
 // ../src/core/origin-guard.ts
 var MAX_BASE_URL_LENGTH = 200;
@@ -14943,18 +14976,61 @@ function checkOperatorBaseUrl(input) {
 }
 
 // ../src/contracts/schemas.ts
+var ISSUER_PROVIDERS = ["firebase", "supabase", "auth0", "clerk", "custom"];
+var ENTITLEMENT_CHECKS = ["revenuecat", "custom"];
+var APP_ATTEST_ENVIRONMENTS = ["production", "development"];
+var ENDPOINT_SLUG = /^[a-z0-9-]{1,64}$/;
+var PROVIDER_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+var HTTP_FIELD_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var MONTH_PATTERN = /^\d{4}-(?:0[1-9]|1[0-2])$/;
+var MONTH_FORMAT_MESSAGE = "month must use YYYY-MM format";
+var MonthSchema = external_exports.string().regex(MONTH_PATTERN, { error: MONTH_FORMAT_MESSAGE });
+var APPLE_TEAM_ID = /^[A-Z0-9]{10}$/;
+var APPLE_BUNDLE_ID = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/;
+var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var RESERVED_KEY_ERROR = "key cannot be __proto__, constructor or prototype";
+var safeKey = (schema) => schema.refine((key) => !RESERVED_OBJECT_KEYS.has(key), { error: RESERVED_KEY_ERROR });
 var ProviderTypeSchema = external_exports.enum(PROVIDER_TYPES);
 var NullableRequestLimit = external_exports.number().int().positive().nullable();
-var NullableSpendLimit = external_exports.number().nonnegative().nullable();
-var SlugSchema = external_exports.string().regex(PROVIDER_SLUG_PATTERN);
+var NullableSpendLimit = external_exports.number().nonnegative().refine((usd) => Number.isSafeInteger(Math.round(usd * 1e6)), {
+  error: "monthly_usd is too large"
+}).nullable();
+var SlugSchema = safeKey(
+  external_exports.string().regex(PROVIDER_SLUG_PATTERN).meta({
+    description: "Lowercase letters, digits and hyphens, starting with a letter or digit. `constructor` and `prototype` are reserved."
+  })
+);
+var StoredSlugSchema = external_exports.string().regex(PROVIDER_SLUG_PATTERN);
 var ClaimRequirementSchema = external_exports.object({
-  path: external_exports.string(),
+  path: external_exports.string().min(1),
   contains: external_exports.union([external_exports.string(), external_exports.array(external_exports.string()).min(1)]).optional(),
   equals: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]).optional()
+}).strict().superRefine((value, context) => {
+  if (value.contains === void 0 === (value.equals === void 0)) {
+    context.addIssue({
+      code: "custom",
+      message: "Claim requirements need exactly one of contains or equals"
+    });
+  }
 });
-var IssuerClaimValuesSchema = external_exports.union([external_exports.string().min(1), external_exports.array(external_exports.string().min(1)).min(1)]);
+var IssuerClaimValuesSchema = external_exports.union([external_exports.string().min(1), external_exports.array(external_exports.string().min(1)).min(1)]).transform((value) => typeof value === "string" ? [value] : value);
 var IssuerAuthenticationSchema = external_exports.object({
-  jwks_url: external_exports.url(),
+  /**
+   * HTTPS only, and stored in the canonical form `URL` prints: the gateway
+   * fetches this on the authentication path, so a plaintext origin would put
+   * the keys that verify every token on the wire for anyone to replace.
+   */
+  jwks_url: external_exports.url({ protocol: /^https$/, error: "Issuer JWKS URLs must be valid and use HTTPS" }).overwrite((value) => {
+    try {
+      return new URL(value).toString();
+    } catch {
+      return value;
+    }
+  }).meta({ description: "An https URL. Stored in the canonical form `URL` prints." }),
   /**
    * Required: several issuers publish one JWKS for every customer — Firebase
    * signs all projects with the same keys — so without `iss` and `aud` a token
@@ -14962,8 +15038,9 @@ var IssuerAuthenticationSchema = external_exports.object({
    */
   issuer: IssuerClaimValuesSchema,
   audience: IssuerClaimValuesSchema,
-  user_id_claim: external_exports.string(),
-  token_header: external_exports.string().optional(),
+  user_id_claim: external_exports.string().min(1),
+  /** Lowercased, because header lookups ignore case. */
+  token_header: external_exports.string().min(1).toLowerCase().optional(),
   required_claims: external_exports.array(ClaimRequirementSchema),
   max_token_lifetime_seconds: external_exports.number().int().positive(),
   /**
@@ -14971,11 +15048,30 @@ var IssuerAuthenticationSchema = external_exports.object({
    * which kind of paid-user check `required_claims` implements. Bookkeeping for
    * the console, so it can show "Firebase, project X" and reopen the same
    * form: the gateway verifies tokens from the fields above and reads neither.
+   *
+   * Refused rather than dropped when this build does not know the name: this
+   * schema is checked on the way in, so a name it cannot interpret never
+   * reaches storage in the first place.
    */
   provider: external_exports.enum(ISSUER_PROVIDERS).optional(),
   entitlement: external_exports.enum(ENTITLEMENT_CHECKS).optional()
 }).strict();
-var EndUserHeaderSchema = external_exports.string().trim().min(1).max(64).regex(HTTP_FIELD_NAME, { error: "header must be a valid HTTP header name" });
+var RESERVED_END_USER_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  ...PROVIDER_CREDENTIAL_HEADERS,
+  "x-app-version",
+  "content-type",
+  "content-length",
+  "host"
+]);
+var EndUserHeaderSchema = external_exports.string().trim().toLowerCase().min(1).max(64).regex(HTTP_FIELD_NAME, { error: "must be a valid HTTP header name" }).superRefine((header, context) => {
+  if (RESERVED_END_USER_HEADERS.has(header)) {
+    context.addIssue({
+      code: "custom",
+      message: `cannot be ${header}: the gateway already uses that header`
+    });
+  }
+});
 var HeaderEndUserSchema = external_exports.object({
   source: external_exports.literal("header"),
   header: EndUserHeaderSchema
@@ -14995,23 +15091,29 @@ var AppAttestEndUserSchema = external_exports.discriminatedUnion("source", [
   IssuerEndUserSchema,
   AppInstallEndUserSchema
 ], { error: "authentication.end_user.source must be one of issuer, app_install" });
+var AppleAppIdentitySchema = external_exports.object({
+  team_id: external_exports.string().regex(APPLE_TEAM_ID, {
+    error: "team_id must contain ten uppercase letters or digits"
+  }),
+  bundle_id: external_exports.string().regex(APPLE_BUNDLE_ID, {
+    error: "bundle_id must be a reverse DNS identifier"
+  })
+});
 var AppleAppAttestAuthenticationSchema = external_exports.object({
   type: external_exports.literal("apple_app_attest"),
   end_user: AppAttestEndUserSchema,
-  app_attest: external_exports.object({
-    team_id: external_exports.string(),
-    bundle_id: external_exports.string(),
+  app_attest: AppleAppIdentitySchema.extend({
     /**
      * Which of Apple's two App Attest environments this application accepts.
-     * Omitted means `["production"]` alone, because a development-signed build
+     * Defaulted to `["production"]` alone, because a development-signed build
      * stamps a different aaguid and is debuggable on any device carrying the
      * team's provisioning profile. Accepting one is therefore a deliberate
      * per-application opt-in, and belongs on a development bundle id rather
      * than the one shipped to the App Store.
      */
-    environments: external_exports.array(external_exports.enum(["production", "development"])).min(1).refine((values) => new Set(values).size === values.length, {
+    environments: external_exports.array(external_exports.enum(APP_ATTEST_ENVIRONMENTS)).min(1, { error: "environments must name at least one environment" }).refine((values) => new Set(values).size === values.length, {
       error: "environments cannot repeat a value"
-    }).optional()
+    }).prefault(["production"])
   }).strict()
 }).strict();
 var ApiKeyAuthenticationSchema = external_exports.object({
@@ -15024,59 +15126,96 @@ var ApiKeyAuthenticationSchema = external_exports.object({
    */
   end_user: ApiKeyEndUserSchema.optional()
 }).strict();
+var AllowedPathSchema = external_exports.union([
+  external_exports.string().min(1),
+  external_exports.object({
+    path: external_exports.string().min(1),
+    fixed_model: external_exports.string().min(1).optional(),
+    clamp: external_exports.enum(OUTPUT_CLAMP_STYLES).optional()
+  }).strict()
+]);
 var ProviderPolicySchema = external_exports.object({
-  allowed_paths: external_exports.array(external_exports.union([
-    external_exports.string(),
-    external_exports.object({
-      path: external_exports.string(),
-      fixed_model: external_exports.string().optional(),
-      clamp: external_exports.enum(["responses", "chat_completions", "gemini_native", "anthropic", "none"]).optional()
-    })
-  ])),
-  allowed_models: external_exports.array(external_exports.string()),
+  allowed_paths: external_exports.array(AllowedPathSchema),
+  allowed_models: external_exports.array(external_exports.string().min(1)),
   max_output_tokens: external_exports.number().int().positive().optional()
-});
+}).strict();
 var EndpointTargetSchema = external_exports.object({
   provider: SlugSchema,
   model: external_exports.string().min(1)
 });
 var EndpointSchema = EndpointTargetSchema.extend({
-  api_style: external_exports.enum(["responses", "transcription"]),
+  api_style: external_exports.enum(ENDPOINT_API_STYLES),
   params: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   max_output_tokens: external_exports.number().int().positive().optional(),
   fallback: external_exports.array(EndpointTargetSchema).optional()
-});
+}).strict();
 var LimitScopeSchema = external_exports.object({
   requests: external_exports.object({
     per_minute: NullableRequestLimit,
     per_day: NullableRequestLimit
-  }),
-  spending: external_exports.object({ monthly_usd: NullableSpendLimit })
-});
+  }).strict(),
+  spending: external_exports.object({ monthly_usd: NullableSpendLimit }).strict()
+}).strict();
+var UNLIMITED_SCOPE = {
+  requests: { per_minute: null, per_day: null },
+  spending: { monthly_usd: null }
+};
+function identifiesEndUsers(authentication) {
+  return authentication.type !== "api_key" || authentication.end_user !== void 0;
+}
+var scopeHasLimits = (scope) => scope.requests.per_minute !== null || scope.requests.per_day !== null || scope.spending.monthly_usd !== null;
 var AppConfigSchema = external_exports.object({
   authentication: external_exports.discriminatedUnion("type", [
     AppleAppAttestAuthenticationSchema,
     ApiKeyAuthenticationSchema
   ]),
   routing: external_exports.object({
-    providers: external_exports.object({
-      mode: external_exports.enum(["all", "selected"]),
-      selected: external_exports.record(SlugSchema, ProviderPolicySchema).optional()
-    }),
-    model_rewrites: external_exports.record(external_exports.string(), external_exports.string())
-  }),
+    /**
+     * Discriminated, because the two modes carry different fields: `all` names
+     * nothing and `selected` must name its policies. Declaring `selected` as an
+     * optional member of one object would make "all mode with a selection" and
+     * "selected mode with nothing selected" both expressible.
+     */
+    providers: external_exports.discriminatedUnion("mode", [
+      external_exports.object({ mode: external_exports.literal("all") }).strict(),
+      external_exports.object({
+        mode: external_exports.literal("selected"),
+        selected: external_exports.record(SlugSchema, ProviderPolicySchema, {
+          error: "routing.providers.selected must be keyed by provider instance slug"
+        })
+      }).strict()
+    ], { error: "routing.providers.mode must be all or selected" }),
+    model_rewrites: external_exports.record(safeKey(external_exports.string().min(1)), external_exports.string().min(1), {
+      error: "routing.model_rewrites must be keyed by a model name"
+    })
+  }).strict(),
   /**
-   * The organization's own limits on its app's end users. Optional: an absent
-   * block is unlimited, so an app that never sets one stores nothing.
+   * The organization's own limits on its app's end users, always present on a
+   * parsed configuration: an unwritten block is the unlimited one.
    */
   limits: external_exports.object({
-    per_user: LimitScopeSchema,
-    per_app: LimitScopeSchema
-  }).optional(),
-  endpoints: external_exports.record(external_exports.string().regex(ENDPOINT_SLUG), EndpointSchema).optional()
+    per_user: LimitScopeSchema.prefault(UNLIMITED_SCOPE),
+    per_app: LimitScopeSchema.prefault(UNLIMITED_SCOPE)
+  }).strict().prefault({}),
+  endpoints: external_exports.record(
+    safeKey(external_exports.string().regex(ENDPOINT_SLUG)),
+    EndpointSchema,
+    { error: "is not a valid slug; use 1-64 characters from a-z, 0-9, and -" }
+  ).prefault({})
+}).strict().superRefine((config2, context) => {
+  const authentication = config2.authentication;
+  const perUser = config2.limits?.per_user;
+  if (authentication !== void 0 && perUser !== void 0 && !identifiesEndUsers(authentication) && scopeHasLimits(perUser)) {
+    context.addIssue({
+      code: "custom",
+      path: ["limits", "per_user"],
+      message: "needs an authentication.end_user source: this application identifies no end users, so use limits.per_app"
+    });
+  }
 }).meta({ id: "AppConfig" });
 var AppWriteSchema = external_exports.object({
-  name: external_exports.string().min(1).max(100),
+  /** Trimmed, so a name of nothing but spaces is the empty name it looks like. */
+  name: external_exports.string().trim().min(1).max(100),
   config: AppConfigSchema,
   status: external_exports.enum(["active", "disabled"]).optional()
 }).strict().meta({ id: "AppWrite" });
@@ -15104,7 +15243,7 @@ var ApiKeyTokenRequestSchema = external_exports.object({
 var UsageRepriceRequestSchema = external_exports.object({
   provider: ProviderTypeSchema,
   model: external_exports.string().min(1),
-  month: external_exports.string().regex(/^\d{4}-\d{2}$/),
+  month: MonthSchema,
   apply: external_exports.boolean().default(false)
 }).strict().meta({ id: "UsageRepriceRequest" });
 var ProviderPricingSchema = external_exports.record(
@@ -15130,15 +15269,17 @@ var GatewayRouteConfigSchema = external_exports.object({
   modelPrefix: external_exports.string().trim().min(1).max(100).optional(),
   providerOnly: external_exports.array(external_exports.string().trim().min(1).max(100)).min(1).max(20).optional()
 }).strict().meta({ id: "GatewayRouteConfig" });
-var ProviderCreateRequestSchema = external_exports.object({
+var ProviderCreateFieldsSchema = external_exports.object({
   type: ProviderTypeSchema,
   name: ProviderNameSchema,
   slug: SlugSchema.optional(),
-  secret: ProviderSecretSchema.optional(),
   providerGatewayId: external_exports.string().trim().min(1).optional(),
   gatewayRoute: GatewayRouteConfigSchema.optional(),
   baseUrl: ProviderBaseUrlSchema.optional(),
   pricing: ProviderPricingSchema.optional()
+});
+var ProviderCreateRequestSchema = ProviderCreateFieldsSchema.extend({
+  secret: ProviderSecretSchema.optional()
 }).strict().superRefine((value, context) => {
   if (value.secret === void 0 === (value.providerGatewayId === void 0)) {
     context.addIssue({
@@ -15165,21 +15306,22 @@ var ProviderTestRequestSchema = external_exports.object({
   }
   assertBaseUrlIsDirect(value, context);
 }).meta({ id: "ProviderTestRequest" });
+var CfAigGatewayFieldsSchema = external_exports.object({
+  type: external_exports.literal("cf_aig"),
+  name: ProviderNameSchema,
+  accountId: external_exports.string().trim().min(1).max(100),
+  gatewayId: external_exports.string().trim().min(1).max(100)
+});
+var VercelGatewayFieldsSchema = external_exports.object({
+  type: external_exports.literal("vercel"),
+  name: ProviderNameSchema
+});
+var GATEWAY_TYPE_ERROR = "Provider gateway type must be one of cf_aig, vercel";
 var ProviderGatewayCreateRequestSchema = external_exports.discriminatedUnion("type", [
-  external_exports.object({
-    type: external_exports.literal("cf_aig"),
-    name: ProviderNameSchema,
-    accountId: external_exports.string().trim().min(1).max(100),
-    gatewayId: external_exports.string().trim().min(1).max(100),
-    token: ProviderSecretSchema
-  }).strict(),
-  external_exports.object({
-    type: external_exports.literal("vercel"),
-    name: ProviderNameSchema,
-    token: ProviderSecretSchema
-  }).strict()
+  CfAigGatewayFieldsSchema.extend({ token: ProviderSecretSchema }).strict(),
+  VercelGatewayFieldsSchema.extend({ token: ProviderSecretSchema }).strict()
 ], {
-  error: "Provider gateway type must be one of cf_aig, vercel"
+  error: GATEWAY_TYPE_ERROR
 }).meta({ id: "ProviderGatewayCreateRequest" });
 var ProviderGatewayTestRequestSchema = external_exports.discriminatedUnion("type", [
   external_exports.object({
@@ -15204,10 +15346,8 @@ var ProviderGatewayRotateRequestSchema = external_exports.object({
   revision: external_exports.number().int().positive().meta({ description: "The gateway revision returned by the read this rotation is based on." })
 }).strict().meta({ id: "ProviderGatewayRotateRequest" });
 var BASE_URL_REQUIRES_SECRET = "Changing the base URL requires re-supplying the provider key, because the stored key is never sent to a new origin";
-var ProviderUpdateRequestSchema = external_exports.object({
-  revision: external_exports.number().int().positive().meta({ description: "The provider revision returned by the read this update is based on." }),
+var ProviderUpdateFieldsSchema = external_exports.object({
   name: ProviderNameSchema.optional(),
-  secret: ProviderSecretSchema.optional(),
   /** A full replace; `null` clears the row's routing configuration. */
   gatewayRoute: GatewayRouteConfigSchema.nullable().optional(),
   /**
@@ -15223,6 +15363,10 @@ var ProviderUpdateRequestSchema = external_exports.object({
    * nothing can take the slug meanwhile and re-enabling always succeeds.
