apiblaze 0.10.0 → 0.11.0

package/dist/index.js

@@ -302,10 +302,10 @@ var init_anon_cred = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk30 = __toESM(require("chalk"));
+var import_chalk32 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.10.0";
+var version = "0.11.0";
 
 // src/index.ts
 init_types();
@@ -2207,7 +2207,7 @@ function renderTrace() {
   console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
   console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
   console.log(
-    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`):\n")
+    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
   );
   entries.forEach((e, i) => {
     const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
@@ -2477,6 +2477,11 @@ async function runRename(project, opts) {
   await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
 }
 
+// src/commands/config-browse.ts
+var import_chalk26 = __toESM(require("chalk"));
+var import_ora11 = __toESM(require("ora"));
+init_auth();
+
 // src/commands/domain.ts
 var import_chalk21 = __toESM(require("chalk"));
 var import_ora7 = __toESM(require("ora"));
@@ -2680,15 +2685,15 @@ async function runTenantCors(opts) {
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const origins2 = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-  const cors = origins2.length ? { allowed_origins: origins2 } : null;
+  const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const cors = origins.length ? { allowed_origins: origins } : null;
   const spinner = (0, import_ora8.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
       path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(opts.tenant)}/cors`,
       body: { cors },
-      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins2.length ? origins2.join(", ") : "(cleared)"}`
+      summary: `Set CORS for tenant ${opts.tenant} \u2192 ${origins.length ? origins.join(", ") : "(cleared)"}`
     });
     spinner.succeed(`CORS updated for ${opts.tenant}.`);
   } catch (err) {
@@ -2697,88 +2702,10 @@ async function runTenantCors(opts) {
   }
 }
 
-// src/commands/key.ts
-var import_chalk23 = __toESM(require("chalk"));
-var import_ora9 = __toESM(require("ora"));
-async function runApikeysMenu(opts) {
-  await runKeyList(opts);
-  if (opts.json) return;
-  const { default: inquirer2 } = await import("inquirer");
-  const { make } = await inquirer2.prompt([
-    { type: "confirm", name: "make", message: "Generate a new control-plane API key?", default: false }
-  ]);
-  if (!make) return;
-  const { desc } = await inquirer2.prompt([
-    { type: "input", name: "desc", message: "Description (optional):" }
-  ]);
-  await runKeyMint({ ...opts, desc: desc || void 0 });
-}
-async function runKeyList(opts) {
-  const { teamId, teamName } = await resolveTeam(opts.team);
-  const out = await admin({
-    method: "GET",
-    path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
-    summary: `List developer keys for team ${teamName ?? teamId}`
-  });
-  const keys = out?.keys ?? [];
-  if (opts.json) {
-    console.log(JSON.stringify(keys));
-    return;
-  }
-  if (!keys.length) {
-    console.log(import_chalk23.default.yellow("No developer keys."));
-    return;
-  }
-  for (const k of keys) {
-    console.log(`  ${import_chalk23.default.bold(k.key_id ?? k.id)}  ${import_chalk23.default.dim(k.description ?? "")}  ${import_chalk23.default.dim(k.expires_at ?? "no expiry")}`);
-  }
-}
-async function runKeyMint(opts) {
-  const { teamId } = await resolveTeam(opts.team);
-  const body = { role: "consumer-admin" };
-  if (opts.desc) body.description = opts.desc;
-  if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
-  const spinner = (0, import_ora9.default)("Minting key...").start();
-  try {
-    const out = await admin({
-      method: "POST",
-      path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
-      body,
-      summary: `Mint a consumer-admin developer key`
-    });
-    spinner.succeed("Key minted.");
-    if (opts.json) {
-      console.log(JSON.stringify(out));
-      return;
-    }
-    console.log(`  ${import_chalk23.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk23.default.bold("key")}:     ${import_chalk23.default.green(out?.key)}  ${import_chalk23.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk23.default.dim("expires:")} ${out.expires_at}`);
-  } catch (err) {
-    spinner.fail("Mint failed.");
-    throw err;
-  }
-}
-async function runKeyRevoke(keyId, opts) {