    */
   status: external_exports.enum(["active", "disabled"]).optional()
+});
+var ProviderUpdateRequestSchema = ProviderUpdateFieldsSchema.extend({
+  revision: external_exports.number().int().positive().meta({ description: "The provider revision returned by the read this update is based on." }),
+  secret: ProviderSecretSchema.optional()
 }).strict().superRefine((value, context) => {
   if (value.name === void 0 && value.secret === void 0 && value.gatewayRoute === void 0 && value.baseUrl === void 0 && value.pricing === void 0 && value.status === void 0) {
     context.addIssue({
@@ -15234,12 +15378,73 @@ var ProviderUpdateRequestSchema = external_exports.object({
     context.addIssue({ code: "custom", message: BASE_URL_REQUIRES_SECRET, path: ["secret"] });
   }
 }).meta({ id: "ProviderUpdateRequest" });
+var HandoffTargetFields = {
+  /** The existing row the handoff edits. */
+  id: external_exports.string().trim().min(1),
+  /** The revision the CLI read, when it read one; the server pins the current one either way. */
+  revision: external_exports.number().int().positive().optional()
+};
+var HandoffProviderAddPayloadSchema = ProviderCreateFieldsSchema.strict().superRefine(assertBaseUrlIsDirect);
+var HandoffProviderUpdatePayloadSchema = ProviderUpdateFieldsSchema.extend(HandoffTargetFields).strict().superRefine((value, context) => {
+  if (value.name === void 0 && value.gatewayRoute === void 0 && value.baseUrl === void 0 && value.pricing === void 0 && value.status === void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "Provide at least one of name, gatewayRoute, baseUrl, pricing, or status"
+    });
+  }
+});
+var HandoffRotatePayloadSchema = external_exports.object(HandoffTargetFields).strict();
+var HandoffProviderGatewayAddPayloadSchema = external_exports.discriminatedUnion("type", [
+  CfAigGatewayFieldsSchema.strict(),
+  VercelGatewayFieldsSchema.strict()
+], { error: GATEWAY_TYPE_ERROR });
 var OrganizationRoleSchema = external_exports.enum(["owner", "admin", "member"]);
 var OrganizationSelectRequestSchema = external_exports.object({
   organizationId: external_exports.string().trim().min(1)
 }).meta({ id: "OrganizationSelectRequest" });
+var CredentialNameRequestSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(100)
+});
+var ManagementKeyCreateRequestSchema = CredentialNameRequestSchema.meta({ id: "ManagementKeyCreateRequest" });
+var ApiKeyCreateRequestSchema = CredentialNameRequestSchema.meta({ id: "ApiKeyCreateRequest" });
+
+// ../src/shared/app-config.ts
+function selectedProviderPolicies(routing) {
+  return routing.providers.mode === "selected" ? routing.providers.selected : {};
+}
+function providerPolicyFor(routing, slug) {
+  if (routing.providers.mode === "all") return { allowed_paths: [], allowed_models: [] };
+  return Object.hasOwn(routing.providers.selected, slug) ? routing.providers.selected[slug] : void 0;
+}
+function reachableProviders(routing, instances) {
+  return instances.filter(
+    (instance) => instance.status === "active" && providerPolicyFor(routing, instance.slug) !== void 0
+  );
+}
 
 // ../src/contracts/responses.ts
+var USAGE_STATUSES = [
+  "ok",
+  "provider_error",
+  "blocked_app_rate",
+  "blocked_app_budget",
+  "blocked_billing",
+  "blocked_user"
+];
+var USAGE_BREAKDOWN_DIMENSIONS = [
+  "model",
+  "provider",
+  "provider_slug",
+  "provider_gateway",
+  "credential_source",
+  "model_author",
+  "user",
+  "status",
+  "cost_source",
+  "route",
+  "endpoint",
+  "app_version"
+];
 var ErrorResponseSchema = external_exports.object({
   error: external_exports.object({
     code: external_exports.string(),
@@ -15267,6 +15472,24 @@ var AppAttestChallengeResponseSchema = external_exports.object({
   expires_in: external_exports.number()
 });
 var AppAttestRegisterResponseSchema = external_exports.object({ user_id: external_exports.string() });
+var GatewayTokenResponseSchema = external_exports.object({
+  access_token: external_exports.string(),
+  expires_in: external_exports.number()
+});
+var CurrentUserResponseSchema = external_exports.object({
+  user_id: external_exports.string(),
+  limits: external_exports.object({
+    requests_today: external_exports.number().int().nullable().meta({ description: "Requests this user has made so far in the current UTC day. Null when the application sets no per-user limit, in which case requests are not counted at all." }),
+    requests_remaining: external_exports.number().int().nullable().meta({ description: "What is left of requests_per_day. Null when no daily limit is set." }),
+    requests_per_minute: external_exports.number().nullable().meta({ description: "The per-user per-minute limit this app sets. Null means unlimited." }),
+    requests_per_day: external_exports.number().nullable().meta({ description: "The per-user per-day limit this app sets. Null means unlimited." }),
+    monthly_cost_usd: external_exports.number().meta({ description: "What this user's traffic has cost so far in the current UTC calendar month." }),
+    monthly_budget_usd: external_exports.number().nullable().meta({ description: "The per-user monthly spending budget this app sets. Null means unlimited." }),
+    blocked: external_exports.boolean().meta({ description: "Whether this user has been blocked in the console." })
+  }).meta({
+    description: "The limits the app sets on this user, and where the user stands against them. The account's request allowance is not reported here: it is shared by all apps, and is reported on the rejection that spends it."
+  })
+});
 var UsageEventSchema = external_exports.object({
   id: external_exports.number().int(),
   /** Null for an application that identifies no end users. */
@@ -15310,7 +15533,7 @@ var UsageEventSchema = external_exports.object({
   }),
   app_version: external_exports.string().nullable(),
   auth_method: external_exports.enum(["attest", "api_key"]).nullable(),
-  status: external_exports.enum(["ok", "provider_error", "blocked_app_rate", "blocked_app_budget", "blocked_billing", "blocked_user"]),
+  status: external_exports.enum(USAGE_STATUSES),
   client_aborted: external_exports.number().int().nullable().meta({
     description: "1 when the client disconnected before the upstream finished streaming, which cancelled the provider call; null otherwise. Not a failure \u2014 the request was served as far as the caller wanted it \u2014 but an aborted stream often takes the provider's end-of-response usage with it, which is why such an event may carry cost_source unresolved."
   }),
@@ -15389,18 +15612,18 @@ var AppResponseSchema = external_exports.object({
     id: external_exports.string().meta({ description: "The gateway-assigned id, and the `{app}` segment of every URL for this application." }),
     name: external_exports.string(),
     /**
-     * An `AppConfig`, except on the one row this shape's own `config_error`
-     * describes: a configuration written before a schema change is returned as
-     * it is stored, so an operator can read and repair it. Declared as the
-     * union rather than as `AppConfig` alone because a client that parses this
-     * response must still be able to read such a row.
+     * An `AppConfig` — the parsed one, which is also the stored one: what the
+     * gateway accepts is what it keeps, so there is no second "resolved" view
+     * of it to publish. The one exception is the row this shape's own
+     * `config_error` describes: a configuration written before a schema change
+     * is returned as it is stored, so an operator can read and repair it, and
+     * that is why this is declared as the union rather than as `AppConfig`.
      */
     config: external_exports.union([AppConfigSchema, external_exports.record(external_exports.string(), external_exports.unknown())]),
     status: external_exports.enum(["active", "disabled"]),
     created_at: external_exports.string(),
     updated_at: external_exports.string()
   }),
-  resolved: external_exports.record(external_exports.string(), external_exports.unknown()).nullable().meta({ description: "The configuration as the request path resolves it, with provider routing and limits applied. Null when the stored configuration does not parse, which is the one case `app.config` is not an AppConfig." }),
   config_error: external_exports.string().nullable().meta({ description: "Why the stored configuration does not parse, for a row written before a schema change. Always null on create and update, which validate before they write." })
 }).meta({ id: "AppResponse" });
 var AppDeleteResponseSchema = external_exports.object({
@@ -15435,7 +15658,7 @@ var ManagementKeyResponseSchema = external_exports.object({ key: ManagementKeySu
 var ProviderSummarySchema = external_exports.object({
   id: external_exports.string(),
   type: external_exports.enum(PROVIDER_TYPES),
-  slug: SlugSchema.meta({ description: "The URL segment used under /proxy/{slug}/, unique across your providers." }),
+  slug: StoredSlugSchema.meta({ description: "The URL segment used under /proxy/{slug}/, unique across your providers." }),
   name: external_exports.string(),
   secretHint: external_exports.string().nullable().meta({
     description: "Last characters of a direct provider key; null when a shared provider gateway owns the token."
@@ -15611,13 +15834,17 @@ var AppSummarySchema = external_exports.object({
 });
 var AppListResponseSchema = external_exports.object({
   month: external_exports.string(),
-  has_proxied_requests: external_exports.boolean(),
+  has_proxied_requests: external_exports.boolean().meta({
+    description: "Whether this account has ever had a request recorded, at any time. Unlike the per-application `usage` totals beside it, which cover `month` only, this does not reset when a new month begins, and it never goes from true back to false. Intended for first-run interfaces that stop offering setup guidance once traffic has started."
+  }),
   apps: external_exports.array(AppSummarySchema)
 });
 var AppValidateResponseSchema = external_exports.object({
   valid: external_exports.literal(true),
-  app_id: external_exports.string(),
-  exists: external_exports.boolean()
+  app_id: external_exports.string()
+});
+var AppDraftValidateResponseSchema = external_exports.object({
+  valid: external_exports.literal(true)
 });
 var CreatedApiKeySchema = external_exports.object({
   id: external_exports.string(),
@@ -15700,11 +15927,32 @@ var BreakdownRowSchema = UsageTotalsSchema.extend({
 });
 var BreakdownResponseSchema = external_exports.object({
   app_id: external_exports.string(),
-  by: external_exports.string(),
+  by: external_exports.enum(USAGE_BREAKDOWN_DIMENSIONS),
   from: external_exports.string(),
   to: external_exports.string(),
   rows: external_exports.array(BreakdownRowSchema)
 });
+var UsageRepriceResponseSchema = external_exports.object({
+  app_id: external_exports.string(),
+  provider: external_exports.string(),
+  model: external_exports.string(),
+  month: external_exports.string(),
+  applied: external_exports.boolean(),
+  matched_events: external_exports.number().int(),
+  unmetered_events: external_exports.number().int().meta({
+    description: "Matched events that carried no readable usage, and so were repriced to the zero their zero counts imply while keeping whatever cost_source they had. A non-zero number means the month contains spend nothing could meter, which repricing cannot fix and must not appear to have fixed."
+  }),
+  unpriced_events: external_exports.number().int().meta({
+    description: "Dry-run only: matched events whose serving instance can no longer price them."
+  }),
+  unpriced_cost_usd: external_exports.number(),
+  previous_cost_usd: external_exports.number(),
+  recalculated_cost_usd: external_exports.number(),
+  delta_usd: external_exports.number(),
+  reconciled_users: external_exports.number().int().meta({
+    description: "End-user spend ledgers reprojected inside this request; the rest are left to scheduled recovery."
+  })
+});
 var ModelPriceSchema = external_exports.object({
   input: external_exports.number().optional(),
   output: external_exports.number().optional(),
@@ -15725,18 +15973,25 @@ var PricesResponseSchema = external_exports.object({
 // ../src/contracts/cli.ts
 var CliProofSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{32,256}$/);
 var CliBootstrapRequestSchema = external_exports.object({ idempotencyKey: CliProofSchema, pollToken: CliProofSchema }).strict();
-var CliOperationRequestSchema = external_exports.object({
-  kind: external_exports.enum([
-    "claim",
-    "provider.add",
-    "provider.rotate-key",
-    "provider.update",
-    "provider-gateway.add",
-    "provider-gateway.rotate-key"
-  ]),
-  payload: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
-  pollToken: CliProofSchema
-}).strict();
+var CliOperationKindSchema = external_exports.enum([
+  "claim",
+  "provider.add",
+  "provider.rotate-key",
+  "provider.update",
+  "provider-gateway.add",
+  "provider-gateway.rotate-key"
+]);
+function operationRequest(kind, payload) {
+  return external_exports.object({ kind: external_exports.literal(kind), payload, pollToken: CliProofSchema }).strict();
+}
+var CliOperationRequestSchema = external_exports.discriminatedUnion("kind", [
+  operationRequest("claim", external_exports.object({}).strict().default({})),
+  operationRequest("provider.add", HandoffProviderAddPayloadSchema),
+  operationRequest("provider.rotate-key", HandoffRotatePayloadSchema),
+  operationRequest("provider.update", HandoffProviderUpdatePayloadSchema),
+  operationRequest("provider-gateway.add", HandoffProviderGatewayAddPayloadSchema),
+  operationRequest("provider-gateway.rotate-key", HandoffRotatePayloadSchema)
+]);
 var CliSubmissionRequestSchema = external_exports.object({
   submissionToken: CliProofSchema,
   approve: external_exports.literal(true).optional(),
@@ -15767,7 +16022,7 @@ var CliViewerSchema = external_exports.object({
   email: external_exports.string().nullable()
 });
 var CliBrowserDetailsResponseSchema = external_exports.object({
-  kind: CliOperationRequestSchema.shape.kind,
+  kind: CliOperationKindSchema,
   payload: external_exports.record(external_exports.string(), external_exports.unknown()),
   account: CliAccountSchema,
   viewer: CliViewerSchema.nullable(),
@@ -15800,11 +16055,17 @@ var CliBrowserGoogleResponseSchema = external_exports.object({
 var CliCredentialSchema = external_exports.object({
   token: external_exports.string()
 });
+var UnclaimedAccessSchema = external_exports.object({ endsAt: external_exports.string(), limit: external_exports.number().int().optional() }).nullable();
 var CliBootstrapResponseSchema = external_exports.object({
   deployment: CliDeploymentSchema,
   account: CliAccountSchema,
   credential: CliCredentialSchema,
-  trial: external_exports.object({ endsAt: external_exports.string(), limit: external_exports.number().int().optional() }).nullable()
+  /**
+   * On a hosted deployment, when this unclaimed account's free access ends and
+   * the request allowance it has until then; null on a self-host, where an
+   * account has no such window.
+   */
+  unclaimedAccess: UnclaimedAccessSchema
 });
 var CliOperationResponseSchema = external_exports.object({
   id: external_exports.string(),
@@ -15921,57 +16182,6 @@ var CliAccountResponseSchema = external_exports.object({
   billing: CliBillingSchema,
   usage: CliQuotaUsageSchema
 });
-
-// ../src/contracts/operation-schemas.ts
-var responseSchemas = {
-  getConsoleCapabilities: ConsoleCapabilitiesResponseSchema,
-  getAdminSession: IdentitySessionSchema,
-  listOrganizations: OrganizationListResponseSchema,
-  selectOrganization: IdentitySessionSchema,
-  listManagementKeys: ManagementKeyListResponseSchema,
-  createManagementKey: CreatedManagementKeyResponseSchema,
-  revokeManagementKey: ManagementKeyResponseSchema,
-  listProviders: ProviderListResponseSchema,
-  createProvider: ProviderResponseSchema,
-  testProvider: ProviderTestResponseSchema,
-  updateProvider: ProviderResponseSchema,
-  deleteProvider: ProviderDeleteResponseSchema,
-  listProviderGateways: ProviderGatewayListResponseSchema,
-  createProviderGateway: ProviderGatewayResponseSchema,
-  testProviderGateway: ProviderGatewayTestResponseSchema,
-  updateProviderGateway: ProviderGatewayResponseSchema,
-  rotateProviderGateway: ProviderGatewayResponseSchema,
-  deleteProviderGateway: ProviderGatewayDeleteResponseSchema,
-  listApps: AppListResponseSchema,
-  createApp: CreatedAppResponseSchema,
-  getApp: AppResponseSchema,
-  updateApp: AppResponseSchema,
-  deleteApp: AppDeleteResponseSchema,
-  validateApp: AppValidateResponseSchema,
-  listAppKeys: ApiKeyListResponseSchema,
-  createAppKey: CreatedApiKeySchema,
-  revokeAppKey: ApiKeyRevokeResponseSchema,
-  listAppUsers: UserListResponseSchema,
-  setAppUserBlocked: UserBlockResponseSchema,
-  getAppUsage: MonthlyUsageResponseSchema,
-  getAppUsageTimeseries: TimeseriesResponseSchema,
-  getAppUsageBreakdown: BreakdownResponseSchema,
-  listAppEvents: UsageEventListSchema,
-  getAppAuthEventSummary: AuthEventSummarySchema,
-  listAppAuthEvents: AuthEventListSchema,
-  listModelPrices: PricesResponseSchema,
-  getCliCapabilities: CliCapabilitiesResponseSchema,
-  bootstrapCliAccount: CliBootstrapResponseSchema,
-  createCliOperation: CliOperationResponseSchema,
-  pollCliOperation: CliPollResponseSchema,
-  getCliAccount: CliAccountResponseSchema,
-  getCliUsage: CliUsageResponseSchema,
-  cliBrowserDetails: CliBrowserDetailsResponseSchema,
-  cliBrowserSubmit: CliBrowserSubmitResponseSchema,
-  cliBrowserRegister: CliBrowserRegisterResponseSchema,
-  cliBrowserGoogle: CliBrowserGoogleResponseSchema
-};
-var responseSchemaFor = responseSchemas;
 var CliErrorDetailsSchema = external_exports.object({
   status: external_exports.number().optional(),
   appId: external_exports.string().optional(),
@@ -16006,7 +16216,1058 @@ var CliErrorDetailsSchema = external_exports.object({
 // src/apps.ts
 import { createHash as createHash2 } from "node:crypto";
 
-// ../src/contracts/operations.ts
+// ../src/contracts/billing.ts
+var BillingSubscriptionStatusSchema = external_exports.enum([
+  "on_trial",
+  "active",
+  "paused",
+  "past_due",
+  "unpaid",
+  "cancelled",
+  "expired"
+]);
+var BillingSourceSchema = external_exports.enum(["lemon_squeezy", "manual"]);
+var BillingPeriodSchema = external_exports.enum(["month", "year"]);
+var EntitledPlanSchema = external_exports.object({
+  planKey: external_exports.string(),
+  planName: external_exports.string(),
+  limits: external_exports.unknown().optional(),
+  /** True when it came from the service's default plan rather than a subscription. */
+  isDefault: external_exports.boolean()
+}).meta({ id: "EntitledPlan" });
+var SubscriptionStateSchema = external_exports.object({
+  subscriptionId: external_exports.string().nullable(),
+  status: BillingSubscriptionStatusSchema,
+  planKey: external_exports.string(),
+  planName: external_exports.string(),
+  /** Null for trials and manual grants, which carry no price. */
+  billingPeriod: BillingPeriodSchema.nullable(),
+  renewsAt: external_exports.string().nullable(),
+  endsAt: external_exports.string().nullable(),
+  trialEndsAt: external_exports.string().nullable(),
+  source: BillingSourceSchema,
+  /** This subscription generation */
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  /** Original provider day, retained when short months clamp the exact anchor. */
+  billingAnchorDay: external_exports.number().nullable(),
+  /** Exact normalized UTC origin of the monthly allowance schedule. */
+  billingAnchorAt: external_exports.string(),
+  /** When the current allowance schedule took effect. */
+  billingScheduleUpdatedAt: external_exports.string()
+}).meta({ id: "Subscription" });
+var BillingAccessSchema = external_exports.object({
+  /** `null` means no entitlement at all, and the gateway refuses the request. */
+  plan: EntitledPlanSchema.nullable(),
+  /** `null` means the organization has no billing row. */
+  subscription: SubscriptionStateSchema.nullable()
+});
+var GatewayBillingAccessSchema = external_exports.discriminatedUnion("state", [
+  /** No `BILLING` binding: self-hosted, unlimited, never refused. */
+  external_exports.object({ state: external_exports.literal("self_hosted") }),
+  /** The billing RPC failed. The allowance is unknown, so traffic waits. */
+  external_exports.object({ state: external_exports.literal("unavailable"), billingErrorCode: external_exports.string().optional() }),
+  /** The billing service answered. `plan === null` means no entitlement at all. */
+  external_exports.object({
+    state: external_exports.literal("billed"),
+    plan: EntitledPlanSchema.nullable(),
+    subscription: SubscriptionStateSchema.nullable(),
+    /**
+     * Set when the billing service could not be reached and this is the last
+     * reading it gave for the organization. Entitlement decisions are
+     * unchanged: a stale `plan === null` is still a paywall.
+     */
+    stale: external_exports.literal(true).optional(),
+    /** Why the refresh failed, on a stale reading. */
+    billingErrorCode: external_exports.string().optional()
+  })
+]).meta({ id: "BillingAccess" });
+var PlanLimitsSchema = external_exports.object({
+  maxRequestsPerMonth: external_exports.number().int().optional().meta({ description: "Requests the account may dispatch per allowance period." }),
+  maxApps: external_exports.number().int().optional().meta({ description: "Applications the account may own." }),
+  maxProviders: external_exports.number().int().optional().meta({ description: "Providers the account may own." }),
+  maxProviderGateways: external_exports.number().int().optional().meta({ description: "Provider gateways the account may own." }),
+  maxActiveKeysPerApp: external_exports.number().int().optional().meta({ description: "Active API keys each of the account's applications may hold." })
+}).meta({
+  description: "The plan's ceilings, as this gateway enforces them. Every key is optional and an absent key means unlimited, so an empty object is a plan with no ceilings. A write that would exceed one is refused with billing_plan_limit_reached."