-  const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora9.default)("Revoking key...").start();
-  try {
-    await admin({
-      method: "DELETE",
-      path: `/teams/${encodeURIComponent(teamId)}/developer-keys/${encodeURIComponent(keyId)}`,
-      summary: `Revoke developer key ${keyId}`
-    });
-    spinner.succeed(`Revoked ${keyId}.`);
-  } catch (err) {
-    spinner.fail("Revoke failed.");
-    throw err;
-  }
-}
-
 // src/commands/spec.ts
 var fs6 = __toESM(require("fs"));
-var import_chalk24 = __toESM(require("chalk"));
-var import_ora10 = __toESM(require("ora"));
+var import_chalk23 = __toESM(require("chalk"));
+var import_ora9 = __toESM(require("ora"));
 async function runSpecGet(project, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
@@ -2791,19 +2718,19 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk24.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk23.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs6.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk24.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk23.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora10.default)("Uploading spec...").start();
+  const spinner = (0, import_ora9.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -2820,12 +2747,12 @@ async function runSpecSet(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk26 = __toESM(require("chalk"));
-var import_ora11 = __toESM(require("ora"));
+var import_chalk25 = __toESM(require("chalk"));
+var import_ora10 = __toESM(require("ora"));
 init_auth();
 
 // src/lib/tools.ts
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk24 = __toESM(require("chalk"));
 init_api();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
@@ -2843,15 +2770,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      const lines = [`  ${import_chalk25.default.dim("Proxy URL:")}  ${import_chalk25.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk25.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk24.default.dim("Proxy URL:")}  ${import_chalk24.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk24.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk25.default.bold("API keys")} ${import_chalk25.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk24.default.bold("API keys")} ${import_chalk24.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk25.default.cyan(env.padEnd(w))}  ${import_chalk25.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk24.default.cyan(env.padEnd(w))}  ${import_chalk24.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk25.default.dim("Try it:")}`, `    ${import_chalk25.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk24.default.dim("Try it:")}`, `    ${import_chalk24.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -3006,23 +2933,23 @@ function truncate(value, max = 1500) {
 }
 function printCost(llm) {
   const usd = llm.cost > 0 ? `$${llm.cost.toFixed(4)}` : "<$0.0001";
-  console.log(import_chalk26.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk26.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
+  console.log(import_chalk25.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk25.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk26.default.bold("APIblaze agent") + import_chalk26.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk26.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk25.default.bold("APIblaze agent") + import_chalk25.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk25.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk26.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk25.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora11.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora10.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -3030,21 +2957,21 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk26.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk25.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp.llm);
-      if (resp.reply) console.log(import_chalk26.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk25.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora11.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora10.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -3062,16 +2989,763 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk26.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk25.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk26.default.dim("\nBye."));
+  console.log(import_chalk25.default.dim("\nBye."));
 }
 
-// src/commands/consumer.ts
+// src/commands/config-browse.ts