+});
+var OrganizationQuotaStatusSchema = external_exports.object({
+  periodId: external_exports.string().meta({ description: "Opaque identifier for the allowance period being reported." }),
+  periodStart: external_exports.string().meta({ description: "Inclusive UTC instant at which this allowance period began." }),
+  periodEnd: external_exports.string().meta({ description: "Exclusive UTC instant at which this allowance period ends." }),
+  used: external_exports.number().int().meta({ description: "Requests dispatched to a provider in this period, across all apps." }),
+  limit: external_exports.number().int().optional().meta({ description: "The plan's maxRequestsPerMonth. Absent means unlimited." }),
+  resetAt: external_exports.string().meta({ description: "UTC instant at which the allowance resets; currently equal to periodEnd." })
+});
+var SubscriptionActionsSchema = external_exports.object({
+  cancel: external_exports.boolean().meta({ description: "A self-service subscription can be cancelled at the end of its period." }),
+  resume: external_exports.boolean().meta({ description: "A cancelled self-service subscription can be resumed." }),
+  manual: external_exports.boolean().meta({ description: "A live grant made by hand, which no self-service action may change." })
+});
+var BillingStatusResponseSchema = external_exports.object({
+  access: GatewayBillingAccessSchema,
+  limits: PlanLimitsSchema,
+  quota: OrganizationQuotaStatusSchema.nullable().meta({
+    description: "Null when billing is unavailable or no plan entitlement resolves."
+  }),
+  actions: SubscriptionActionsSchema,
+  unclaimedAccessEndsAt: external_exports.string().nullable().meta({
+    description: "When this account's free access ends if nobody claims it; null once a person owns it."
+  })
+});
+var BillingPlanOfferPriceSchema = external_exports.object({
+  billingPeriod: BillingPeriodSchema,
+  priceAmountCents: external_exports.number(),
+  priceCurrency: external_exports.string()
+});
+var BillingPlanOfferSchema = external_exports.object({
+  planKey: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string(),
+  features: external_exports.array(external_exports.string()),
+  limits: external_exports.unknown().optional(),
+  trialDays: external_exports.number(),
+  prices: external_exports.array(BillingPlanOfferPriceSchema)
+}).meta({ id: "BillingPlan" });
+var BillingPlansResponseSchema = external_exports.object({
+  plans: external_exports.array(BillingPlanOfferSchema)
+});
+var BillingPlanSelectionSchema = external_exports.object({
+  planKey: external_exports.string().min(1),
+  billingPeriod: BillingPeriodSchema
+});
+var BillingCheckoutRequestSchema = BillingPlanSelectionSchema.extend({
+  successUrl: external_exports.url().optional(),
+  cancelUrl: external_exports.url().optional()
+});
+var BillingCheckoutResponseSchema = external_exports.object({ url: external_exports.string() });
+var BillingChangeResponseSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  requiredActionUrl: external_exports.string().optional()
+});
+var BillingCancelResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
+var BillingTrialRequestSchema = external_exports.object({ planKey: external_exports.string().min(1) });
+var billingSubscriptionStatuses = BillingSubscriptionStatusSchema.options;
+var billingSources = BillingSourceSchema.options;
+var billingPeriods = BillingPeriodSchema.options;
+
+// ../src/contracts/catalog.ts
+var NO_PLAN = "No billing plan resolves for the account.";
+var APP_AUTH_RATE_LIMITED = "Too many application authentication requests from this network address for this application. Carries Retry-After.";
+var NO_END_USERS = "This application identifies no end users, so there is no per-user standing to report. Answered with auth_method_not_supported: the request was well-formed, and nothing the caller can rephrase would make it work.";
+var DATA_PLANE_RATE_LIMITED = "Either the app's own limits or the account's request allowance refused the request. The app's limits are checked first and answer app_rate_limited or app_budget_exhausted, carrying scope; the plan allowance answers billing_request_quota_exceeded with limit, used, and the UTC resetAt. Every one of them carries a Retry-After header.";
+var ISSUER_ERRORS = {
+  403: "`issuer_token_rejected` \u2014 the token did not verify; get a fresh one, retry once, then fail. `issuer_claims_missing` \u2014 the token is valid but a required entitlement claim has not propagated yet; do not re-authenticate, wait and retry. `auth_required` \u2014 the key was refused or the user is blocked. `attest_failed` \u2014 the App Attest proof did not hold.",
+  503: "`issuer_verification_unavailable` \u2014 the gateway could not reach or read the issuer's keys, so the token was never judged. Retry with backoff."
+};
+var CLI_ERRORS = {
+  409: "A conflicting transition or setup cap prevents this operation.",
+  410: "The protected credential exchange has expired; no replacement is minted.",
+  429: "The durable initiation or submission rate limit was reached."
+};
+var BROWSER_HANDOFF_DESCRIPTION = "First-party browser only: both the request URL origin and exact Origin header must match consoleOrigin; a separate submissionToken is required. Identity approval also requires an interactive human session; registration is limited to a valid pending claim. Provider secret values are write-only.";
+var SignUpRequestSchema = external_exports.object({
+  name: external_exports.string(),
+  email: external_exports.email(),
+  password: external_exports.string().min(8)
+});
+var SignInRequestSchema = external_exports.object({ email: external_exports.email(), password: external_exports.string() });
+var ProviderNativeBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).meta({
+  description: "Provider-native JSON request. Consult the selected provider's API reference for the exact shape."
+});
+var ResponsesStyleBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).meta({
+  description: "OpenAI Responses API body for endpoints whose api_style is responses. The gateway overwrites model and deep-merges the configured params."
+});
+var TranscriptionStyleBodySchema = external_exports.object({
+  file: external_exports.string().meta({ format: "binary" }),
+  model: external_exports.string().optional().meta({ description: "Ignored; the gateway sets the configured model." }),
+  prompt: external_exports.string().optional(),
+  language: external_exports.string().optional(),
+  response_format: external_exports.string().optional()
+}).meta({ description: "Body for endpoints whose api_style is transcription." });
+var GatewayClientHeadersSchema = external_exports.object({
+  "x-app-version": external_exports.string().optional().meta({
+    description: "Required for gateway-token clients; optional for issuer-less API-key clients."
+  }),
+  "x-end-user-id": external_exports.string().optional().meta({
+    description: "Optional configured end-user identity for issuer-less API-key applications."
+  })
+});
+var MonthQuerySchema = external_exports.object({
+  month: MonthSchema.optional().meta({ description: "YYYY-MM; defaults to the current UTC month." })
+});
+var DaySchema = (name) => external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, { error: `${name} must use YYYY-MM-DD format` });
+var RangeQuerySchema = external_exports.object({
+  from: DaySchema("from").optional().meta({ description: "Inclusive YYYY-MM-DD start; defaults to 29 days before `to`." }),
+  to: DaySchema("to").optional().meta({ description: "Inclusive YYYY-MM-DD end; defaults to today." })
+});
+var PageLimitSchema = external_exports.coerce.number().int({ error: "limit must be an integer between 1 and 200" }).min(1, { error: "limit must be an integer between 1 and 200" }).max(200, { error: "limit must be an integer between 1 and 200" }).default(50);
+var BeforeIdSchema = external_exports.coerce.number().int({ error: "before_id must be a positive integer" }).positive({ error: "before_id must be a positive integer" }).optional().meta({ description: "Page backwards: only events older than this id." });
+var APP_PARAM = { app: { example: "my-app" } };
+var NO_RESPONSE_BODY = external_exports.never();
+var CATALOG = {
+  getHealth: {
+    method: "GET",
+    path: "/v1/healthz",
+    tags: ["Operations"],
+    summary: "Check gateway health",
+    security: "public",
+    response: HealthResponseSchema,
+    responseDescription: "The Worker is accepting requests.",
+    errors: "none"
+  },
+  getConsoleCapabilities: {
+    method: "GET",
+    path: "/v1/console/capabilities",
+    tags: ["Operations"],
+    summary: "Discover optional deployment capabilities",
+    security: "public",
+    response: ConsoleCapabilitiesResponseSchema,
+    responseDescription: "Capabilities the console adapts to.",
+    errors: "none"
+  },
+  signUp: {
+    method: "POST",
+    path: "/v1/auth/sign-up/email",
+    tags: ["Console authentication"],
+    summary: "Create an account",
+    security: "public",
+    request: SignUpRequestSchema,
+    response: external_exports.unknown(),
+    responseDescription: "Authenticated session."
+  },
+  // Only the password route is throttled by the gateway, so the two console
+  // authentication routes do not document the same responses.
+  signIn: {
+    method: "POST",
+    path: "/v1/auth/sign-in/email",
+    tags: ["Console authentication"],
+    summary: "Sign in with email and password",
+    security: "public",
+    request: SignInRequestSchema,
+    response: external_exports.unknown(),
+    responseDescription: "Authenticated session.",
+    errors: {
+      429: "Too many sign-in attempts. Counted twice over: per client address, and per email address so that a spread of addresses cannot grind through one account's passwords. Carries Retry-After."
+    }
+  },
+  getSession: {
+    method: "GET",
+    path: "/v1/auth/get-session",
+    tags: ["Console authentication"],
+    summary: "Get the current session",
+    security: "session",
+    response: external_exports.unknown(),
+    responseDescription: "Current session or null."
+  },
+  signOut: {
+    method: "POST",
+    path: "/v1/auth/sign-out",
+    tags: ["Console authentication"],
+    summary: "End the current session",
+    security: "session",
+    response: external_exports.unknown(),
+    responseDescription: "Session ended."
+  },
+  signInWithGoogle: {
+    method: "GET",
+    path: "/v1/auth/sign-in/social",
+    tags: ["Console authentication"],
+    summary: "Start optional Google sign-in",
+    description: "Available only when GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are configured.",
+    security: "public",
+    query: external_exports.object({ provider: external_exports.literal("google") }),
+    status: 302,
+    response: NO_RESPONSE_BODY,
+    responseDescription: "Redirect to Google."
+  },
+  createAppAttestChallenge: {
+    method: "POST",
+    path: "/v1/apps/{app}/auth/challenge",
+    tags: ["Application authentication"],
+    summary: "Create an App Attest challenge",
+    security: "public",
+    params: APP_PARAM,
+    response: AppAttestChallengeResponseSchema,
+    responseDescription: "A five-minute, single-use challenge.",
+    errors: { 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED, 404: NO_END_USERS }
+  },
+  registerAppAttestKey: {
+    method: "POST",
+    path: "/v1/apps/{app}/auth/register",
+    tags: ["Application authentication"],
+    summary: "Register an App Attest key",
+    security: "public",
+    params: APP_PARAM,
+    request: AppAttestRegisterRequestSchema,
+    response: AppAttestRegisterResponseSchema,
+    responseDescription: "The key was registered for the verified issuer identity.",
+    errors: { ...ISSUER_ERRORS, 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED }
+  },
+  exchangeGatewayToken: {
+    method: "POST",
+    path: "/v1/apps/{app}/auth/token",
+    tags: ["Application authentication"],
+    summary: "Exchange issuer identity and client proof for a gateway token",
+    description: "App Attest clients send key_id, assertion, and challenge. Issuer-backed API-key clients send api_key and issuer_token. The verified issuer claim is always the resulting user identity.",
+    security: "public",
+    params: APP_PARAM,
+    request: external_exports.union([AppAttestTokenRequestSchema, ApiKeyTokenRequestSchema]),
+    response: GatewayTokenResponseSchema,
+    responseDescription: "A short-lived gateway access token.",
+    errors: { ...ISSUER_ERRORS, 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED }
+  },
+  getCurrentUser: {
+    method: "GET",
+    path: "/v1/apps/{app}/me",
+    tags: ["Application"],
+    summary: "Get the current user's limits, spend and block state",
+    security: "gateway",
+    params: APP_PARAM,
+    response: CurrentUserResponseSchema,
+    responseDescription: "Current user state.",
+    errors: { 402: NO_PLAN, 404: NO_END_USERS }
+  },
+  proxyProviderRequest: {
+    method: "POST",
+    path: "/v1/apps/{app}/proxy/{provider}/{path}",
+    tags: ["Provider proxy"],
+    summary: "Proxy a provider-native model request",
+    description: "The path, body, and successful response retain the selected provider's native contract. For example, OpenAI clients send v1/responses or v1/chat/completions; gateway-specific provider slug quirks are never part of the client path. The gateway validates the configured path and model, spends one request from the account's monthly allowance, and streams the upstream response without buffering.",
+    security: "gateway",
+    params: {
+      app: { example: "my-app" },
+      provider: { example: "openai-dev", pattern: PROVIDER_SLUG_PATTERN },
+      path: {
+        description: "The provider's native API path verbatim, without a leading slash.",
+        example: "v1/responses"
+      }
+    },
+    headers: GatewayClientHeadersSchema,
+    request: ProviderNativeBodySchema,
+    response: external_exports.unknown(),
+    responseDescription: "Provider-native response. Streaming responses remain streamed.",
+    errors: {
+      402: NO_PLAN,
+      429: DATA_PLANE_RATE_LIMITED,
+      502: "The upstream provider request failed.",
+      504: "The upstream provider sent no response headers within the gateway's time-to-first-byte budget."
+    }
+  },
+  callNamedEndpoint: {
+    method: "POST",
+    path: "/v1/apps/{app}/endpoints/{slug}",
+    tags: ["Named endpoints"],
+    summary: "Call a server-configured named endpoint",
+    description: "The endpoint's provider, model, fixed parameters, output cap, and fallback chain come from the application configuration, so you can change models without shipping a client release. Responses-style endpoints accept an OpenAI Responses body; transcription-style endpoints accept an OpenAI audio transcription multipart body and may omit the model field. The successful response keeps the serving provider's native format and streaming behaviour.",
+    security: "gateway",
+    params: {
+      app: { example: "my-app" },
+      slug: { example: "chat", pattern: /^[a-z0-9-]{1,64}$/ }
+    },
+    headers: GatewayClientHeadersSchema,
+    request: {
+      content: {
+        "application/json": ResponsesStyleBodySchema,
+        "multipart/form-data": TranscriptionStyleBodySchema
+      }
+    },
+    response: external_exports.unknown(),
+    responseDescription: "Provider-native response. Streaming responses remain streamed.",
+    errors: {
+      402: NO_PLAN,
+      429: DATA_PLANE_RATE_LIMITED,
+      502: "Every configured target failed.",
+      504: "Every configured target failed, and the last one sent no response headers within the gateway's time-to-first-byte budget."
+    }
+  },
+  listApps: {
+    method: "GET",
+    path: "/v1/admin/apps",
+    tags: ["Admin applications"],
+    summary: "List applications",
+    security: "management",
+    query: MonthQuerySchema,
+    response: AppListResponseSchema,
+    responseDescription: "Applications and current usage summaries."
+  },
+  createApp: {
+    method: "POST",
+    path: "/v1/admin/apps",
+    tags: ["Admin applications"],
+    summary: "Create an application",
+    description: "Send only `name`, `config` and an optional `status`. The gateway assigns the id \u2014 the name slugified plus a six-character random suffix \u2014 and returns it as `app.id`; it cannot be chosen, and it cannot change once the application exists. A body that still carries `id` is refused with `400`. API-key applications receive a one-time plaintext initial key in the response.",
+    security: "management",
+    request: AppWriteSchema,
+    status: 201,
+    response: CreatedAppResponseSchema,
+    responseDescription: "Application created. `app.id` is the assigned id and the segment every gateway URL for this app uses. `api_key` is the one-time plaintext initial key for an API-key application, and null for any other.",
+    errors: {
+      409: "`invalid_request` \u2014 no unique generated id could be allocated after repeated attempts. Retrying is safe."
+    },
+    receipt: true
+  },
+  listBillingPlans: {
+    method: "GET",
+    path: "/v1/admin/billing/plans",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "List billing plans",
+    security: "management",
+    // The whole billing subtree is a person's to act on: a service credential
+    // may run an account but may not buy, change or cancel what pays for it.
+    policy: { identity: "human" },
+    response: BillingPlansResponseSchema,
+    responseDescription: "Billing service response."
+  },
+  getBillingStatus: {
+    method: "GET",
+    path: "/v1/admin/billing/status",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Get billing access and the current allowance period",
+    security: "management",
+    policy: { identity: "human" },
+    response: BillingStatusResponseSchema,
+    responseDescription: "Billing access, and the current period against the plan's request allowance when an entitlement resolves."
+  },
+  startCheckout: {
+    method: "POST",
+    path: "/v1/admin/billing/checkout",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Create a hosted checkout",
+    security: "management",
+    policy: { identity: "human" },
+    request: BillingCheckoutRequestSchema,
+    response: BillingCheckoutResponseSchema,
+    responseDescription: "Hosted checkout URL."
+  },
+  changePlan: {
+    method: "POST",
+    path: "/v1/admin/billing/change",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Change the subscription plan",
+    security: "management",
+    policy: { identity: "human" },
+    request: BillingPlanSelectionSchema,
+    response: BillingChangeResponseSchema,
+    responseDescription: "Billing service response."
+  },
+  resumeSubscription: {
+    method: "POST",
+    path: "/v1/admin/billing/resume",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Resume a canceled subscription",
+    security: "management",
+    policy: { identity: "human" },
+    request: BillingPlanSelectionSchema,
+    response: BillingChangeResponseSchema,
+    responseDescription: "Billing service response."
+  },
+  cancelSubscription: {
+    method: "POST",
+    path: "/v1/admin/billing/cancel",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Cancel the subscription at period end",
+    security: "management",
+    policy: { identity: "human" },
+    response: BillingCancelResponseSchema,
+    responseDescription: "Cancellation accepted."
+  },
+  startTrial: {
+    method: "POST",
+    path: "/v1/admin/billing/trial",
+    hidden: true,
+    tags: ["Admin billing"],
+    summary: "Start a no-card trial",
+    security: "management",
+    policy: { identity: "human" },
+    request: BillingTrialRequestSchema,
+    response: BillingAccessSchema,
+    responseDescription: "Trial access state."
+  },
+  getApp: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}",
+    tags: ["Admin applications"],
+    summary: "Get an application",
+    security: "management",
+    params: APP_PARAM,
+    response: AppResponseSchema,
+    responseDescription: "Application state."
+  },
+  updateApp: {
+    method: "PUT",
+    path: "/v1/admin/apps/{app}",
+    tags: ["Admin applications"],
+    summary: "Update an application",
+    description: "Requires `revision` in the body, the one the application was read at; a stale revision answers `409 app_revision_conflict` and an absent one `400 app_revision_required`. Updates an existing application in place. It never creates one: an id none of your applications holds answers `404 app_not_found`, and nothing is written. Applications are created only by `POST /v1/admin/apps`, which assigns the id.",
+    security: "management",
+    params: APP_PARAM,
+    request: AppUpdateSchema,
+    response: AppResponseSchema,
+    responseDescription: "Application state.",
+    errors: { 409: "The application changed since it was read." }
+  },
+  validateApp: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/validate",
+    tags: ["Admin applications"],
+    summary: "Validate an edit of an application without saving it",
+    description: "Judged as an update of this application would be: provider slugs its stored configuration already names stay acceptable even if their provider has since been deleted. Use the draft validation for an application that does not exist yet.",
+    security: "management",
+    // A POST that stores nothing: it answers whether a body would be accepted,
+    // which is a read of the configuration rules and not a write.
+    policy: { role: "member", access: "read" },
+    params: APP_PARAM,
+    request: AppWriteSchema,
+    response: AppValidateResponseSchema,
+    responseDescription: "Resolved valid configuration."
+  },
+  validateAppDraft: {
+    method: "POST",
+    path: "/v1/admin/app-drafts/validate",
+    tags: ["Admin applications"],
+    summary: "Validate a new application configuration without saving it",
+    description: "Judged as a creation would be, against the account's current providers and prices.",
+    security: "management",
+    policy: { role: "member", access: "read" },
+    request: AppWriteSchema,
+    response: AppDraftValidateResponseSchema,
+    responseDescription: "The configuration would be accepted."
+  },
+  deleteApp: {
+    method: "DELETE",
+    path: "/v1/admin/apps/{app}",
+    tags: ["Admin applications"],
+    summary: "Delete an application and its associated operational data",
+    security: "management",
+    params: APP_PARAM,
+    query: external_exports.object({
+      confirm: external_exports.string({ error: "Pass ?confirm=<app-id> to delete an app" })
+    }),
+    response: AppDeleteResponseSchema,
+    responseDescription: "Application deleted. Its usage events are kept, which is what `usage_events_retained` reports."