+var fullThrottle = (cfg, patch) => ({
+  throttling: { ...cfg.throttling ?? {}, ...patch }
+});
+var fullPolicy = (cfg, patch) => {
+  const merged = { mode: "passthrough", ...cfg.requests_policy ?? {}, ...patch };
+  return { requests_policy: merged };
+};
+var SETTINGS = [
+  {
+    key: "display_name",
+    label: "Display name",
+    group: "Basics",
+    type: "string",
+    desc: "Human-friendly label shown in the dashboard and portal",
+    read: (cfg) => cfg.display_name ?? cfg.project_display_name,
+    toPatch: (v) => ({ display_name: v })
+  },
+  {
+    key: "target_url",
+    label: "Upstream target URL",
+    group: "Basics",
+    type: "string",
+    desc: "Where the proxy forwards requests (cascades to every environment)",
+    read: (cfg) => cfg.target_url ?? dig(cfg, "environments.prod.target") ?? Object.values(cfg.environments ?? {})[0]?.target,
+    toPatch: (v) => ({ target_url: v })
+  },
+  {
+    key: "enabled",
+    label: "Proxy serving",
+    group: "Traffic & limits",
+    type: "boolean",
+    desc: "Master on/off switch \u2014 off stops serving traffic",
+    read: (cfg) => cfg.enabled !== false,
+    toPatch: (v) => ({ enabled: v })
+  },
+  {
+    key: "listenToTraffic",
+    label: "Traffic capture",
+    group: "Traffic & limits",
+    type: "boolean",
+    desc: "Capture request samples to build your OpenAPI spec from real traffic",
+    read: (cfg) => cfg.listenToTraffic !== false,
+    toPatch: (v) => ({ listenToTraffic: v })
+  },
+  {
+    key: "throttling.userRateLimit",
+    label: "Caller rate limit (req/s)",
+    group: "Traffic & limits",
+    type: "number",
+    desc: "Requests/second per authenticated caller",
+    toPatch: (v, cfg) => fullThrottle(cfg, { userRateLimit: v })
+  },
+  {
+    key: "throttling.endUserRateLimit",
+    label: "End-user rate limit (req/s)",
+    group: "Traffic & limits",
+    type: "number",
+    desc: "Requests/second per end user (x-end-user-id)",
+    toPatch: (v, cfg) => fullThrottle(cfg, { endUserRateLimit: v })
+  },
+  {
+    key: "throttling.proxyQuota",
+    label: "Quota (requests/period)",
+    group: "Traffic & limits",
+    type: "number",
+    desc: "Total requests per quota period for the whole proxy",
+    toPatch: (v, cfg) => fullThrottle(cfg, { proxyQuota: v })
+  },
+  {
+    key: "throttling.quotaPeriod",
+    label: "Quota period",
+    group: "Traffic & limits",
+    type: "enum",
+    enum: ["daily", "weekly", "monthly"],
+    desc: "Window the quota applies to",
+    toPatch: (v, cfg) => fullThrottle(cfg, { quotaPeriod: v })
+  },
+  {
+    key: "requests_policy.mode",
+    label: "Credential policy",
+    group: "Access & auth",
+    type: "enum",
+    enum: ["passthrough", "authenticate"],
+    desc: "passthrough = forward anything; authenticate = require a credential",
+    toPatch: (v, cfg) => fullPolicy(cfg, v === "authenticate" ? { mode: v, methods: cfg.requests_policy?.methods?.length ? cfg.requests_policy.methods : ["api_key"] } : { mode: v })
+  },
+  {
+    key: "requests_policy.methods",
+    label: "Accepted credentials",
+    group: "Access & auth",
+    type: "json",
+    desc: "Array from api_key | jwt | opaque (used when policy = authenticate)",
+    toPatch: (v, cfg) => fullPolicy(cfg, { mode: cfg.requests_policy?.mode ?? "authenticate", methods: v })
+  },
+  {
+    key: "auth_type",
+    label: "Consumer login",
+    group: "Access & auth",
+    type: "enum",
+    enum: ["oauth", "none"],
+    desc: "OAuth login for your API consumers (portal sign-in)",
+    read: (cfg) => cfg.auth_type ?? "none",
+    toPatch: (v) => ({ auth_type: v })
+  },
+  {
+    key: "cors",
+    label: "CORS",
+    group: "Access & auth",
+    type: "json",
+    desc: "Per-proxy CORS config object; null clears the override",
+    toPatch: (v) => ({ cors: v })
+  },
+  {
+    key: "enable_portal",
+    label: "Developer portal",
+    group: "Portal & MCP",
+    type: "boolean",
+    desc: "The hosted docs + key-management portal for your consumers",
+    read: (cfg) => cfg.enable_portal !== false,
+    toPatch: (v) => ({ enable_portal: v })
+  },
+  {
+    key: "mcp_enabled",
+    label: "MCP server",
+    group: "Portal & MCP",
+    type: "boolean",
+    desc: "Serve this API as an MCP server for AI agents",
+    read: (cfg) => cfg.mcp_enabled !== false,
+    toPatch: (v) => ({ mcp_enabled: v })
+  },
+  {
+    key: "product_slug",
+    label: "Product tag",
+    group: "Portal & MCP",
+    type: "string",
+    desc: "Team-scoped tag grouping projects in the consumer portal",