+  },
+  listManagementKeys: {
+    method: "GET",
+    path: "/v1/admin/keys",
+    tags: ["Admin management keys"],
+    summary: "List management keys",
+    description: "Console session only. Management keys cannot administer management keys.",
+    security: "session",
+    response: ManagementKeyListResponseSchema,
+    responseDescription: "Management key metadata without plaintext tokens."
+  },
+  createManagementKey: {
+    method: "POST",
+    path: "/v1/admin/keys",
+    tags: ["Admin management keys"],
+    summary: "Create a management key",
+    description: "Console session only, and requires the owner or admin role. A management key cannot create another one, so revoking a key you handed out ends that access for good. The plaintext agw_mgmt_ token is returned once, and never expires; the account's own deadline is the only one.",
+    security: "session",
+    request: ManagementKeyCreateRequestSchema,
+    status: 201,
+    response: CreatedManagementKeyResponseSchema,
+    responseDescription: "One-time plaintext management key."
+  },
+  revokeManagementKey: {
+    method: "POST",
+    path: "/v1/admin/keys/{id}/revoke",
+    tags: ["Admin management keys"],
+    summary: "Revoke a management key",
+    description: "Console session only, and requires the owner or admin role.",
+    security: "session",
+    params: { id: { example: "key_123" } },
+    response: ManagementKeyResponseSchema,
+    responseDescription: "Revoked management key metadata."
+  },
+  listProviders: {
+    method: "GET",
+    path: "/v1/admin/providers",
+    tags: ["Admin providers"],
+    summary: "List provider credentials",
+    security: "management",
+    response: ProviderListResponseSchema,
+    responseDescription: "Provider metadata without credentials."
+  },
+  createProvider: {
+    method: "POST",
+    path: "/v1/admin/providers",
+    tags: ["Admin providers"],
+    summary: "Store a provider credential",
+    description: "Creates one named provider instance. Supply exactly one direct provider secret or reusable providerGatewayId. The credential is stored as given and never probed: check one first with POST /v1/admin/providers/test. The slug defaults to the provider type and is unique among your provider instances, disabled ones included; only deleting an instance frees its slug.",
+    security: "management",
+    request: ProviderCreateRequestSchema,
+    status: 201,
+    response: ProviderResponseSchema,
+    responseDescription: "Stored provider.",
+    errors: { 409: "The requested active provider slug is already in use." },
+    receipt: true
+  },
+  testProviderCredential: {
+    method: "POST",
+    path: "/v1/admin/providers/test",
+    tags: ["Admin providers"],
+    summary: "Probe a provider credential without storing it",
+    description: "Calls the provider with a credential, and reports what it answered. Nothing is stored, and no other endpoint runs this check: a write stores what it is given. Supply exactly one direct provider secret or an existing providerGatewayId.",
+    security: "management",
+    request: ProviderTestRequestSchema,
+    response: ProviderTestResponseSchema,
+    responseDescription: "Probe outcome."
+  },
+  updateProvider: {
+    method: "PUT",
+    path: "/v1/admin/providers/{id}",
+    tags: ["Admin providers"],
+    summary: "Rotate a credential, rename it, move it to another origin, replace its custom pricing, or disable it",
+    description: "Requires the revision returned by the provider read this edit is based on; a stale revision returns 409 conflict. Sending status disables or re-enables the instance. Disabling keeps the secret, the pricing and the slug, so requests to it fail with provider_disabled and no other instance can take its slug meanwhile. Re-enabling does not require reclaiming the slug. Sending a non-null baseUrl also requires secret in the same request: the stored key is write-only and is never decrypted to be sent to an origin it has not been sent to before, so a move carries the key it is to be used with. Sending baseUrl: null returns the instance to its provider type's own origin and needs nothing else.",
+    security: "management",
+    params: { id: { example: "b0a1\u2026" } },
+    request: ProviderUpdateRequestSchema,
+    response: ProviderResponseSchema,
+    responseDescription: "Updated provider."
+  },
+  deleteProvider: {
+    method: "DELETE",
+    path: "/v1/admin/providers/{id}",
+    tags: ["Admin providers"],
+    summary: "Delete a provider credential and its custom pricing",
+    description: 'A hard delete, secret and pricing included. Applications using this provider start failing with provider_not_configured within a minute. To pause an instance reversibly instead, send status: "disabled" to PUT /v1/admin/providers/{id}.',
+    security: "management",
+    params: { id: { example: "b0a1\u2026" } },
+    response: ProviderDeleteResponseSchema,
+    responseDescription: "Provider deleted."
+  },
+  listProviderGateways: {
+    method: "GET",
+    path: "/v1/admin/provider-gateways",
+    tags: ["Admin provider gateways"],
+    summary: "List reusable provider gateways",
+    security: "management",
+    response: ProviderGatewayListResponseSchema,
+    responseDescription: "Provider gateway metadata without tokens."
+  },
+  createProviderGateway: {
+    method: "POST",
+    path: "/v1/admin/provider-gateways",
+    tags: ["Admin provider gateways"],
+    summary: "Create a reusable provider gateway connection",
+    description: "Cloudflare AI Gateway takes an account and gateway id; Vercel AI Gateway takes only a name and a token. The token is encrypted and stored as given, never probed: check a connection first with POST /v1/admin/provider-gateways/test. Provider instances are attached separately through the providers API.",
+    security: "management",
+    request: ProviderGatewayCreateRequestSchema,
+    status: 201,
+    response: ProviderGatewayResponseSchema,
+    responseDescription: "Created provider gateway.",
+    receipt: true
+  },
+  testProviderGateway: {
+    method: "POST",
+    path: "/v1/admin/provider-gateways/test",
+    tags: ["Admin provider gateways"],
+    summary: "Probe a gateway connection without storing it",
+    description: "Calls the gateway with a token, and reports what it answered. Nothing is stored, and no other endpoint runs this check: a write stores what it is given. Unlike the providers API, a refused token is reported as reason: rejected rather than raised as provider_key_invalid, because the same 401 means both a wrong token and a gateway that is not finished being set up.",
+    security: "management",
+    request: ProviderGatewayTestRequestSchema,
+    response: ProviderGatewayTestResponseSchema,
+    responseDescription: "Probe outcome."
+  },
+  updateProviderGateway: {
+    method: "PATCH",
+    path: "/v1/admin/provider-gateways/{id}",
+    tags: ["Admin provider gateways"],
+    summary: "Rename a provider gateway",
+    description: "Requires the revision returned by the gateway read this rename is based on; a stale revision returns 409 conflict.",
+    security: "management",
+    params: { id: { example: "b0a1\u2026" } },
+    request: ProviderGatewayUpdateRequestSchema,
+    response: ProviderGatewayResponseSchema,
+    responseDescription: "Updated provider gateway."
+  },
+  rotateProviderGateway: {
+    method: "POST",
+    path: "/v1/admin/provider-gateways/{id}/rotate",
+    tags: ["Admin provider gateways"],
+    summary: "Rotate a shared provider gateway token",
+    description: "Requires the revision returned by the gateway read this rotation is based on; a stale revision returns 409 conflict. Re-encrypts the token once for every provider instance referencing this gateway. The new token is stored as given, never probed.",
+    security: "management",
+    params: { id: { example: "b0a1\u2026" } },
+    request: ProviderGatewayRotateRequestSchema,
+    response: ProviderGatewayResponseSchema,
+    responseDescription: "Rotated provider gateway."
+  },
+  deleteProviderGateway: {
+    method: "DELETE",
+    path: "/v1/admin/provider-gateways/{id}",
+    tags: ["Admin provider gateways"],
+    summary: "Delete an unused provider gateway",
+    security: "management",
+    params: { id: { example: "b0a1\u2026" } },
+    response: ProviderGatewayDeleteResponseSchema,
+    responseDescription: "Provider gateway deleted.",
+    errors: {
+      409: "Provider instances still reference this gateway. Disabled rows are retained for re-enabling and block deletion too; see referencedCount."
+    }
+  },
+  getAdminSession: {
+    method: "GET",
+    path: "/v1/admin/session",
+    tags: ["Admin organizations"],
+    summary: "Get the caller's identity, current organization and role",
+    description: "The console needs the caller's role and active organization to gate its UI; the sign-in session endpoint reports neither.",
+    security: "management",
+    response: IdentitySessionSchema,
+    responseDescription: "Resolved session."
+  },
+  listOrganizations: {
+    method: "GET",
+    path: "/v1/admin/organizations",
+    tags: ["Admin organizations"],
+    summary: "List the organizations the caller belongs to",
+    security: "management",
+    response: OrganizationListResponseSchema,
+    responseDescription: "Memberships ordered by organization creation time."
+  },
+  selectOrganization: {
+    method: "POST",
+    path: "/v1/admin/organizations/select",
+    tags: ["Admin organizations"],
+    summary: "Switch the caller's active organization",
+    description: "Available to every member, including read-only members, of the target organization.",
+    security: "management",
+    // Switching the active organization re-signs the cookie naming which
+    // tenant the caller reads; gating it behind owner/admin would strand a
+    // read-only member in one organization, and gating it behind setup access
+    // would strand them in an account whose trial has ended.
+    policy: { role: "member", access: "read" },
+    request: OrganizationSelectRequestSchema,
+    response: IdentitySessionSchema,
+    responseDescription: "Session rescoped to the selected organization."
+  },
+  listAppEvents: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/events",
+    tags: ["Admin operations"],
+    summary: "List application usage events",
+    security: "management",
+    params: APP_PARAM,
+    query: external_exports.object({
+      limit: PageLimitSchema,
+      status: external_exports.enum(USAGE_STATUSES).optional(),
+      provider: external_exports.string().optional(),
+      user: external_exports.string().optional(),
+      model: external_exports.string().optional(),
+      before_id: BeforeIdSchema
+    }),
+    response: UsageEventListSchema,
+    responseDescription: "Paginated application usage events."
+  },
+  getAppAuthEventSummary: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/auth-events/summary",
+    tags: ["Admin operations"],
+    summary: "Summarize application authentication outcomes",
+    description: "Daily authentication outcomes and reasons, non-ok proxied requests, token-exchange success rate, entitlement-claim propagation delays, and how many users are waiting on a claim right now.",
+    security: "management",
+    params: APP_PARAM,
+    query: external_exports.object({
+      days: external_exports.coerce.number().int({ error: "days must be an integer between 1 and 365" }).min(1, { error: "days must be an integer between 1 and 365" }).max(365, { error: "days must be an integer between 1 and 365" }).default(30).meta({ description: "Trailing window in days, ending today. Defaults to 30." })
+    }),
+    response: AuthEventSummarySchema,
+    responseDescription: "Authentication activity for the window."
+  },
+  listAppAuthEvents: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/auth-events",
+    tags: ["Admin operations"],
+    summary: "List application authentication events",
+    security: "management",
+    params: APP_PARAM,
+    query: external_exports.object({
+      limit: PageLimitSchema,
+      outcome: external_exports.string().optional(),
+      event: external_exports.enum(["token_exchange", "register"]).optional(),
+      user: external_exports.string().optional(),
+      before_id: BeforeIdSchema
+    }),
+    response: AuthEventListSchema,
+    responseDescription: "Paginated authentication attempts, newest first."
+  },
+  listAppKeys: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/keys",
+    tags: ["Admin operations"],
+    summary: "List application API keys",
+    security: "management",
+    params: APP_PARAM,
+    response: ApiKeyListResponseSchema,
+    responseDescription: "Application API keys without plaintext tokens."
+  },
+  createAppKey: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/keys",
+    tags: ["Admin operations"],
+    summary: "Create an application API key",
+    security: "management",
+    params: APP_PARAM,
+    request: ApiKeyCreateRequestSchema,
+    status: 201,
+    response: CreatedApiKeySchema,
+    responseDescription: "One-time plaintext application API key.",
+    receipt: true
+  },
+  revokeAppKey: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/keys/{key}/revoke",
+    tags: ["Admin operations"],
+    summary: "Revoke an application API key",
+    security: "management",
+    params: { app: { example: "my-app" }, key: { example: "key_123" } },
+    response: ApiKeyRevokeResponseSchema,
+    responseDescription: "Revoked application API key."
+  },
+  listAppUsers: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/users",
+    tags: ["Admin operations"],
+    summary: "List application users",
+    security: "management",
+    params: APP_PARAM,
+    query: external_exports.object({
+      month: MonthSchema.optional().meta({ description: "YYYY-MM; defaults to the current UTC month." }),
+      query: external_exports.string().optional().meta({ description: "Substring match on the user id." }),
+      status: external_exports.enum(["active", "blocked"]).optional(),
+      limit: PageLimitSchema,
+      offset: external_exports.coerce.number().int({ error: "offset must be a non-negative integer" }).min(0, { error: "offset must be a non-negative integer" }).default(0)
+    }),
+    response: UserListResponseSchema,
+    responseDescription: "Application users and their usage for the month."
+  },
+  getAppUser: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/users/{user}",
+    tags: ["Admin operations"],
+    summary: "Get an application user",
+    security: "management",
+    params: { app: { example: "my-app" }, user: { example: "user-123" } },
+    query: MonthQuerySchema,
+    response: UserResponseSchema,
+    responseDescription: "One application user and their usage for the month."
+  },
+  blockAppUser: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/users/{user}/block",
+    tags: ["Admin operations"],
+    summary: "Block an application user",
+    security: "management",
+    params: { app: { example: "my-app" }, user: { example: "user-123" } },
+    response: UserBlockResponseSchema,
+    responseDescription: "The user's new block state."
+  },
+  unblockAppUser: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/users/{user}/unblock",
+    tags: ["Admin operations"],
+    summary: "Unblock an application user",
+    security: "management",
+    params: { app: { example: "my-app" }, user: { example: "user-123" } },
+    response: UserBlockResponseSchema,
+    responseDescription: "The user's new block state."
+  },
+  getAppUsage: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/usage",
+    tags: ["Admin operations"],
+    summary: "Get application usage totals",
+    security: "management",
+    params: APP_PARAM,
+    query: MonthQuerySchema,
+    response: MonthlyUsageResponseSchema,
+    responseDescription: "One month's totals for one application."
+  },
+  repriceAppUsage: {
+    method: "POST",
+    path: "/v1/admin/apps/{app}/usage/reprice",
+    tags: ["Admin operations"],
+    summary: "Preview or apply current catalog prices to stored usage",
+    security: "management",
+    params: APP_PARAM,
+    request: UsageRepriceRequestSchema,
+    response: UsageRepriceResponseSchema,
+    responseDescription: "What repricing would change, or did."
+  },
+  getAppUsageTimeseries: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/usage/timeseries",
+    tags: ["Admin operations"],
+    summary: "Get application usage over time",
+    security: "management",
+    params: APP_PARAM,
+    query: RangeQuerySchema,
+    response: TimeseriesResponseSchema,
+    responseDescription: "Daily buckets split by provider."
+  },
+  getAppUsageBreakdown: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/usage/breakdown",
+    tags: ["Admin operations"],
+    summary: "Get grouped application usage",
+    security: "management",
+    params: APP_PARAM,
+    query: RangeQuerySchema.extend({
+      by: external_exports.enum(USAGE_BREAKDOWN_DIMENSIONS).default("model").meta({ description: "Which dimension to group by. Defaults to model." }),
+      limit: PageLimitSchema
+    }),
+    response: BreakdownResponseSchema,
+    responseDescription: "One dimension's totals, largest first."
+  },
+  listModelPrices: {
+    method: "GET",
+    path: "/v1/admin/prices",
+    tags: ["Admin models"],
+    summary: "List known model prices",
+    security: "management",
+    response: PricesResponseSchema,
+    responseDescription: "The priced model catalog this deployment enforces."
+  },
+  getCliCapabilities: {
+    method: "GET",
+    path: "/v1/cli/capabilities",
+    tags: ["CLI"],
+    summary: "Discover deployment identity and provider capabilities",
+    security: "public",
+    response: CliCapabilitiesResponseSchema,
+    responseDescription: "Public deployment capabilities. No credentials or inference calls.",
+    errors: "none"
+  },
+  bootstrapCliAccount: {
+    method: "POST",
+    path: "/v1/cli/bootstrap",
+    tags: ["CLI"],
+    summary: "Initialize a recoverable CLI account",
+    description: "Persist both random proofs before sending. An identical retry returns the same account and protected credential during its exchange window. Cloud initialization is public and rate limited. Self-hosted initialization is public too and creates the deployment's single initial account, so whoever initializes an empty deployment first owns it, exactly as its first console registration does; it is not rate limited, because the only thing a limit could refuse on a deployment nobody owns yet is its own installer retrying, and every caller after the first is refused permanently anyway. All responses are no-store.",
+    security: "public",
+    request: CliBootstrapRequestSchema,
+    response: CliBootstrapResponseSchema,
+    responseDescription: "Initial account and credential. Never print or log the credential.",
+    errors: CLI_ERRORS
+  },
+  createCliOperation: {
+    method: "POST",
+    path: "/v1/cli/operations",
+    tags: ["CLI"],
+    summary: "Create or recover a browser handoff",
+    description: "Persist pollToken before initiation. Repeating the same proof and payload recovers the same operation. A current account key is required. Claims require interactive human sign-in and explicit consent. Provider handoffs require the browser URL proof and show the exact resource configuration before secret submission. Handoffs expire after 15 minutes.",
+    security: "management",
+    // Admin, like every write; read access because the claim is the one kind
+    // an account past its free window may still open. Every resource kind then
+    // asks for setup access of its own, in the handler, from its kind entry.
+    policy: { role: "admin", access: "read" },
+    request: CliOperationRequestSchema,
+    response: CliOperationResponseSchema,
+    responseDescription: "Browser URL for the pending handoff.",
+    errors: CLI_ERRORS
+  },
+  pollCliOperation: {
+    method: "GET",
+    path: "/v1/cli/operations/{id}",
+    tags: ["CLI"],
+    summary: "Poll a browser handoff",
+    description: "Only the original polling proof can recover the result. Completed claims report the account they landed on; the CLI keeps the access it already had. Provider secrets are never returned.",
+    security: "cliPoll",
+    params: { id: {} },
+    response: CliPollResponseSchema,
+    responseDescription: "Current operation state and nonsecret result.",
+    errors: CLI_ERRORS
+  },
+  getCliAccount: {
+    method: "GET",
+    path: "/v1/cli/account",
+    tags: ["CLI"],
+    summary: "Read account lifecycle and current access",
+    security: "management",
+    response: CliAccountResponseSchema,
+    responseDescription: "Account deadlines, effective access and current request count.",
+    errors: CLI_ERRORS
+  },
+  getCliUsage: {
+    method: "GET",
+    path: "/v1/cli/usage",
+    tags: ["CLI"],
+    summary: "Read retained account usage for a UTC month",
+    description: "Includes retained usage for deleted apps, with durable account attribution. Historical rows whose owner was already unknown when attribution was introduced cannot be counted. Coverage describes this limitation without disclosing other accounts' data.",
+    security: "management",
+    query: external_exports.object({
+      month: MonthSchema.optional().meta({ description: "YYYY-MM; defaults to the current UTC month." })
+    }),
+    response: CliUsageResponseSchema,
+    responseDescription: "Account totals, per-app totals and attribution coverage.",
+    errors: CLI_ERRORS
+  },
+  /*
+   * The human half of a handoff. There is no page to fetch here: the console
+   * renders the approval screen at `/cli/approve/{id}` from its own bundle, and
+   * these four are the API it calls with the proof it read from the URL
+   * fragment. Every one of them carries that proof in its body, so they are
+   * POSTs with no readable URL of their own.