+    toPatch: (v) => ({ product_slug: v })
+  }
+];
+var SETTING_GROUPS = ["Basics", "Traffic & limits", "Access & auth", "Portal & MCP"];
+var FEATURES = [
+  { go: "transforms", label: "Transforms", desc: "Rewrite requests/responses (headers, body fields) without touching your upstream" },
+  { go: "mappings", label: "Mapping tables", desc: "Reusable value-mapping tables used by map transforms (values can be hidden/encrypted)" },
+  { go: "tenants", label: "Tenants", desc: "Separate groups of your API consumers \u2014 each with its own portal, login, and keys" },
+  { go: "domains", label: "Custom domains", desc: "Serve the proxy on your own hostname + choose what the bare URL serves" },
+  { go: "spec", label: "OpenAPI spec & traffic", desc: "View the stored spec, refresh it from source, or build it from captured traffic" },
+  { go: "agents", label: "AI agents", desc: "Chat to build your spec, design access rules, or publish an MCP server (billed per turn)" },
+  { go: "danger", label: "Danger zone", desc: "Delete this proxy and everything under it" }
+];
+function dig(blob, dotted) {
+  let cur = blob;
+  for (const part of dotted.split(".")) {
+    if (cur == null || typeof cur !== "object") return void 0;
+    cur = cur[part];
+  }
+  return cur;
+}
+var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
+function show(v) {
+  if (v === void 0) return import_chalk26.default.dim("(unset)");
+  if (v === null) return import_chalk26.default.dim("null");
+  if (typeof v === "object") return import_chalk26.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk26.default.green("on") : import_chalk26.default.red("off");
+  return import_chalk26.default.cyan(String(v));
+}
+function parseValue(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  if (raw === "null") return null;
+  if (raw !== "" && !Number.isNaN(Number(raw))) return Number(raw);
+  if (/^[[{]/.test(raw.trim())) {
+    try {
+      return JSON.parse(raw);
+    } catch {
+    }
+  }
+  return raw;
+}
+async function fetchConfigBlob(proj2) {
+  const out = await admin({
+    method: "GET",
+    path: `/projects?team_id=${encodeURIComponent(proj2.teamId)}`,
+    summary: `Read settings for ${proj2.projectName}`
+  });
+  const rows = out?.projects ?? [];
+  const row = rows.find((r) => r.project_id === proj2.projectId && r.api_version === proj2.apiVersion) ?? rows.find((r) => r.project_id === proj2.projectId);
+  return row?.config ?? {};
+}
+async function patchSetting(proj2, s, value, cfg) {
+  const body = s.toPatch(value, cfg);
+  const spinner = (0, import_ora11.default)(`Set ${s.key}...`).start();
+  try {
+    await admin({
+      method: "PATCH",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
+      body,
+      summary: `Set ${s.key} = ${JSON.stringify(value)}`
+    });
+    spinner.succeed(`${s.key} = ${JSON.stringify(value)}`);
+  } catch (err) {
+    spinner.fail(`Set ${s.key} failed.`);
+    throw err;
+  }
+}
+var loginFirst = (what) => {
+  console.log(import_chalk26.default.yellow(`
+  Log in first to ${what}.`));
+  console.log(import_chalk26.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk26.default.dim("  anonymously and want to bring it into your account.\n"));
+};
+async function runConfig(project, key, value, opts) {
+  const creds = loadCredentials();
+  if (!creds) {
+    await discoveryMenu(project);
+    return;
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = project ? await resolveProject(teamId, project, opts.apiversion) : await pickProject(teamId);
+  const cfg = await fetchConfigBlob(proj2);
+  if (opts.list || key === void 0) {
+    if (opts.list) return printAll(proj2, cfg, opts.json);
+    return navigator(proj2, cfg, opts);
+  }
+  const setting = SETTINGS.find((s) => s.key === key);
+  if (!setting) {
+    console.error(import_chalk26.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk26.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk26.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    process.exit(1);
+  }
+  if (value === void 0) {
+    const v = readSetting(setting, cfg);
+    if (opts.json) console.log(JSON.stringify(v ?? null));
+    else console.log(`${setting.key} = ${show(v)}`);
+    return;
+  }
+  await patchSetting(proj2, setting, parseValue(value), cfg);
+}
+async function pickProject(teamId) {
+  const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
+  const projects = await getProjects2(teamId).catch(() => []);
+  if (!projects.length) {
+    console.error(import_chalk26.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    process.exit(1);
+  }
+  const { default: inquirer2 } = await import("inquirer");
+  const { picked } = await inquirer2.prompt([{
+    type: "list",
+    name: "picked",
+    message: "Which project?",
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk26.default.dim("v" + p.apiVersion)}`, value: p }))
+  }]);
+  return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
+}
+function printAll(proj2, cfg, json) {
+  if (json) {
+    const out = {};
+    for (const s of SETTINGS) out[s.key] = readSetting(s, cfg) ?? null;
+    console.log(JSON.stringify(out, null, 2));
+    return;
+  }
+  console.log(import_chalk26.default.bold(`
+${proj2.projectName} v${proj2.apiVersion} \u2014 settings
+`));
+  for (const group of SETTING_GROUPS) {
+    console.log(import_chalk26.default.bold(group));
+    for (const s of SETTINGS.filter((x) => x.group === group)) {
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk26.default.dim(s.desc)}`);
+    }
+    console.log();
+  }
+  console.log(import_chalk26.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+}
+async function discoveryMenu(project) {
+  const { default: inquirer2 } = await import("inquirer");
+  console.log(import_chalk26.default.bold(`
+APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
+`));
+  console.log(import_chalk26.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk26.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  for (; ; ) {
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: "Explore:",
+      pageSize: 20,
+      choices: [
+        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Settings \u2014")),
+        ...SETTING_GROUPS.map((g) => ({
+          name: `${g}  ${import_chalk26.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          value: { kind: "settings", g }
+        })),
+        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk26.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer2.Separator(),
+        { name: "Exit", value: { kind: "exit" } }
+      ]
+    }]);
+    if (pick2.kind === "exit") return;
+    if (pick2.kind === "settings") {
+      console.log();
+      for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
+        console.log(`  ${import_chalk26.default.bold(s.label.padEnd(28))} ${import_chalk26.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk26.default.dim("  key: " + s.key)}`);
+      }
+      loginFirst("view or change these settings");
+    } else {
+      const f = pick2.f;
+      console.log(`
+  ${import_chalk26.default.bold(f.label)} \u2014 ${f.desc}`);
+      loginFirst(`use ${f.label.toLowerCase()}`);
+    }
+  }
+}
+async function navigator(proj2, cfg, opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  console.log(import_chalk26.default.bold(`
+${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
+`));
+  console.log(import_chalk26.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  let blob = cfg;
+  for (; ; ) {
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: "Where to?",
+      pageSize: 20,
+      choices: [
+        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Settings \u2014")),
+        ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
+        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk26.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer2.Separator(),
+        { name: "Show all settings", value: { kind: "list" } },
+        { name: "Exit", value: { kind: "exit" } }
+      ]
+    }]);
+    try {
+      switch (pick2.kind) {
+        case "exit":
+          return;
+        case "list":
+          printAll(proj2, blob);
+          break;
+        case "settings":
+          blob = await settingsGroup(proj2, blob, pick2.g);
+          break;
+        case "transforms":
+          await transformsMenu(proj2);
+          break;
+        case "mappings":
+          await mappingsMenu(proj2);
+          break;
+        case "tenants":
+          await tenantsMenu(proj2, opts);
+          break;
+        case "domains":
+          await domainsMenu(proj2, opts);
+          break;
+        case "spec":
+          await specMenu(proj2, opts);
+          break;
+        case "agents":
+          await agentsMenu(proj2, opts);
+          break;
+        case "danger": {
+          await runDelete(proj2.projectName, proj2.apiVersion, { team: opts.team });
+          return;
+        }
+      }
+    } catch (err) {
+      console.error(import_chalk26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+}