+   */
+  cliBrowserDetails: {
+    method: "POST",
+    path: "/v1/cli/browser/{id}/details",
+    tags: ["CLI"],
+    summary: "Browser handoff: details",
+    description: BROWSER_HANDOFF_DESCRIPTION,
+    security: "public",
+    params: { id: {} },
+    request: CliSubmissionRequestSchema,
+    response: CliBrowserDetailsResponseSchema,
+    responseDescription: "The pending action, its configuration, the account it lands on, the signed-in human who would approve it, if any, and what stands between this browser and approving it.",
+    errors: CLI_ERRORS
+  },
+  cliBrowserSubmit: {
+    method: "POST",
+    path: "/v1/cli/browser/{id}/submit",
+    tags: ["CLI"],
+    summary: "Browser handoff: submit",
+    description: BROWSER_HANDOFF_DESCRIPTION,
+    security: "public",
+    params: { id: {} },
+    request: CliSubmissionRequestSchema,
+    response: CliBrowserSubmitResponseSchema,
+    responseDescription: "The handoff is approved and consumed. No submitted secret is ever echoed.",
+    errors: CLI_ERRORS
+  },
+  cliBrowserRegister: {
+    method: "POST",
+    path: "/v1/cli/browser/{id}/register",
+    tags: ["CLI"],
+    summary: "Browser handoff: register",
+    description: BROWSER_HANDOFF_DESCRIPTION,
+    security: "public",
+    params: { id: {} },
+    request: CliSubmissionRequestSchema,
+    response: CliBrowserRegisterResponseSchema,
+    responseDescription: "A new human identity for a pending claim, with its session set as a cookie.",
+    errors: CLI_ERRORS
+  },
+  cliBrowserGoogle: {
+    method: "POST",
+    path: "/v1/cli/browser/{id}/google",
+    tags: ["CLI"],
+    summary: "Browser handoff: google",
+    description: BROWSER_HANDOFF_DESCRIPTION,
+    security: "public",
+    params: { id: {} },
+    request: CliSubmissionRequestSchema,
+    response: CliBrowserGoogleResponseSchema,
+    responseDescription: "Where to send the browser to start Google consent for a pending claim.",
+    errors: CLI_ERRORS
+  }
+};
 function searchSuffix(params) {
   const search = new URLSearchParams();
   for (const [key, value] of Object.entries(params)) {
@@ -16015,200 +17276,15 @@ function searchSuffix(params) {
   const encoded = search.toString();
   return encoded ? `?${encoded}` : "";
 }
-var seg = encodeURIComponent;
-function operation() {
-  return (method, path) => ({ method, path });
+function operationPath(name, ...rest) {
+  const [params, query] = rest;
+  const filled = CATALOG[name].path.replace(/\{(\w+)\}/gu, (_match, key) => {
+    const value = params?.[key];
+    if (value === void 0) throw new Error(`${String(name)} needs a "${key}" path parameter`);
+    return encodeURIComponent(value);
+  });
+  return query === void 0 ? filled : filled + searchSuffix(query);
 }
-var operations = {
-  // Deployment and identity
-  getConsoleCapabilities: operation()(
-    "GET",
-    () => "/v1/console/capabilities"
-  ),
-  getAdminSession: operation()(
-    "GET",
-    () => "/v1/admin/session"
-  ),
-  listOrganizations: operation()(
-    "GET",
-    () => "/v1/admin/organizations"
-  ),
-  selectOrganization: operation()(
-    "POST",
-    () => "/v1/admin/organizations/select"
-  ),
-  // Management keys
-  listManagementKeys: operation()(
-    "GET",
-    () => "/v1/admin/keys"
-  ),
-  createManagementKey: operation()(
-    "POST",
-    () => "/v1/admin/keys"
-  ),
-  revokeManagementKey: operation()(
-    "POST",
-    (id) => `/v1/admin/keys/${seg(id)}/revoke`
-  ),
-  // Providers
-  listProviders: operation()(
-    "GET",
-    () => "/v1/admin/providers"
-  ),
-  createProvider: operation()(
-    "POST",
-    () => "/v1/admin/providers"
-  ),
-  testProvider: operation()(
-    "POST",
-    () => "/v1/admin/providers/test"
-  ),
-  updateProvider: operation()(
-    "PUT",
-    (id) => `/v1/admin/providers/${seg(id)}`
-  ),
-  deleteProvider: operation()(
-    "DELETE",
-    (id) => `/v1/admin/providers/${seg(id)}`
-  ),
-  // Provider gateways
-  listProviderGateways: operation()(
-    "GET",
-    () => "/v1/admin/provider-gateways"
-  ),
-  createProviderGateway: operation()("POST", () => "/v1/admin/provider-gateways"),
-  testProviderGateway: operation()("POST", () => "/v1/admin/provider-gateways/test"),
-  updateProviderGateway: operation()("PATCH", (id) => `/v1/admin/provider-gateways/${seg(id)}`),
-  rotateProviderGateway: operation()("POST", (id) => `/v1/admin/provider-gateways/${seg(id)}/rotate`),
-  deleteProviderGateway: operation()(
-    "DELETE",
-    (id) => `/v1/admin/provider-gateways/${seg(id)}`
-  ),
-  // Applications
-  listApps: operation()(
-    "GET",
-    (query = {}) => `/v1/admin/apps${searchSuffix(query)}`
-  ),
-  createApp: operation()(
-    "POST",
-    () => "/v1/admin/apps"
-  ),
-  getApp: operation()(
-    "GET",
-    (appId) => `/v1/admin/apps/${seg(appId)}`
-  ),
-  updateApp: operation()(
-    "PUT",
-    (appId) => `/v1/admin/apps/${seg(appId)}`
-  ),
-  deleteApp: operation()(
-    "DELETE",
-    (appId) => `/v1/admin/apps/${seg(appId)}${searchSuffix({ confirm: appId })}`
-  ),
-  validateApp: operation()(
-    "POST",
-    (appId) => `/v1/admin/apps/${seg(appId)}/validate`
-  ),
-  // Application keys
-  listAppKeys: operation()(
-    "GET",
-    (appId) => `/v1/admin/apps/${seg(appId)}/keys`
-  ),
-  createAppKey: operation()(
-    "POST",
-    (appId) => `/v1/admin/apps/${seg(appId)}/keys`
-  ),
-  revokeAppKey: operation()(
-    "POST",
-    (appId, keyId) => `/v1/admin/apps/${seg(appId)}/keys/${seg(keyId)}/revoke`
-  ),
-  // Application users
-  listAppUsers: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/users${searchSuffix(query)}`
-  ),
-  setAppUserBlocked: operation()(
-    "POST",
-    (appId, userId, blocked) => `/v1/admin/apps/${seg(appId)}/users/${seg(userId)}/${blocked ? "block" : "unblock"}`
-  ),
-  // Application usage
-  getAppUsage: operation()(
-    "GET",
-    (appId, query = {}) => `/v1/admin/apps/${seg(appId)}/usage${searchSuffix(query)}`
-  ),
-  getAppUsageTimeseries: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/usage/timeseries${searchSuffix(query)}`
-  ),
-  getAppUsageBreakdown: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/usage/breakdown${searchSuffix(query)}`
-  ),
-  listAppEvents: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/events${searchSuffix(query)}`
-  ),
-  getAppAuthEventSummary: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/auth-events/summary${searchSuffix(query)}`
-  ),
-  listAppAuthEvents: operation()(
-    "GET",
-    (appId, query) => `/v1/admin/apps/${seg(appId)}/auth-events${searchSuffix(query)}`
-  ),
-  listModelPrices: operation()(
-    "GET",
-    () => "/v1/admin/prices"
-  ),
-  // CLI surface
-  getCliCapabilities: operation()(
-    "GET",
-    () => "/v1/cli/capabilities"
-  ),
-  bootstrapCliAccount: operation()(
-    "POST",
-    () => "/v1/cli/bootstrap"
-  ),
-  createCliOperation: operation()(
-    "POST",
-    () => "/v1/cli/operations"
-  ),
-  pollCliOperation: operation()(
-    "GET",
-    (id) => `/v1/cli/operations/${seg(id)}`
-  ),
-  getCliAccount: operation()(
-    "GET",
-    () => "/v1/cli/account"
-  ),
-  getCliUsage: operation()(
-    "GET",
-    (query = {}) => `/v1/cli/usage${searchSuffix(query)}`
-  ),
-  /*
-   * The browser half of a handoff, called by the console's approval page rather
-   * than by the CLI. Every one of them carries the submission proof from the
-   * URL fragment in its body, so they are POSTs with no readable URL of their
-   * own; routing them through here is what keeps the page from writing those
-   * paths by hand.
-   */
-  cliBrowserDetails: operation()(
-    "POST",
-    (id) => `/v1/cli/browser/${seg(id)}/details`
-  ),
-  cliBrowserSubmit: operation()(
-    "POST",
-    (id) => `/v1/cli/browser/${seg(id)}/submit`
-  ),
-  cliBrowserRegister: operation()(
-    "POST",
-    (id) => `/v1/cli/browser/${seg(id)}/register`
-  ),
-  cliBrowserGoogle: operation()(
-    "POST",
-    (id) => `/v1/cli/browser/${seg(id)}/google`
-  )
-};
 
 // src/common.ts
 import { randomBytes } from "node:crypto";
@@ -16579,14 +17655,14 @@ async function required2(flags, key, label = key) {
   return typeof value === "string" ? value : await prompt(label, flags);
 }
 async function resolveProvider(ctx, id) {
-  const { data } = await ctx.call("listProviders", []);
+  const { data } = await ctx.call("listProviders");
   const matches = data.providers.filter((p) => p.id === id || p.slug === id);
   if (matches.length !== 1 || !matches[0])
     fail("provider_not_found", "Choose one exact provider ID or slug.");
   return matches[0];
 }
 async function resolveGateway(ctx, id) {
-  const { data } = await ctx.call("listProviderGateways", []);
+  const { data } = await ctx.call("listProviderGateways");
   const value = data.gateways.find((g) => g.id === id);
   if (!value)
     fail("provider_gateway_not_found", "Provider gateway ID was not found.");
@@ -16596,14 +17672,14 @@ async function resourceCommand(ctx, command, args, flags) {
   const [group, action] = command.split(" ");
   const gateway = group === "provider-gateway";
   if (action === "types") {
-    const { data } = await ctx.publicCall("getCliCapabilities", []);
+    const { data } = await ctx.publicCall("getCliCapabilities");
     return gateway ? data.providerGateways.map((entry) => ({
       ...entry,
       type: entry.type === "cf_aig" ? "cloudflare" : entry.type
     })) : data.providers;
   }
   if (action === "list")
-    return gateway ? (await ctx.call("listProviderGateways", [])).data : (await ctx.call("listProviders", [])).data;
+    return gateway ? (await ctx.call("listProviderGateways")).data : (await ctx.call("listProviders")).data;
   let existingProvider;
   let existingGateway;
   const target = args[0];
@@ -16623,14 +17699,14 @@ async function resourceCommand(ctx, command, args, flags) {
         `Delete ${group} ${existingGateway.name} (${existingGateway.id})? Referenced by ${existingGateway.referencedCount} providers; deletion is refused until all references are removed.`,
         flags
       );
-      return (await ctx.call("deleteProviderGateway", [existingGateway.id])).data;
+      return (await ctx.call("deleteProviderGateway", { params: { id: existingGateway.id } })).data;
     }
     if (!existingProvider) fail("invalid_arguments", "Supply the resource to remove.");
     await confirm(
       `Delete ${group} ${existingProvider.name} (${existingProvider.id})? Apps referencing this provider lose access through this slug.`,
       flags
     );
-    return (await ctx.call("deleteProvider", [existingProvider.id])).data;
+    return (await ctx.call("deleteProvider", { params: { id: existingProvider.id } })).data;
   }
   if (action === "add") {
     const type = await required2(
@@ -16664,7 +17740,7 @@ async function resourceCommand(ctx, command, args, flags) {
       await ctx.bootstrap();
       if (flags.browser)
         return ctx.operation("provider-gateway.add", { ...draft2 });
-      const created2 = await ctx.create("createProviderGateway", [], body2);
+      const created2 = await ctx.create("createProviderGateway", { body: body2 });
       await created2.complete();
       return created2.data;
     }
@@ -16696,8 +17772,9 @@ async function resourceCommand(ctx, command, args, flags) {
     let body;
     if (!flags.browser) body = validate(ProviderCreateRequestSchema, draft);
     await ctx.bootstrap();
-    if (flags.browser) return ctx.operation("provider.add", { ...draft });
-    const created = await ctx.create("createProvider", [], body);
+    if (flags.browser)
+      return ctx.operation("provider.add", validate(HandoffProviderAddPayloadSchema, draft));
+    const created = await ctx.create("createProvider", { body });
     await created.complete();
     return created.data;
   }
@@ -16707,7 +17784,8 @@ async function resourceCommand(ctx, command, args, flags) {
       const value2 = await secret(flags, "Gateway token");
       if (flags.browser)
         return ctx.operation("provider-gateway.rotate-key", { id: existingGateway.id, revision: existingGateway.revision });
-      return (await ctx.call("rotateProviderGateway", [existingGateway.id], {
+      return (await ctx.call("rotateProviderGateway", {
+        params: { id: existingGateway.id },
         body: { token: value2, revision: existingGateway.revision }
       })).data;
     }
@@ -16720,7 +17798,8 @@ async function resourceCommand(ctx, command, args, flags) {
     const value = await secret(flags, "Provider API key");
     if (flags.browser)
       return ctx.operation("provider.rotate-key", { id: existingProvider.id, revision: existingProvider.revision });
-    return (await ctx.call("updateProvider", [existingProvider.id], {
+    return (await ctx.call("updateProvider", {
+      params: { id: existingProvider.id },
       body: { secret: value, revision: existingProvider.revision }
     })).data;
   }
@@ -16731,7 +17810,7 @@ async function resourceCommand(ctx, command, args, flags) {
         name: await required2(flags, "name"),
         revision: existingGateway.revision
       });
-      return (await ctx.call("updateProviderGateway", [existingGateway.id], { body: body2 })).data;
+      return (await ctx.call("updateProviderGateway", { params: { id: existingGateway.id }, body: body2 })).data;
     }
     if (!existingProvider) fail("invalid_arguments", "Supply the provider to update.");
     const draft = {};
@@ -16774,13 +17853,20 @@ async function resourceCommand(ctx, command, args, flags) {
       ...flags.browser ? { secret: "validation-placeholder" } : {}
     });
     if (flags.browser)
-      return ctx.operation("provider.update", { id: existingProvider.id, revision: existingProvider.revision, ...draft });
-    return (await ctx.call("updateProvider", [existingProvider.id], { body })).data;
+      return ctx.operation(
+        "provider.update",
+        validate(HandoffProviderUpdatePayloadSchema, {
+          id: existingProvider.id,
+          revision: existingProvider.revision,
+          ...draft
+        })
+      );
+    return (await ctx.call("updateProvider", { params: { id: existingProvider.id }, body })).data;
   }
   fail("unknown_command", "Unknown command.");
 }
 async function assertSupportedType(ctx, gateway, type) {
-  const { data: capabilities } = await ctx.publicCall("getCliCapabilities", []);
+  const { data: capabilities } = await ctx.publicCall("getCliCapabilities");
   const supported = gateway ? capabilities.providerGateways : capabilities.providers;
   if (!supported.some((p) => p.type === type))
     fail(
@@ -16805,6 +17891,95 @@ import { join, resolve } from "node:path";
 import { homedir, hostname as hostname3, platform } from "node:os";
 import { setTimeout as delay } from "node:timers/promises";
 var posixPermissions = () => process.platform !== "win32";
+var StoredOrigin = external_exports.string().refine(
+  (value) => {
+    try {
+      origin(value);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  "must be a deployment origin without credentials, path, query or fragment"
+);
+var StoredConnectionSchema = external_exports.looseObject({
+  url: StoredOrigin,
+  authenticated: external_exports.boolean(),
+  credential: external_exports.string().optional(),
+  account: external_exports.looseObject({}).optional(),
+  deployment: external_exports.looseObject({}).optional()
+}).refine(
+  (connection) => !connection.authenticated || typeof connection.credential === "string",
+  "an authenticated connection must carry its credential"
+);
+var StoredOperationSchema = external_exports.looseObject({
+  url: StoredOrigin,
+  pollToken: external_exports.string(),
+  kind: external_exports.string(),
+  phase: external_exports.enum(["initiating", "pending"]).optional(),
+  payload: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  generation: external_exports.number().optional(),
+  completed: external_exports.boolean().optional()
+});
+var StoredMutationSchema = external_exports.looseObject({
+  id: external_exports.string(),
+  proof: external_exports.string(),
+  requestHash: external_exports.string(),
+  url: external_exports.string(),
+  accountId: external_exports.string().nullable(),
+  path: external_exports.string(),
+  createdAt: external_exports.string(),
+  completedAt: external_exports.string().optional()
+});
+var StoredInstallationSchema = external_exports.looseObject({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  accountId: external_exports.string(),
+  version: external_exports.string(),
+  phase: external_exports.enum(["prepared", "deployed", "ready"]),
+  databaseId: external_exports.string().optional(),
+  databaseName: external_exports.string().optional(),
+  url: external_exports.string().optional(),
+  vars: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  domains: external_exports.array(external_exports.string()).optional(),
+  pendingDomain: external_exports.string().optional(),
+  bootstrap: external_exports.looseObject({ idempotencyKey: external_exports.string(), pollToken: external_exports.string() }).optional(),
+  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional()
+});
+var CliStateSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  active: StoredConnectionSchema.nullable(),
+  previous: StoredConnectionSchema.optional(),
+  operations: external_exports.record(external_exports.string(), StoredOperationSchema),
+  generation: external_exports.number().optional(),
+  bootstrap: external_exports.looseObject({
+    createdAt: external_exports.string().optional(),
+    idempotencyKey: external_exports.string(),
+    pollToken: external_exports.string()
+  }).optional(),
+  mutations: external_exports.record(external_exports.string(), StoredMutationSchema).optional(),
+  installations: external_exports.record(external_exports.string(), StoredInstallationSchema).optional()
+});
+var RECOVER_STATE = "Recover the state file; it will not be treated as a new account.";
+function parseState(path, text2) {
+  let value;
+  try {
+    value = JSON.parse(text2);
+  } catch {
+    fail("invalid_state", `Connection state at ${path} is not valid JSON.`, RECOVER_STATE, 4);
+  }
+  try {
+    return validate(CliStateSchema, value);
+  } catch (error51) {
+    const first = error51 instanceof CliError ? error51.message.split("; ")[0] : void 0;
+    fail(
+      "invalid_state",
+      `Unsupported or malformed connection state at ${path}${first ? `: ${first}` : ""}.`,
+      RECOVER_STATE,
+      4
+    );
+  }
+}
 function stateDirectory() {
   if (platform() === "win32")
     return join(
@@ -16929,7 +18104,6 @@ async function breakAbandonedLock(path) {
   return true;
 }
 var same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
-var records = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
 function mergeRecords(baseline, local, disk) {
   const merged = { ...disk };
   for (const [id, value] of Object.entries(local)) {
@@ -16941,8 +18115,7 @@ function mergeRecords(baseline, local, disk) {
   return merged;
 }
 function mergeState(baseline, local, disk) {
-  if (!disk || disk.schemaVersion !== 1 || typeof disk.operations !== "object" || disk.operations === null || Array.isArray(disk.operations))
-    return local;
+  if (!disk) return local;
   const connection = baseline && same(baseline.active, local.active) && same(baseline.previous, local.previous) && same(baseline.generation, local.generation) && same(baseline.bootstrap, local.bootstrap) ? disk : local;
   const merged = {
     schemaVersion: 1,
@@ -16960,13 +18133,13 @@ function mergeState(baseline, local, disk) {
   const mutations = mergeRecords(
     baseline?.mutations ?? {},
     local.mutations ?? {},
-    records(disk.mutations)
+    disk.mutations ?? {}
   );
   if (Object.keys(mutations).length) merged.mutations = mutations;
   const installations = mergeRecords(
     baseline?.installations ?? {},
     local.installations ?? {},
-    records(disk.installations)
+    disk.installations ?? {}
   );
   if (Object.keys(installations).length) merged.installations = installations;
   return merged;
@@ -17030,50 +18203,32 @@ var StateStore = class {
       });
     }
   }
+  /**
+   * The state this command starts from: what the file holds, or a fresh state
+   * when there is no file.