+async function settingsGroup(proj2, cfg, group) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const items = SETTINGS.filter((s2) => s2.group === group);
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: group + ":",
+      pageSize: 16,
+      choices: [
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk26.default.dim(s2.desc)}`, value: s2 })),
+        new inquirer2.Separator(),
+        { name: "\u2190 Back", value: null }
+      ]
+    }]);
+    if (!pick2) return cfg;
+    const s = pick2;
+    let value;
+    if (s.type === "boolean") {
+      const cur = readSetting(s, cfg);
+      const { v } = await inquirer2.prompt([{ type: "confirm", name: "v", message: `${s.label} on?`, default: cur !== false }]);
+      value = v;
+    } else if (s.type === "enum") {
+      const { v } = await inquirer2.prompt([{ type: "list", name: "v", message: s.label + ":", choices: s.enum, default: readSetting(s, cfg) }]);
+      value = v;
+    } else if (s.type === "number") {
+      const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
+      if (v === "" || Number.isNaN(Number(v))) {
+        console.log(import_chalk26.default.yellow("  Not a number \u2014 unchanged."));
+        continue;
+      }
+      value = Number(v);
+    } else if (s.type === "json") {
+      const cur = readSetting(s, cfg);
+      const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: `${s.label} (JSON, or "null" to clear):`, default: cur === void 0 ? "" : JSON.stringify(cur) }]);
+      if (v === "") continue;
+      value = parseValue(v);
+    } else {
+      const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: s.label + ":", default: readSetting(s, cfg) }]);
+      if (v === "") continue;
+      value = v;
+    }
+    await patchSetting(proj2, s, value, cfg);
+    cfg = await fetchConfigBlob(proj2);
+  }
+}
+async function transformsMenu(proj2) {
+  const { default: inquirer2 } = await import("inquirer");
+  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/transforms`;
+  for (; ; ) {
+    const out = await admin({ method: "GET", path: base, summary: "List transform rules" });
+    const rules = out?.rules ?? [];
+    console.log();
+    if (!rules.length) console.log(import_chalk26.default.dim("  No transform rules yet."));
+    for (const r of rules) {
+      const a = r.action ?? {};
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}`;
+      console.log(`  ${r.enabled ? import_chalk26.default.green("\u25CF") : import_chalk26.default.dim("\u25CB")} ${import_chalk26.default.bold(r.name)}  ${import_chalk26.default.dim(`[${r.phase ?? "request"}]`)}  ${what}`);
+    }
+    const { act } = await inquirer2.prompt([{
+      type: "list",
+      name: "act",
+      message: "Transforms:",
+      choices: [
+        { name: "Add a rule", value: "add" },
+        ...rules.length ? [
+          { name: "Enable/disable a rule", value: "toggle" },
+          { name: "Delete a rule", value: "delete" }
+        ] : [],
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    if (act === "back") return;
+    if (act === "add") {
+      const ans = await inquirer2.prompt([
+        { type: "input", name: "name", message: "Rule name:", validate: (s) => !!s || "required" },
+        { type: "list", name: "phase", message: "Phase:", choices: [
+          { name: "request \u2014 before forwarding upstream", value: "request" },
+          { name: "response \u2014 on the reply before it returns", value: "response" }
+        ] },
+        { type: "list", name: "kind", message: "Action:", choices: [
+          { name: "Set a value (header/param/body field)", value: "hardcode" },
+          { name: "Copy/map one field to another", value: "map" },
+          { name: "Remove a field", value: "remove" }
+        ] }
+      ]);
+      const fieldHint = import_chalk26.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      let action2;
+      if (ans.kind === "hardcode") {
+        const a = await inquirer2.prompt([
+          { type: "input", name: "destination", message: `Destination field ${fieldHint}:`, validate: (s) => !!s || "required" },
+          { type: "input", name: "value", message: "Value:" }
+        ]);
+        action2 = { type: "hardcode", destination: a.destination, value: a.value };
+      } else if (ans.kind === "remove") {
+        const a = await inquirer2.prompt([
+          { type: "input", name: "field", message: `Field to remove ${fieldHint}:`, validate: (s) => !!s || "required" }
+        ]);
+        action2 = { type: "remove", field: a.field };