+   *
+   * Only a missing file is a fresh state. A file that is present and cannot be
+   * read — wrong owner, wrong mode, unparseable, or a shape this release does
+   * not know — is refused, because every one of those would otherwise start a
+   * command as though this machine had never held an account.
+   */
   async read() {
-    try {
-      const s = await lstat(this.path);
-      if (!s.isFile() || s.isSymbolicLink() || posixPermissions() && (process.getuid && s.uid !== process.getuid() || (s.mode & 63) !== 0))
-        fail(
-          "unsafe_storage",
-          "Connection state must be owned by you with mode 0600."
-        );
-      const state = JSON.parse(await readFile2(this.path, "utf8"));
-      if (state.schemaVersion !== 1 || !Object.hasOwn(state, "active") || !state.operations || typeof state.operations !== "object" || Array.isArray(state.operations))
-        fail("invalid_state", "Unsupported or malformed connection state.");
-      if (state.active !== null) {
-        const a = state.active;
-        if (!a || typeof a !== "object" || typeof a.url !== "string" || typeof a.authenticated !== "boolean" || a.authenticated && typeof a.credential !== "string")
-          fail(
-            "invalid_state",
-            "Malformed prior connection; recovery is required."
-          );
-        origin(a.url);
-      }
-      for (const op of Object.values(state.operations)) {
-        if (!op || typeof op.url !== "string" || typeof op.pollToken !== "string" || typeof op.kind !== "string")
-          fail(
-            "invalid_state",
-            "Malformed operation state; recovery is required."
-          );
-        origin(op.url);
-      }
-      this.baseline = structuredClone(state);
-      return state;
-    } catch (e) {
-      if (errorCode(e) === "ENOENT") {
-        const empty = { schemaVersion: 1, active: null, operations: {} };
-        this.baseline = structuredClone(empty);
-        return empty;
-      }
-      if (e instanceof CliError) throw e;
+    const held = await lstat(this.path).catch((error51) => {
+      if (errorCode(error51) === "ENOENT") return null;
+      fail("invalid_state", "Cannot read connection state.", RECOVER_STATE, 4);
+    });
+    if (held && (!held.isFile() || held.isSymbolicLink() || posixPermissions() && (process.getuid && held.uid !== process.getuid() || (held.mode & 63) !== 0)))
       fail(
-        "invalid_state",
-        "Cannot read connection state.",
-        "Recover the state file; it will not be treated as a new account.",
-        4
+        "unsafe_storage",
+        "Connection state must be owned by you with mode 0600."
       );
-    }
+    const state = held && await this.stored() || {
+      schemaVersion: 1,
+      active: null,
+      operations: {}
+    };
+    this.baseline = structuredClone(state);
+    return state;
   }
   /**
    * Persists the state, merged with whatever another command wrote meanwhile.
@@ -17125,13 +18280,23 @@ var StateStore = class {
       else state.generation = merged.generation;
     }
   }
-  /** The state file as it stands, or null when there is nothing to merge with. */
+  /**
+   * The state file as it stands, or null when there is no file at all.
+   *
+   * A file that will not parse is refused here rather than treated as nothing
+   * to merge with: this is what a write reads to keep another command's
+   * receipts, and answering "nothing" would replace a file whose contents
+   * could not be understood with this command's own state.
+   */
   async stored() {
+    let text2;
     try {
-      return JSON.parse(await readFile2(this.path, "utf8"));
-    } catch {
-      return null;
+      text2 = await readFile2(this.path, "utf8");
+    } catch (error51) {
+      if (errorCode(error51) === "ENOENT") return null;
+      fail("invalid_state", "Cannot read connection state.", RECOVER_STATE, 4);
     }
+    return parseState(this.path, text2);
   }
   async replace(state) {
     const temp = join(this.directory, `.state-${randomToken()}`);
@@ -17210,15 +18375,12 @@ var EXAMPLE_GAP_NOTES = {
   body: `This app allows no path whose request shape is known here, so ${BODY_PLACEHOLDER} stands in for the body the provider documents.`
 };
 function examplePath(type, { gatewayRouted = false, model } = {}) {
-  if (type === "openai") return "v1/responses";
-  if (type === "anthropic") return "v1/messages";
-  if (type === "gemini")
-    return model ? `v1beta/models/${model}:generateContent` : void 0;
-  if (gatewayRouted) return "v1/chat/completions";
-  if (type === "groq") return "openai/v1/chat/completions";
-  if (type === "fireworks") return "inference/v1/chat/completions";
-  if (["deepseek", "perplexity", "bytedance"].includes(type)) return "chat/completions";
-  return "v1/chat/completions";
+  const descriptor = isProviderType(type) ? providerDescriptor(type) : void 0;
+  if (descriptor?.modelInPath) {
+    return model ? API_STYLE_PATHS.gemini_native.replace("{model}", model) : void 0;
+  }
+  const own = descriptor?.examplePath ?? API_STYLE_PATHS.chat_completions;
+  return gatewayRouted && own.endsWith("chat/completions") ? API_STYLE_PATHS.chat_completions : own;
 }
 function bodyFor(path, model) {
   const messages = [{ role: "user", content: "Say hello." }];
@@ -17229,8 +18391,8 @@ function bodyFor(path, model) {
     return { contents: [{ parts: [{ text: "Say hello." }] }] };
   return null;
 }
-function modelsFor(provider, policy2, prices) {
-  if (policy2?.allowed_models?.length) return policy2.allowed_models;
+function modelsFor(provider, policy, prices) {
+  if (policy?.allowed_models?.length) return policy.allowed_models;
   return [
     ...Object.keys(provider.pricing ?? {}),
     ...Object.entries(prices[provider.type] ?? {}).filter(([, price]) => price.output !== void 0).map(([model]) => model)
@@ -17238,18 +18400,17 @@ function modelsFor(provider, policy2, prices) {
 }
 function firstRequest(routing, providers, prices) {
   let fallback;
-  for (const provider of providers) {
-    if (provider.status !== "active") continue;
-    const policy2 = routing?.providers?.[provider.slug];
-    if (routing?.providerMode === "selected" && !policy2) continue;
-    const models = modelsFor(provider, policy2, prices);
+  const candidates = routing ? reachableProviders(routing, providers) : providers.filter((provider) => provider.status === "active");
+  for (const provider of candidates) {
+    const policy = routing?.providers.mode === "selected" ? providerPolicyFor(routing, provider.slug) : void 0;
+    const models = modelsFor(provider, policy, prices);
     const model = models[0] ?? MODEL_PLACEHOLDER;
     const gaps = models.length ? [] : ["model"];
     const fallbackPath = examplePath(provider.type, {
       gatewayRouted: Boolean(provider.providerGatewayId),
       model
     });
-    const paths = policy2?.allowed_paths?.length ? policy2.allowed_paths : fallbackPath ? [fallbackPath] : [];
+    const paths = policy?.allowed_paths?.length ? policy.allowed_paths : fallbackPath ? [fallbackPath] : [];
     for (const entry of paths) {
       const path = typeof entry === "string" ? entry : entry.path;
       if (path.includes("*")) continue;
@@ -17298,8 +18459,16 @@ function curlSnippet(options) {
 ` + (example.anthropic ? "  -H 'anthropic-version: 2023-06-01' \\\n" : "") + `  -d ${shellQuote(body)}
 `;
 }
+var ISSUER_TOKEN_NOTE = "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration.";
+function swiftSignsInUsers(authentication) {
+  return authentication?.type === "apple_app_attest" && authentication.end_user.source === "issuer";
+}
+function swiftAuthMode(authentication) {
+  return swiftSignsInUsers(authentication) ? ".appAttest(issuerTokenProvider: { forceRefresh in\n        // Return a fresh signed token from your configured identity SDK.\n        try await yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh)\n    })" : ".appAttestInstall";
+}
 function swiftSnippet(options) {
-  const { baseUrl, appId, example, notes: notes2, authMode = ".appAttestInstall" } = options;
+  const { baseUrl, appId, example, notes: notes2, authentication } = options;
+  const authMode = swiftAuthMode(authentication);
   const target = "endpoint" in example.target ? `endpointSlug: ${JSON.stringify(example.target.endpoint)}` : `provider: ${JSON.stringify(example.target.provider)},
     providerPath: ${JSON.stringify(example.target.path)}`;
   const body = example.body ? `request.httpBody = Data(${JSON.stringify(JSON.stringify(example.body))}.utf8)` : `// Supply the provider-native JSON body.
@@ -17323,33 +18492,54 @@ print(String(decoding: data, as: UTF8.self))
 `;
 }
 
+// ../src/shared/app-defaults.ts
+function unlimitedScope() {
+  return {
+    requests: { per_minute: null, per_day: null },
+    spending: { monthly_usd: null }
+  };
+}
+function mobileDefaultLimits() {
+  return {
+    per_user: { requests: { per_minute: 10, per_day: 300 }, spending: { monthly_usd: null } },
+    per_app: unlimitedScope()
+  };
+}
+function emptyPolicy() {
+  return { allowed_paths: [], allowed_models: [] };
+}
+function newAppConfig(input) {
+  const routing = { providers: { mode: "all" }, model_rewrites: {} };
+  if (input.type === "api_key") {
+    return {
+      authentication: {
+        type: "api_key",
+        ...input.endUser ? { end_user: input.endUser } : {}
+      },
+      routing
+    };
+  }
+  return {
+    authentication: {
+      type: "apple_app_attest",
+      app_attest: {
+        team_id: input.teamId,
+        bundle_id: input.bundleId,
+        ...input.environments ? { environments: [...input.environments] } : {}
+      },
+      end_user: input.endUser ?? { source: "app_install" }
+    },
+    routing,
+    limits: mobileDefaultLimits()
+  };
+}
+
 // src/apps.ts
-var unlimited = () => ({
-  requests: { per_minute: null, per_day: null },
-  spending: { monthly_usd: null }
-});
-var policy = () => ({ allowed_paths: [], allowed_models: [] });
 function documentOf(app2) {
   return localApp({ name: app2.name, config: app2.config, status: app2.status });
 }
 function localApp(value) {
-  const doc = validate(AppWriteSchema, value);
-  const auth = doc.config.authentication;
-  if (auth.type === "apple_app_attest") {
-    if (!/^[A-Z0-9]{10}$/.test(auth.app_attest.team_id))
-      fail(
-        "invalid_input",
-        "App Attest team_id must contain ten uppercase letters or digits."
-      );
-    if (!/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/.test(auth.app_attest.bundle_id))
-      fail(
-        "invalid_input",
-        "App Attest bundle_id must be a reverse DNS identifier."
-      );
-  }
-  if (auth.type === "api_key" && !auth.end_user && doc.config.limits?.per_user && (doc.config.limits.per_user.requests.per_minute !== null || doc.config.limits.per_user.requests.per_day !== null || doc.config.limits.per_user.spending.monthly_usd !== null))
-    fail("invalid_input", "User limits require an end-user identity source.");
-  return doc;
+  return validate(AppWriteSchema, value);
 }
 async function appDocument(flags, current) {
   if (flags.file) {
@@ -17383,27 +18573,22 @@ async function appDocument(flags, current) {
     doc = localApp({
       name: flags.name ?? (ios && bundle ? bundle.split(".").slice(-2).join(" ") : await required2(flags, "name", "App name")),
       status: flags.status ?? "active",
-      config: {
-        authentication: ios ? {
-          type: "apple_app_attest",
-          end_user: { source: "app_install" },
-          app_attest: {
-            team_id: await required2(flags, "team-id", "Apple team ID"),
-            bundle_id: bundle,
-            environments: (flags["attest-environments"] ?? "production,development").split(",")
-          }
-        } : { type: "api_key" },
-        routing: { providers: { mode: "all" }, model_rewrites: {} },
-        ...ios ? {
-          limits: {
-            per_user: {
-              requests: { per_minute: 10, per_day: 300 },
-              spending: { monthly_usd: null }
-            },
-            per_app: unlimited()
-          }
-        } : {}
-      }
+      config: ios ? newAppConfig({
+        type: "apple_app_attest",
+        teamId: await required2(flags, "team-id", "Apple team ID"),
+        // Asked for above, because `ios` is exactly when there is one.
+        bundleId: bundle ?? "",
+        /*
+         * Both environments, which is `agw`'s own default rather than the
+         * schema's: someone reaching for the CLI to create an iOS app is
+         * building it, and a development-signed build is what they have in
+         * hand. Passed through unmapped, so `localApp` below is what
+         * refuses a name that is neither.
+         */
+        environments: attestEnvironments(
+          flags["attest-environments"] ?? "production,development"
+        )
+      }) : newAppConfig({ type: "api_key" })
     });
   }
   if (flags.name) doc.name = flags.name;
@@ -17417,22 +18602,25 @@ async function appDocument(flags, current) {
     if (flags["team-id"]) auth.app_attest.team_id = flags["team-id"];
     if (flags["bundle-id"]) auth.app_attest.bundle_id = flags["bundle-id"];
     if (flags["attest-environments"])
-      auth.app_attest.environments = flags["attest-environments"].split(",").map((value) => value === "development" ? "development" : "production");
+      auth.app_attest.environments = attestEnvironments(flags["attest-environments"]);
   }
   const selectedProviders = flagList(flags.provider);
   if (selectedProviders.length) {
-    const previous = doc.config.routing.providers.selected ?? {};
+    const previous = selectedProviderPolicies(doc.config.routing);
     doc.config.routing.providers = {
       mode: "selected",
       selected: Object.fromEntries(
-        selectedProviders.map((slug) => [slug, previous[slug] ?? policy()])
+        selectedProviders.map((slug) => [slug, previous[slug] ?? emptyPolicy()])
       )
     };
   }
   if (flags["all-providers"]) doc.config.routing.providers = { mode: "all" };
   return localApp(doc);
 }
-async function remoteValidation(ctx, doc, id = "validation-preview") {
+function attestEnvironments(value) {
+  return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+async function remoteValidation(ctx, doc, id) {
   if (!ctx.active?.credential)
     return {
       local: true,
@@ -17441,7 +18629,7 @@ async function remoteValidation(ctx, doc, id = "validation-preview") {
         "Provider references, pricing, and saved configuration checks require login."
       ]
     };
-  const { data } = await ctx.call("validateApp", [id], { body: doc });
+  const { data } = id === void 0 ? await ctx.call("validateAppDraft", { body: doc }) : await ctx.call("validateApp", { params: { app: id }, body: doc });
   return { local: true, remote: true, ...data };
 }
 function mintedKey(value) {
@@ -17465,7 +18653,7 @@ async function saveKey(ctx, keyRecord, output, appId) {
     }
     let revoked = false;
     try {
-      await ctx.call("revokeAppKey", [appId, keyRecord.id]);
+      await ctx.call("revokeAppKey", { params: { app: appId, key: keyRecord.id } });
       revoked = true;
     } catch {
     }
@@ -17495,7 +18683,7 @@ async function saveKey(ctx, keyRecord, output, appId) {
 }
 async function appCommand(ctx, command, args, flags) {
   const action = command.slice(4);
-  if (action === "list") return (await ctx.call("listApps", [])).data;
+  if (action === "list") return (await ctx.call("listApps")).data;
   if (action === "validate") {
     const doc2 = localApp(await jsonFile(await required2(flags, "file")));
     return { definition: doc2, validation: await remoteValidation(ctx, doc2) };
@@ -17505,7 +18693,7 @@ async function appCommand(ctx, command, args, flags) {
     let revision = 0;
     const appId2 = args[0] ?? "";
     if (action === "update") {
-      const r = await ctx.call("getApp", [appId2]);
+      const r = await ctx.call("getApp", { params: { app: appId2 } });
       current = documentOf(r.data.app);
       revision = r.data.app.revision;
       if (!revision && !flags["dry-run"])
@@ -17529,16 +18717,15 @@ async function appCommand(ctx, command, args, flags) {
         definition: doc2,
         validation: await remoteValidation(ctx, doc2, appId2 || void 0)
       };
-    const output = action === "add" && doc2.config.authentication.type === "api_key" ? await ctx.keyOutput(operations.createApp.path(), doc2, flags["key-output"]) : null;
+    const output = action === "add" && doc2.config.authentication.type === "api_key" ? await ctx.keyOutput(operationPath("createApp"), doc2, flags["key-output"]) : null;
     try {
       let app2;
-      let resolved;
       let configError;
       let key;
       if (action === "add") {
         await ctx.bootstrap();
-        const created = await ctx.create("createApp", [], doc2);
-        ({ app: app2, resolved, config_error: configError } = created.data);
+        const created = await ctx.create("createApp", { body: doc2 });
+        ({ app: app2, config_error: configError } = created.data);
         if (output) {
           if (created.keyMetadata) key = created.keyMetadata;
           else {
@@ -17556,10 +18743,11 @@ async function appCommand(ctx, command, args, flags) {
         }
         await created.complete();
       } else {
-        const updated = await ctx.call("updateApp", [appId2], {
+        const updated = await ctx.call("updateApp", {
+          params: { app: appId2 },
           body: { ...doc2, revision }
         });
-        ({ app: app2, resolved, config_error: configError } = updated.data);
+        ({ app: app2, config_error: configError } = updated.data);
       }
       let snippet;
       try {
@@ -17574,7 +18762,6 @@ ${snippet}`;
       return {
         ...snippet ? { snippet } : {},
         app: app2,
-        resolved,
         config_error: configError,
         ...key ? { applicationKey: key } : {},
         guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
@@ -17586,31 +18773,31 @@ ${snippet}`;
   if (action.startsWith("key ")) {
     const sub = action.slice(4);
     const appId2 = args[0] ?? "";
-    const { data: app2 } = await ctx.call("getApp", [appId2]);
+    const { data: app2 } = await ctx.call("getApp", { params: { app: appId2 } });
     if (documentOf(app2.app).config.authentication.type !== "api_key")
       fail(
         "invalid_input",
         "Only server applications support application keys."
       );
-    if (sub === "list") return (await ctx.call("listAppKeys", [appId2])).data;
+    if (sub === "list") return (await ctx.call("listAppKeys", { params: { app: appId2 } })).data;
     if (sub === "revoke") {
       const keyId = args[1] ?? "";
       await confirm(
         `Revoke key ${keyId} for app ${appId2}? Clients using it will lose access.`,
         flags
       );
-      return (await ctx.call("revokeAppKey", [appId2, keyId])).data;
+      return (await ctx.call("revokeAppKey", { params: { app: appId2, key: keyId } })).data;
     }
     const name = await required2(flags, "name");
     if (!name.trim() || name.length > 100)
       fail("invalid_input", "Key name must be 1\u2013100 characters.");
     const output = await ctx.keyOutput(
-      operations.createAppKey.path(appId2),
+      operationPath("createAppKey", { app: appId2 }),
       { name },
       flags["key-output"]
     );
     try {
-      const created = await ctx.create("createAppKey", [appId2], { name });
+      const created = await ctx.create("createAppKey", { params: { app: appId2 }, body: { name } });
       let applicationKey = created.keyMetadata;
       if (!applicationKey) {
         const minted = mintedKey(created.data);
@@ -17631,7 +18818,7 @@ ${snippet}`;
     }
   }
   const appId = args[0] ?? "";
-  const { data } = await ctx.call("getApp", [appId]);
+  const { data } = await ctx.call("getApp", { params: { app: appId } });
   if (action === "show") return data;
   const doc = documentOf(data.app);
   if (action === "remove") {
@@ -17639,13 +18826,13 @@ ${snippet}`;
       `Delete app ${data.app.name} (${appId})? Its keys, users and authentication state will be removed and clients will lose access.`,
       flags
     );
-    return (await ctx.call("deleteApp", [appId])).data;
+    return (await ctx.call("deleteApp", { params: { app: appId }, query: { confirm: appId } })).data;
   }
   if (action === "check") {
     const validation = await remoteValidation(ctx, doc, appId);
-    const { data: providers } = await ctx.call("listProviders", []);
-    const selected = doc.config.routing.providers.mode === "all" ? providers.providers : providers.providers.filter(
-      (p) => Object.hasOwn(doc.config.routing.providers.selected ?? {}, p.slug)
+    const { data: providers } = await ctx.call("listProviders");
+    const selected = providers.providers.filter(
+      (p) => providerPolicyFor(doc.config.routing, p.slug) !== void 0
     );
     return {
       appId,
@@ -17656,7 +18843,7 @@ ${snippet}`;
         slug: p.slug,
         status: p.status
       })),
-      ready: doc.status === "active" && selected.some((p) => p.status === "active") && !data.config_error,
+      ready: doc.status === "active" && reachableProviders(doc.config.routing, selected).length > 0 && !data.config_error,
       limitations: [
         "No inference was sent.",
         "Physical device attestation, issuer login, subscription entitlement and upstream credentials were not exercised."