+      } else {
+        const a = await inquirer2.prompt([
+          { type: "input", name: "source", message: `Source field ${fieldHint}:`, validate: (s) => !!s || "required" },
+          { type: "input", name: "destination", message: `Destination field ${fieldHint}:`, validate: (s) => !!s || "required" },
+          { type: "confirm", name: "strip", message: "Remove the source field after copying?", default: false }
+        ]);
+        action2 = { type: "copy", source: a.source, destination: a.destination, ...a.strip ? { strip_source: true } : {} };
+      }
+      const spinner = (0, import_ora11.default)("Creating rule...").start();
+      try {
+        await admin({ method: "POST", path: base, body: { name: ans.name, phase: ans.phase, enabled: true, action: action2 }, summary: `Create transform "${ans.name}"` });
+        spinner.succeed(`Rule "${ans.name}" created.`);
+      } catch (err) {
+        spinner.fail("Create failed.");
+        throw err;
+      }
+    } else {
+      const { rule } = await inquirer2.prompt([{
+        type: "list",
+        name: "rule",
+        message: act === "toggle" ? "Which rule?" : "Delete which rule?",
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk26.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+      }]);
+      if (!rule) continue;
+      if (act === "toggle") {
+        const flipped = { ...rule, enabled: rule.enabled === false };
+        await admin({ method: "PUT", path: `${base}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
+        console.log(import_chalk26.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+      } else {
+        await admin({ method: "DELETE", path: `${base}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
+        console.log(import_chalk26.default.green(`  ${rule.name} deleted.`));
+      }
+    }
+  }
+}
+async function mappingsMenu(proj2) {
+  const { default: inquirer2 } = await import("inquirer");
+  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/mappings`;
+  for (; ; ) {
+    const out = await admin({ method: "GET", path: base, summary: "List mapping tables" });
+    const tables = out?.mappings ?? out?.tables ?? [];
+    console.log();
+    if (!tables.length) console.log(import_chalk26.default.dim("  No mapping tables yet."));
+    for (const t of tables) {
+      console.log(`  ${import_chalk26.default.bold(t.name)}  ${import_chalk26.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+    }
+    const { act } = await inquirer2.prompt([{
+      type: "list",
+      name: "act",
+      message: "Mapping tables:",
+      choices: [
+        { name: "Create a table", value: "add" },
+        ...tables.length ? [{ name: "Delete a table", value: "delete" }] : [],
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    if (act === "back") return;
+    if (act === "add") {
+      const a = await inquirer2.prompt([
+        { type: "input", name: "name", message: "Table name:", validate: (s) => !!s || "required" },
+        { type: "input", name: "entries", message: 'Entries as JSON, e.g. [{"from":"a","to":"b"}]:', default: "[]" }
+      ]);
+      const entries2 = parseValue(a.entries);
+      if (!Array.isArray(entries2)) {
+        console.log(import_chalk26.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        continue;
+      }
+      await admin({ method: "POST", path: base, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
+      console.log(import_chalk26.default.green(`  Table "${a.name}" created.`));
+    } else {
+      const { table } = await inquirer2.prompt([{
+        type: "list",
+        name: "table",
+        message: "Delete which table?",
+        choices: [...tables.map((t) => ({ name: t.name, value: t })), { name: "\u2190 Back", value: null }]
+      }]);
+      if (!table) continue;
+      await admin({ method: "DELETE", path: `${base}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
+      console.log(import_chalk26.default.green(`  ${table.name} deleted.`));
+    }
+  }
+}
+async function tenantsMenu(proj2, opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`;
+  for (; ; ) {
+    const out = await admin({ method: "GET", path: base, summary: "List attached tenants" });
+    const tenants = out?.tenants ?? [];
+    console.log();
+    if (!tenants.length) console.log(import_chalk26.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk26.default.bold(t.tenant_name ?? t.name)}  ${import_chalk26.default.dim(t.display_name ?? "")}`);
+    const { act } = await inquirer2.prompt([{