@@ -17677,7 +18864,7 @@ ${snippet}`;
     const notes2 = [];
     let example;
     if (flags.endpoint) {
-      const endpoint = doc.config.endpoints?.[flags.endpoint];
+      const endpoint = doc.config.endpoints[flags.endpoint];
       if (!endpoint)
         fail("endpoint_not_found", "Choose an existing named endpoint.");
       const responses = endpoint.api_style === "responses";
@@ -17688,14 +18875,9 @@ ${snippet}`;
         gaps: responses ? [] : ["body"]
       };
     } else {
-      const routing = {
-        providerMode: doc.config.routing.providers.mode,
-        providers: doc.config.routing.providers.selected
-      };
-      const { data: all } = await ctx.call("listProviders", []);
-      const reachable = all.providers.filter(
-        (p) => p.status === "active" && (routing.providerMode === "all" || Object.hasOwn(routing.providers ?? {}, p.slug))
-      );
+      const routing = doc.config.routing;
+      const { data: all } = await ctx.call("listProviders");
+      const reachable = reachableProviders(routing, all.providers);
       const requested = typeof flags.provider === "string" ? flags.provider : void 0;
       if (requested && !reachable.some((p) => p.slug === requested))
         fail(
@@ -17703,7 +18885,7 @@ ${snippet}`;
           all.providers.some((p) => p.slug === requested) ? "That provider is disabled or outside this app's proxy policy." : "No provider has that slug.",
           "Run agw provider list for the slugs, and agw app show <id> for the policy."
         );
-      const { data: catalog } = await ctx.call("listModelPrices", []);
+      const { data: catalog } = await ctx.call("listModelPrices");
       const providers = requested ? reachable.filter((p) => p.slug === requested) : reachable;
       example = firstRequest(routing, providers, catalog.prices);
       if (!requested && reachable.length > 1)
@@ -17713,17 +18895,12 @@ ${snippet}`;
     const clientUrl = ctx.active?.deployment?.apiUrl ?? ctx.url;
     let snippet;
     if (ios) {
-      const endUser = doc.config.authentication.type === "apple_app_attest" ? doc.config.authentication.end_user : void 0;
-      const issuer = endUser?.source === "issuer";
-      if (issuer)
-        notes2.push(
-          "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration."
-        );
+      if (swiftSignsInUsers(doc.config.authentication)) notes2.push(ISSUER_TOKEN_NOTE);
       snippet = swiftSnippet({
         baseUrl: clientUrl,
         appId,
         example,
-        authMode: issuer ? ".appAttest(issuerTokenProvider: { forceRefresh in\n        // Return a fresh signed token from your configured identity SDK.\n        try await yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh)\n    })" : ".appAttestInstall",
+        authentication: doc.config.authentication,
         notes: [
           "Swift package: https://github.com/maxceem/app-ai-gateway-swift (from: 1.0.0)",
           "Enable App Attest and test on a supported physical device.",
@@ -17769,6 +18946,7 @@ var RECORDED_RESULT = {
   createProviderGateway: ProviderGatewayResponseSchema
 };
 var recordedResultFor = RECORDED_RESULT;
+var pathFor = operationPath;
 var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429]);
 var RECEIPT_BOUND_STATUS = /* @__PURE__ */ new Set([409, 410]);
 function definitiveRefusal(error51) {
@@ -17806,13 +18984,12 @@ var Context = class {
    * this is what keeps an undocumented server field — or anything an unexpected
    * response carries — out of the values the commands go on to print.
    */
-  async publicCall(name, params, { body, key, url: url2, headers } = {}) {
-    const descriptor = operations[name];
+  async publicCall(name, { params, query, body, key, url: url2, headers } = {}) {
     const wire = await this.transport.request(
       url2 ?? this.url,
-      descriptor.path(...params),
+      pathFor(name, params, query),
       {
-        method: descriptor.method,
+        method: CATALOG[name].method,
         ...body === void 0 ? {} : { body },
         ...key === void 0 ? {} : { key },
         ...headers === void 0 ? {} : { headers }
@@ -17821,7 +18998,7 @@ var Context = class {
     return { data: this.parse(name, wire.data) };
   }
   parse(name, data) {
-    const parsed = responseSchemaFor[name].safeParse(data);
+    const parsed = CATALOG[name].response.safeParse(data);
     if (!parsed.success)
       fail(
         "invalid_response",
@@ -17844,11 +19021,8 @@ var Context = class {
     return parsed.data;
   }
   /** The same call, with the connection's management credential attached. */
-  async call(name, params, options = {}) {
-    return this.publicCall(name, params, {
-      ...options,
-      key: options.key ?? this.credential(name)
-    });
+  async call(name, options = {}) {
+    return this.publicCall(name, { ...options, key: options.key ?? this.credential(name) });
   }
   /**
    * The current management credential, or the refusal that names the way back.
@@ -17931,7 +19105,7 @@ var Context = class {
    * The receipt in protected state holds the original server answer until the
    * command has printed it; `complete` is what releases it.
    */
-  async create(name, params, body) {
+  async create(name, { params, body }) {
     if (!this.active?.credential)
       fail(
         "login_required",
@@ -17939,8 +19113,7 @@ var Context = class {
         "Run agw account login.",
         4
       );
-    const descriptor = operations[name];
-    const path = descriptor.path(...params);
+    const path = pathFor(name, params);
     const mutation2 = await this.prepareCreate(path, body);
     if (mutation2.accountId === null) {
       mutation2.accountId = this.active.account?.id ?? null;
@@ -17979,7 +19152,7 @@ var Context = class {
       const keyRecord = recoveredKey(name, recovered);
       if (keyRecord) {
         const appId = recoveredAppId(name, recovered, params);
-        const { data: existing } = await this.call("listAppKeys", [appId]);
+        const { data: existing } = await this.call("listAppKeys", { params: { app: appId } });
         if (!existing.keys.some(
           (key) => key.id === keyRecord.id && key.status === "active"
         )) {
@@ -17997,7 +19170,8 @@ var Context = class {
       }
       data = recovered;
     } else {
-      const response = await this.call(name, params, {
+      const response = await this.call(name, {
+        ...params === void 0 ? {} : { params },
         body,
         headers: {
           "Idempotency-Key": mutation2.id,
@@ -18082,11 +19256,10 @@ var Context = class {
         4
       );
     const { idempotencyKey, pollToken } = reservation;
-    const { data } = await this.publicCall(
-      "bootstrapCliAccount",
-      [],
-      { body: { idempotencyKey, pollToken }, url: CLOUD }
-    ).catch(async (error51) => {
+    const { data } = await this.publicCall("bootstrapCliAccount", {
+      body: { idempotencyKey, pollToken },
+      url: CLOUD
+    }).catch(async (error51) => {
       if (definitiveRefusal(error51)) {
         delete this.state.bootstrap;
         await this.save().catch(() => {
@@ -18097,7 +19270,7 @@ var Context = class {
     await this.select(CLOUD, data);
     this.onboarding = {
       account: data.account,
-      trial: data.trial,
+      unclaimedAccess: data.unclaimedAccess,
       deployment: data.deployment
     };
     delete this.state.bootstrap;
@@ -18133,7 +19306,7 @@ var Context = class {
     const token = await secret(this.flags, "Management API key");
     if (!token)
       fail("input_required", "A management API key is required.", "Supply it with --key-stdin.");
-    const { data } = await this.publicCall("getCliAccount", [], { key: token, url: url2 });
+    const { data } = await this.publicCall("getCliAccount", { key: token, url: url2 });
     await this.select(url2, { ...data, credential: { token } });
     return { connected: true, ...data };
   }
@@ -18161,12 +19334,14 @@ var Context = class {
       };
       await this.save();
     }
-    const operation3 = this.state.operations[localId];
-    const { data: capabilities } = await this.publicCall("getCliCapabilities", [], {
+    const operation2 = this.state.operations[localId];
+    const { data: capabilities } = await this.publicCall("getCliCapabilities", {
       url: target
     });
-    const { data } = await this.publicCall("createCliOperation", [], {
-      body: { kind, payload, pollToken: operation3.pollToken },
+    const { data } = await this.publicCall("createCliOperation", {
+      // One member of the per-kind union: `payload` was typed by `kind` above,
+      // which is the correlation the compiler cannot follow through a generic.
+      body: { kind, payload, pollToken: operation2.pollToken },
       url: target,
       ...authenticated ? { key: this.active?.credential } : {}
     });
@@ -18179,7 +19354,7 @@ var Context = class {
         "invalid_response",
         "The handoff URL is not on this deployment\u2019s trusted console origin."
       );
-    this.state.operations[data.id] = { ...operation3, phase: "pending" };
+    this.state.operations[data.id] = { ...operation2, phase: "pending" };
     delete this.state.operations[localId];
     await this.save();
     if (!this.flags["no-open"]) await openBrowser(data.url);
@@ -18193,34 +19368,35 @@ Operation: ${data.id}
     return this.wait(data.id, 300);
   }
   async poll(id) {
-    const operation3 = this.state.operations[id];
-    if (!operation3)
+    const operation2 = this.state.operations[id];
+    if (!operation2)
       fail(
         "operation_unknown",
         "This operation has no locally stored polling authorization.",
         "Resume it from the machine that initiated the operation.",
         4
       );
-    if (this.active && this.active.url !== operation3.url)
+    if (this.active && this.active.url !== operation2.url)
       fail(
         "operation_context",
         "This operation belongs to another selected deployment.",
         "Reconnect explicitly to the operation\u2019s originating deployment.",
         4
       );
-    const { data } = await this.publicCall("pollCliOperation", [id], {
-      key: operation3.pollToken,
-      url: operation3.url
+    const { data } = await this.publicCall("pollCliOperation", {
+      params: { id },
+      key: operation2.pollToken,
+      url: operation2.url
     });
-    if (data.state === "completed" && !operation3.completed && operation3.kind === "claim") {
-      if ((this.state.generation ?? 0) !== operation3.generation)
+    if (data.state === "completed" && !operation2.completed && operation2.kind === "claim") {
+      if ((this.state.generation ?? 0) !== operation2.generation)
         fail(
           "operation_context",
           "The active connection changed after this operation began.",
           "Start a new login for the intended connection.",
           4
         );
-      operation3.completed = true;
+      operation2.completed = true;
       if (this.active && data.account) this.active.account = data.account;
       await this.save();
     }
@@ -18260,7 +19436,7 @@ function recoveredKey(name, data) {
 }
 function recoveredAppId(name, data, params) {
   if (name === "createApp") return data.app.id;
-  return String(params[0]);
+  return String(params?.app);
 }
 async function openBrowser(url2) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
@@ -18281,14 +19457,9 @@ async function openBrowser(url2) {
 }
 
 // src/deployment.ts
-import { spawn as spawn2 } from "node:child_process";
-import { stripVTControlCharacters } from "node:util";
-import { createRequire as createRequire2 } from "node:module";
 import { randomUUID } from "node:crypto";
-import { cp, writeFile as writeFile2, unlink as unlink2 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join as join3 } from "node:path";
-import { setTimeout as delay3 } from "node:timers/promises";
+import { writeFile as writeFile3, unlink as unlink2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
 
 // src/release.ts
 import { readFile as readFile3, lstat as lstat2, mkdir as mkdir2, rename as rename2, rm, writeFile } from "node:fs/promises";
@@ -18530,7 +19701,12 @@ async function release(requested = VERSION, base = dirname(fileURLToPath(import.
   };
 }
 
-// src/deployment.ts
+// src/cloudflare.ts
+import { spawn as spawn2 } from "node:child_process";
+import { stripVTControlCharacters } from "node:util";
+import { createRequire as createRequire2 } from "node:module";
+import { tmpdir } from "node:os";
+import { setTimeout as delay3 } from "node:timers/promises";
 var require2 = createRequire2(import.meta.url);
 var OUTPUT_TAIL = 5e3;
 function wranglerFailure(args, code, output, redact = []) {
@@ -18751,11 +19927,57 @@ async function resultOf(cf, path, options) {
   if (!data) fail("cloudflare_error", "Cloudflare returned no result.");
   return data.result;
 }
-function hostname4(value) {
-  const u = origin("https://" + value);
-  if (new URL(u).hostname !== value || !value.includes(".") || value.includes(":"))
-    fail("invalid_input", "Supply a hostname without protocol, path or port.");
-  return value;
+function transient(error51) {
+  if (!(error51 instanceof CliError)) return false;
+  if (error51.code === "connection_failed") return true;
+  const status2 = error51.details?.status;
+  return typeof status2 === "number" && status2 >= 500;
+}
+async function whileWarming(run, sleep = delay3, report = (line) => process.stderr.write(line + "\n")) {
+  let wait = 1e3;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await run();
+    } catch (error51) {
+      if (attempt === 5 || !transient(error51)) throw error51;
+      const { code, details } = error51;
+      const status2 = details?.status;
+      report(
+        `Deployment is still coming up (${code}${status2 === void 0 ? "" : ` ${status2}`}); retrying in ${wait / 1e3}s.`
+      );
+      await sleep(wait);
+      wait = Math.min(wait * 2, 8e3);
+    }
+  }
+}
+
+// src/installation.ts
+import { cp, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+import { setTimeout as delay4 } from "node:timers/promises";
+async function advance(ctx, journal, phase, patch = {}) {
+  const fields = journal;
+  for (const [field, value] of Object.entries(patch)) {
+    if (value === void 0) delete fields[field];
+    else fields[field] = value;
+  }
+  journal.phase = phase;
+  await ctx.save();
+}
+async function prepare(ctx, installations, draft) {
+  const journal = { ...draft, phase: "prepared" };
+  installations[draft.id] = journal;
+  await ctx.save();
+  return journal;
+}
+function selectedInstallation(ctx) {
+  if (ctx.active?.deployment?.mode !== "self_hosted")
+    fail("not_self_hosted", "This command requires a selected self-hosted deployment.");
+  return {
+    url: ctx.url,
+    deploymentId: ctx.active.deployment.id,
+    installations: ctx.state.installations ??= {}
+  };
 }
 async function configFile(ctx, journal, artifact) {
   const directory = join3(ctx.store.directory, "deployments", journal.id);
@@ -18792,33 +20014,10 @@ async function configFile(ctx, journal, artifact) {
   await writeFile2(path, JSON.stringify(config2, null, 2), { mode: 384 });
   return { path, directory, config: config2 };
 }
-function transient(error51) {
-  if (!(error51 instanceof CliError)) return false;
-  if (error51.code === "connection_failed") return true;
-  const status2 = error51.details?.status;
-  return typeof status2 === "number" && status2 >= 500;
-}
-async function whileWarming(run, sleep = delay3, report = (line) => process.stderr.write(line + "\n")) {
-  let wait = 1e3;
-  for (let attempt = 0; ; attempt++) {
-    try {
-      return await run();
-    } catch (error51) {
-      if (attempt === 5 || !transient(error51)) throw error51;
-      const { code, details } = error51;
-      const status2 = details?.status;
-      report(
-        `Deployment is still coming up (${code}${status2 === void 0 ? "" : ` ${status2}`}); retrying in ${wait / 1e3}s.`
-      );
-      await sleep(wait);
-      wait = Math.min(wait * 2, 8e3);
-    }
-  }
-}
 async function verifyDeployment(ctx, url2, id) {
   for (let attempt = 0; attempt < 20; attempt++) {
     try {
-      const { data } = await ctx.publicCall("getCliCapabilities", [], { url: url2 });
+      const { data } = await ctx.publicCall("getCliCapabilities", { url: url2 });
       if (data.deployment.id !== id)
         fail(
           "deployment_identity_mismatch",
@@ -18828,7 +20027,7 @@ async function verifyDeployment(ctx, url2, id) {
     } catch (error51) {
       if (error51 instanceof CliError && error51.code === "deployment_identity_mismatch") throw error51;
       if (attempt === 19) throw error51;
-      await delay3(1500);
+      await delay4(1500);
     }
   }
   fail("deployment_identity_mismatch", "The endpoint never identified the expected deployment.");
@@ -18852,10 +20051,10 @@ async function checkDomain(cf, journal, domain2) {
   if (current && current.service !== journal.name)
     fail("domain_in_use", "The hostname is attached to a different Worker.");
   if (!current) {
-    const records2 = await cf.all(
+    const records = await cf.all(
       "/zones/" + zone.id + "/dns_records?name=" + encodeURIComponent(domain2)
     );
-    if (records2.length)
+    if (records.length)
       fail("domain_in_use", "The hostname has existing DNS records; no records were changed.");
   }
   return zone;
@@ -18885,9 +20084,10 @@ async function attachDomain(ctx, cf, journal, domain2, artifact, dryRun) {
       zone_id: zone.id
     }
   });
-  journal.domains = [.../* @__PURE__ */ new Set([...journal.domains ?? [], domain2])];
-  journal.vars = { ...journal.vars, CLI_CONSOLE_ORIGIN: "https://" + domain2 };
-  await ctx.save();
+  await advance(ctx, journal, journal.phase, {
+    domains: [.../* @__PURE__ */ new Set([...journal.domains ?? [], domain2])],
+    vars: { ...journal.vars, CLI_CONSOLE_ORIGIN: "https://" + domain2 }
+  });
   const file2 = await configFile(ctx, journal, artifact);
   await cf.run(["deploy", "--config", file2.path, "--keep-vars"], {
     cwd: file2.directory
@@ -18954,14 +20154,11 @@ async function retireInstallationSecrets(ctx, journal, flags) {
   if (flags["dry-run"] || journal.phase !== "ready" || !journal.secrets) return;
   const kek = journal.secrets["SECRET_VAULT_LOCAL_KEK_V1"];
   if (kek) await ctx.store.vaultKey(journal.id, kek);
-  delete journal.secrets;
-  await ctx.save();
+  await advance(ctx, journal, journal.phase, { secrets: void 0 });
 }
-async function matchExisting(ctx, cf, flags) {
-  if (ctx.active?.deployment?.mode !== "self_hosted")
-    fail("not_self_hosted", "This command requires a selected self-hosted deployment.");
-  const installations = ctx.state.installations ??= {};
-  let journal = installations[ctx.active.deployment.id];
+async function matchExisting(ctx, cf, flags, target) {
+  const { installations } = target;
+  let journal = installations[target.deploymentId];
   if (journal) {
     const settings2 = await resultOf(
       cf,
@@ -18972,7 +20169,7 @@ async function matchExisting(ctx, cf, flags) {
         "deployment_identity_mismatch",
         "The Cloudflare Worker no longer matches this installation journal."
       );
-    const capabilities2 = await verifyDeployment(ctx, ctx.url, journal.id);
+    const capabilities2 = await verifyDeployment(ctx, target.url, journal.id);
     const inventory2 = await currentInventory(
       cf,
       journal.accountId,
@@ -19002,7 +20199,7 @@ async function matchExisting(ctx, cf, flags) {
   const deploymentId = settings.bindings?.find(
     (b) => b.name === "DEPLOYMENT_ID" && b.type === "plain_text"
   )?.text;
-  if (deploymentId !== ctx.active.deployment.id)
+  if (deploymentId !== target.deploymentId)
     fail(
       "deployment_identity_mismatch",
       "Cloudflare Worker identity does not match the selected deployment."
@@ -19014,7 +20211,9 @@ async function matchExisting(ctx, cf, flags) {
       `Bind deployment ${deploymentId} to Cloudflare account ${accountId}, Worker ${name} and D1 ${db.id}?`,
       flags
     );
-  const { data: capabilities } = await ctx.publicCall("getCliCapabilities", []);
+  const { data: capabilities } = await ctx.publicCall("getCliCapabilities", {
+    url: target.url
+  });
   const inventory = await currentInventory(cf, accountId, name, settings);
   journal = {
     id: deploymentId,
@@ -19031,52 +20230,170 @@ async function matchExisting(ctx, cf, flags) {
   }
   return journal;
 }
-async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loadRelease = release) {
+
+// src/deployment.ts
+function hostname4(value) {
+  const u = origin("https://" + value);
+  if (new URL(u).hostname !== value || !value.includes(".") || value.includes(":"))
+    fail("invalid_input", "Supply a hostname without protocol, path or port.");
+  return value;
+}
+async function authorized(flags, cf, loadRelease) {
   const artifact = await loadRelease(flags.version, void 0, {
     archive: flags["release-archive"]
   });
   await cf.authenticate(flags);
-  if (command !== "deployment setup") {
-    const journal2 = await matchExisting(ctx, cf, flags);
-    if (command === "deployment domain") {
-      const domain3 = hostname4(flags.hostname ?? await prompt("Custom hostname", flags));
-      if (!flags["dry-run"])
-        await confirm(
-          `Attach ${domain3} to ${journal2.name} in Cloudflare account ${journal2.accountId}?`,
-          flags
-        );
-      return attachDomain(ctx, cf, journal2, domain3, artifact, Boolean(flags["dry-run"]));
-    }
-    if (!artifact.manifest.upgradeFrom.includes(journal2.version))
-      fail(
-        "unsupported_upgrade",
-        "This release cannot upgrade the selected database schema.",
-        "Use a supported migration release; no data was changed."
-      );
-    const plan2 = {
-      worker: journal2.name,
-      accountId: journal2.accountId,
-      databaseId: journal2.databaseId,
-      fromVersion: journal2.version,
-      toVersion: artifact.manifest.version
-    };
-    if (flags["dry-run"]) return { dryRun: true, ...plan2 };
+  return artifact;
+}
+async function deploymentDomain(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+  const artifact = await authorized(flags, cf, loadRelease);
+  const journal = await matchExisting(ctx, cf, flags, selectedInstallation(ctx));
+  const domain2 = hostname4(flags.hostname ?? await prompt("Custom hostname", flags));
+  if (!flags["dry-run"])
     await confirm(
-      `Update ${journal2.name} to ${artifact.manifest.version}? Database migrations cannot be rolled back automatically.`,
+      `Attach ${domain2} to ${journal.name} in Cloudflare account ${journal.accountId}?`,
       flags
     );
-    const file2 = await configFile(ctx, journal2, artifact);
-    await cf.run(["d1", "migrations", "apply", "DB", "--remote", "--config", file2.path], {
-      cwd: file2.directory
+  return attachDomain(ctx, cf, journal, domain2, artifact, Boolean(flags["dry-run"]));
+}
+async function deploymentUpdate(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+  const artifact = await authorized(flags, cf, loadRelease);
+  const journal = await matchExisting(ctx, cf, flags, selectedInstallation(ctx));
+  if (!artifact.manifest.upgradeFrom.includes(journal.version))
+    fail(
+      "unsupported_upgrade",
+      "This release cannot upgrade the selected database schema.",
+      "Use a supported migration release; no data was changed."
+    );
+  const plan = {
+    worker: journal.name,
+    accountId: journal.accountId,
+    databaseId: journal.databaseId,
+    fromVersion: journal.version,
+    toVersion: artifact.manifest.version
+  };
+  if (flags["dry-run"]) return { dryRun: true, ...plan };
+  await confirm(
+    `Update ${journal.name} to ${artifact.manifest.version}? Database migrations cannot be rolled back automatically.`,
+    flags
+  );
+  const file2 = await configFile(ctx, journal, artifact);
+  await cf.run(["d1", "migrations", "apply", "DB", "--remote", "--config", file2.path], {
+    cwd: file2.directory
+  });
+  await cf.run(["deploy", "--config", file2.path, "--keep-vars"], {
+    cwd: file2.directory
+  });
+  await verifyDeployment(ctx, ctx.url, journal.id);
+  await advance(ctx, journal, journal.phase, { version: artifact.manifest.version });
+  return { updated: true, ...plan };
+}
+function newInstallation(name, accountId, url2, version2) {
+  const id = randomUUID();
+  return {
+    id,
+    name,
+    accountId,
+    databaseName: name + "-" + id.slice(0, 8),
+    version: version2,
+    url: url2,
+    vars: { CLI_CONSOLE_ORIGIN: url2 },
+    bootstrap: { idempotencyKey: randomToken(), pollToken: randomToken() },
+    // Held only until the Worker has them and the install is ready; the vault
+    // key is the one that outlives setup, and it lives in its own file.
+    secrets: {
+      JWT_SECRET: randomToken(),
+      BETTER_AUTH_SECRET: randomToken()
+    }
+  };
+}
+async function completeInstallation(ctx, cf, flags, ready, artifact, installations) {
+  await retireInstallationSecrets(ctx, ready, flags);
+  let journal = ready;
+  if (journal.pendingDomain) {
+    journal = await matchExisting(ctx, cf, flags, {
+      url: journal.url ?? ctx.url,
+      deploymentId: journal.id,
+      installations
+    });
+    if (flags["dry-run"])
+      return {
+        installed: true,
+        pendingDomain: journal.pendingDomain,
+        dryRun: true
+      };
+    await attachDomain(ctx, cf, journal, journal.pendingDomain, artifact, false);
+    await advance(ctx, journal, journal.phase, { pendingDomain: void 0 });
+  }
+  await verifyDeployment(ctx, journal.url ?? ctx.url, journal.id);
+  return {
+    installed: true,
+    deploymentId: journal.id,
+    name: journal.name,
+    accountId: journal.accountId,
+    url: journal.url ?? ctx.url,
+    note: "This installation is already complete. Use deployment connect to authenticate or deployment update to change its release."
+  };
+}
+async function install(ctx, cf, journal, artifact, url2, domain2) {
+  if (!journal.databaseId) {
+    const databases = await cf.all(
+      "/accounts/" + journal.accountId + "/d1/database"
+    );
+    let database = databases.find((d) => d.name === journal.databaseName);
+    if (!database)
+      database = await resultOf(
+        cf,
+        "/accounts/" + journal.accountId + "/d1/database",
+        {
+          method: "POST",
+          body: { name: journal.databaseName }
+        }
+      );
+    await advance(ctx, journal, journal.phase, { databaseId: database.uuid });
+  }
+  const file2 = await configFile(ctx, journal, artifact);
+  await cf.run(["d1", "migrations", "apply", "DB", "--remote", "--config", file2.path], {
+    cwd: file2.directory
+  });
+  const secrets = {
+    ...journal.secrets,
+    SECRET_VAULT_LOCAL_KEK_V1: await ctx.store.vaultKey(journal.id)
+  };
+  const secretPath = join4(file2.directory, "secrets.json");
+  await writeFile3(secretPath, JSON.stringify(secrets), {
+    mode: 384
+  });
+  try {
+    await cf.run(["deploy", "--config", file2.path, "--secrets-file", secretPath], {
+      cwd: file2.directory,
+      redact: Object.values(secrets)
     });
-    await cf.run(["deploy", "--config", file2.path, "--keep-vars"], {
-      cwd: file2.directory
+  } finally {
+    await unlink2(secretPath).catch(() => {
     });
-    await verifyDeployment(ctx, ctx.url, journal2.id);
-    journal2.version = artifact.manifest.version;
-    await ctx.save();
-    return { updated: true, ...plan2 };
   }
+  await advance(ctx, journal, "deployed");
+  await verifyDeployment(ctx, url2, journal.id);
+  const proofs = {
+    idempotencyKey: journal.bootstrap.idempotencyKey,
+    pollToken: journal.bootstrap.pollToken
+  };
+  const { data } = await whileWarming(
+    () => ctx.publicCall("bootstrapCliAccount", { body: proofs, url: url2 })
+  );
+  await ctx.select(url2, data);
+  await advance(ctx, journal, "ready", {
+    ...domain2 ? { pendingDomain: domain2 } : {},
+    secrets: void 0
+  });
+  if (domain2) {
+    await attachDomain(ctx, cf, journal, domain2, artifact, false);
+    await advance(ctx, journal, journal.phase, { pendingDomain: void 0 });
+  }
+}
+async function deploymentSetup(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+  const artifact = await authorized(flags, cf, loadRelease);
   const name = flags.name ?? await prompt("Worker name", flags, { defaultValue: "app-ai-gateway" });
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(name))
     fail("invalid_input", "Worker name must be a lowercase slug of at most 63 characters.");
@@ -19084,58 +20401,29 @@ async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loa
   const accountId = await cf.account(flags);
   const workers = await cf.all("/accounts/" + accountId + "/workers/scripts");
   const installations = ctx.state.installations ??= {};
-  let journal = Object.values(installations).find(
+  const recorded = Object.values(installations).find(
     (j) => j.accountId === accountId && j.name === name
   );
   const exists = workers.some((w) => w.id === name);
-  if (exists && !journal)
+  if (exists && !recorded)
     fail(
       "worker_name_collision",
       "A Worker already uses this name.",
       "Choose a different --name; setup never takes over an existing installation."
     );
-  if (exists && journal) {
+  if (exists && recorded) {
     const settings = await resultOf(
       cf,
       `/accounts/${accountId}/workers/scripts/${name}/settings`
     );
-    if (settings.bindings?.find((b) => b.name === "DEPLOYMENT_ID")?.text !== journal.id)
+    if (settings.bindings?.find((b) => b.name === "DEPLOYMENT_ID")?.text !== recorded.id)
       fail(
         "deployment_identity_mismatch",
         "Existing Worker does not match the saved installation journal."
       );
   }
-  if (journal?.phase === "ready") {
-    await retireInstallationSecrets(ctx, journal, flags);
-    if (journal.pendingDomain) {
-      const inventoryContext = Object.create(ctx);
-      Object.defineProperty(inventoryContext, "active", {
-        value: { deployment: { id: journal.id, mode: "self_hosted" } }
-      });
-      Object.defineProperty(inventoryContext, "url", {
-        value: journal.url ?? ctx.url
-      });
-      journal = await matchExisting(inventoryContext, cf, flags);
-      if (flags["dry-run"])
-        return {
-          installed: true,
-          pendingDomain: journal.pendingDomain,
-          dryRun: true
-        };
-      await attachDomain(ctx, cf, journal, journal.pendingDomain, artifact, false);
-      delete journal.pendingDomain;
-      await ctx.save();
-    }
-    await verifyDeployment(ctx, journal.url ?? ctx.url, journal.id);
-    return {
-      installed: true,
-      deploymentId: journal.id,
-      name,
-      accountId,
-      url: journal.url ?? ctx.url,
-      note: "This installation is already complete. Use deployment connect to authenticate or deployment update to change its release."
-    };
-  }
+  if (recorded?.phase === "ready")
+    return completeInstallation(ctx, cf, flags, recorded, artifact, installations);
   const subdomain = (await resultOf(cf, "/accounts/" + accountId + "/workers/subdomain")).subdomain;
   if (!subdomain)
     fail(
@@ -19157,81 +20445,13 @@ async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loa
     `Install ${name} in Cloudflare account ${accountId} at ${url2}${domain2 ? " with " + domain2 : ""}?`,
     flags
   );
-  if (!journal) {
-    const id = randomUUID();
-    journal = {
-      id,
-      name,
-      accountId,
-      databaseName: name + "-" + id.slice(0, 8),
-      version: artifact.manifest.version,
-      phase: "prepared",
-      url: url2,
-      vars: { CLI_CONSOLE_ORIGIN: url2 },
-      bootstrap: { idempotencyKey: randomToken(), pollToken: randomToken() },
-      // Held only until the Worker has them and the install is ready; the vault
-      // key is the one that outlives setup, and it lives in its own file.
-      secrets: {
-        JWT_SECRET: randomToken(),
-        BETTER_AUTH_SECRET: randomToken()
-      }
-    };
-    installations[id] = journal;
-    await ctx.save();
-  }
+  const journal = recorded ?? await prepare(
+    ctx,
+    installations,
+    newInstallation(name, accountId, url2, artifact.manifest.version)
+  );
   try {
-    if (!journal.databaseId) {
-      const databases = await cf.all("/accounts/" + accountId + "/d1/database");
-      let database = databases.find((d) => d.name === journal.databaseName);
-      if (!database)
-        database = await resultOf(cf, "/accounts/" + accountId + "/d1/database", {
-          method: "POST",
-          body: { name: journal.databaseName }
-        });
-      journal.databaseId = database.uuid;
-      await ctx.save();
-    }
-    const file2 = await configFile(ctx, journal, artifact);
-    await cf.run(["d1", "migrations", "apply", "DB", "--remote", "--config", file2.path], {
-      cwd: file2.directory
-    });
-    const secrets = {
-      ...journal.secrets,
-      SECRET_VAULT_LOCAL_KEK_V1: await ctx.store.vaultKey(journal.id)
-    };
-    const secretPath = join3(file2.directory, "secrets.json");
-    await writeFile2(secretPath, JSON.stringify(secrets), {
-      mode: 384
-    });
-    try {
-      await cf.run(["deploy", "--config", file2.path, "--secrets-file", secretPath], {
-        cwd: file2.directory,
-        redact: Object.values(secrets)
-      });
-    } finally {
-      await unlink2(secretPath).catch(() => {
-      });
-    }
-    journal.phase = "deployed";
-    await ctx.save();
-    await verifyDeployment(ctx, url2, journal.id);
-    const proofs = {
-      idempotencyKey: journal.bootstrap.idempotencyKey,
-      pollToken: journal.bootstrap.pollToken
-    };
-    const { data } = await whileWarming(
-      () => ctx.publicCall("bootstrapCliAccount", [], { body: proofs, url: url2 })
-    );
-    await ctx.select(url2, data);
-    journal.phase = "ready";
-    if (domain2) journal.pendingDomain = domain2;
-    delete journal.secrets;
-    await ctx.save();
-    if (domain2) {
-      await attachDomain(ctx, cf, journal, domain2, artifact, false);
-      delete journal.pendingDomain;
-      await ctx.save();
-    }
+    await install(ctx, cf, journal, artifact, url2, domain2);
     return {
       installed: true,
       ...plan,
@@ -19250,6 +20470,12 @@ async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loa
     throw error51;
   }
 }
+async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loadRelease = release) {
+  if (command === "deployment setup") return deploymentSetup(ctx, flags, cf, loadRelease);
+  if (command === "deployment domain") return deploymentDomain(ctx, flags, cf, loadRelease);
+  if (command === "deployment update") return deploymentUpdate(ctx, flags, cf, loadRelease);
+  fail("unknown_command", "Unknown command.");
+}
 
 // src/style.ts
 import { Writable } from "node:stream";
@@ -19339,8 +20565,8 @@ function humanResult(command, result, context, style2 = plain) {
     return style2.code(result.snippet, language).join("\n") + "\n";
   }
   const lines = render(command, result, context, style2);
-  if ("trial" in result && result.trial)
-    lines.push(`Free access ends: ${result.trial.endsAt}`);
+  if ("unclaimedAccess" in result && result.unclaimedAccess)
+    lines.push(`Free access ends: ${result.unclaimedAccess.endsAt}`);
   if ("account" in result && result.account?.expiresAt)
     lines.push(`Recovery deadline: ${result.account.expiresAt}`);
   return lines.join("\n") + "\n";
@@ -19388,7 +20614,7 @@ function render(command, result, context, style2) {
       return usage(command, result, style2);
     case "operation status":
     case "operation wait":
-      return operation2(result, style2);
+      return operation(result, style2);
     case "app add":
     case "app update":
     case "app validate":
@@ -19434,7 +20660,7 @@ function status(command, result, context, style2) {
         style2
       )
     ];
-  if ("state" in result) return [...did, ...operation2(result, style2)];
+  if ("state" in result) return [...did, ...operation(result, style2)];
   return [...did, style2.json(result)];
 }
 function list(command, result, style2) {
@@ -19670,7 +20896,7 @@ function usage(command, result, style2) {
     );
   return [style2.json(result)];
 }
-function operation2(result, style2) {
+function operation(result, style2) {
   if (!("state" in result)) return [style2.json(result)];
   const stored = "result" in result ? result.result : void 0;
   return kv(
@@ -19716,7 +20942,9 @@ function app(command, result, context, style2) {
           ["Gateway", context.url],
           ["Status", result.definition.status],
           ["Authentication", result.definition.config.authentication.type],
-          ["App ID", result.validation.remote ? result.validation.app_id : void 0]
+          // Only an edit of an application that exists has an id to show; a
+          // new one is judged as a draft and has none yet.
+          ["App ID", result.validation.remote && "app_id" in result.validation ? result.validation.app_id : void 0]
         ],
         style2
       ),
@@ -19942,8 +21170,9 @@ var Transport = class {
 };
 
 // src/usage.ts
+var CLI_BREAKDOWNS = ["provider", "model", "status"];
 function month(value) {
-  if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(value))
+  if (!MONTH_PATTERN.test(value))
     fail(
       "invalid_input",
       "Month must use YYYY-MM with a valid calendar month."
@@ -19966,11 +21195,11 @@ function positive(value, max = 3600) {
 async function usageCommand(ctx, command, flags) {
   if (command === "usage show") {
     const m = month(flags.month ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 7));
-    return flags.app ? (await ctx.call("getAppUsage", [flags.app, { month: m }])).data : (await ctx.call("getCliUsage", [{ month: m }])).data;
+    return flags.app ? (await ctx.call("getAppUsage", { params: { app: flags.app }, query: { month: m } })).data : (await ctx.call("getCliUsage", { query: { month: m } })).data;
   }
   const app2 = await required2(flags, "app");
-  const by = flags.by ?? "model";
-  if (!["provider", "model", "status"].includes(by))
+  const by = CLI_BREAKDOWNS.find((dimension) => dimension === (flags.by ?? "model"));
+  if (by === void 0)
     fail("invalid_input", "--by must be provider, model or status.");
   if (Boolean(flags.from) !== Boolean(flags.to))
     fail("invalid_input", "Supply both --from and --to or neither.");
@@ -19980,7 +21209,10 @@ async function usageCommand(ctx, command, flags) {
   if (from > to) fail("invalid_input", "--from must not be later than --to.");
   const limit = positive(flags.limit ?? 50, 200);
   return {
-    ...(await ctx.call("getAppUsageBreakdown", [app2, { from, to, by, limit }])).data,
+    ...(await ctx.call("getAppUsageBreakdown", {
+      params: { app: app2 },
+      query: { from, to, by, limit }
+    })).data,
     coverage: {
       from,
       to,
@@ -19998,7 +21230,7 @@ async function execute(parsed, ctx) {
   if (command.startsWith("usage ")) return usageCommand(ctx, command, flags);
   if (command.startsWith("operation "))
     return command === "operation wait" ? ctx.wait(args[0] ?? "", positive(flags.timeout ?? 300)) : ctx.poll(args[0] ?? "");
-  if (command === "account status") return (await ctx.call("getCliAccount", [])).data;
+  if (command === "account status") return (await ctx.call("getCliAccount")).data;
   if (command === "account login") return ctx.login();
   if (command === "account claim") return ctx.operation("claim", {});
   if (command === "account logout") {
@@ -20021,7 +21253,7 @@ async function execute(parsed, ctx) {
     return ctx.login(url2);
   }
   if (command === "deployment status") {
-    const { data } = await ctx.publicCall("getCliCapabilities", []);
+    const { data } = await ctx.publicCall("getCliCapabilities");
     return {
       url: ctx.url,
       authenticated: Boolean(ctx.active?.credential),