+      type: "list",
+      name: "act",
+      message: "Tenants:",
+      choices: [
+        { name: "Attach a tenant", value: "attach" },
+        ...tenants.length ? [{ name: "Detach a tenant", value: "detach" }] : [],
+        { name: import_chalk26.default.dim("Manage team tenants (create/CORS/login) \u2192 `apiblaze tenant --help`"), value: "hint" },
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    if (act === "back") return;
+    if (act === "hint") {
+      console.log(import_chalk26.default.dim("\n  apiblaze tenant list | create | attach | cors | delete\n"));
+      continue;
+    }
+    if (act === "attach") {
+      const { slug } = await inquirer2.prompt([{ type: "input", name: "slug", message: "Tenant slug to attach:", validate: (s) => !!s || "required" }]);
+      await runTenantAttach(proj2.projectName, { tenant: slug, team: opts.team, apiversion: proj2.apiVersion });
+    } else {
+      const { t } = await inquirer2.prompt([{
+        type: "list",
+        name: "t",
+        message: "Detach which tenant?",
+        choices: [...tenants.map((x) => ({ name: x.tenant_name ?? x.name, value: x })), { name: "\u2190 Back", value: null }]
+      }]);
+      if (!t) continue;
+      await admin({ method: "DELETE", path: `${base}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
+      console.log(import_chalk26.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+    }
+  }
+}
+async function domainsMenu(proj2, opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const { act } = await inquirer2.prompt([{
+      type: "list",
+      name: "act",
+      message: "Custom domains:",
+      choices: [
+        { name: "List domains", value: "list" },
+        { name: "Add a domain (shows the DNS records to set)", value: "add" },
+        { name: "Remove a domain", value: "remove" },
+        { name: "Set what the bare URL serves (base domain)", value: "base" },
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    const common = { team: opts.team, apiversion: proj2.apiVersion };
+    if (act === "back") return;
+    if (act === "list") await runDomainList(proj2.projectName, common);
+    else if (act === "add") {
+      const { host } = await inquirer2.prompt([{ type: "input", name: "host", message: "Hostname (e.g. api.example.com):", validate: (s) => !!s || "required" }]);
+      await runDomainAdd(proj2.projectName, { ...common, domain: host });
+    } else if (act === "remove") {
+      const { id } = await inquirer2.prompt([{ type: "input", name: "id", message: "Domain id (see List):", validate: (s) => !!s || "required" }]);
+      await runDomainRemove(proj2.projectName, { ...common, id });
+    } else {
+      const { env } = await inquirer2.prompt([{ type: "input", name: "env", message: "Environment (e.g. prod):", default: "prod" }]);
+      await runDomainSetBase(proj2.projectName, { ...common, env });
+    }
+  }
+}
+async function specMenu(proj2, opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  const { act } = await inquirer2.prompt([{
+    type: "list",
+    name: "act",
+    message: "OpenAPI spec & traffic:",
+    choices: [
+      { name: "Print the stored spec", value: "get" },
+      { name: "Refresh the spec from its source", value: "refresh" },
+      { name: import_chalk26.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: "\u2190 Back", value: "back" }
+    ]
+  }]);
+  if (act === "back") return;
+  if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
+  else if (act === "refresh") {
+    await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
+    console.log(import_chalk26.default.green("  Spec refresh triggered."));
+  } else await runOpenapi(proj2.projectName, proj2.apiVersion);
+}
+async function agentsMenu(proj2, opts) {
+  const { default: inquirer2 } = await import("inquirer");
+  const { act } = await inquirer2.prompt([{
+    type: "list",
+    name: "act",
+    message: "AI agents (billed per turn):",
+    choices: [
+      { name: "General chat \u2014 build and run your APIs", value: "agent" },
+      { name: "OpenAPI builder \u2014 build your spec from real traffic", value: "openapi" },
+      { name: "Authorization designer \u2014 draft access rules", value: "authz" },
+      { name: "MCP builder \u2014 publish this API as an MCP server", value: "mcp" },
+      { name: "\u2190 Back", value: "back" }
+    ]
+  }]);
+  if (act === "back") return;
+  if (act === "agent") await runAgent({ team: opts.team });
+  else if (act === "openapi") await runOpenapi(proj2.projectName, proj2.apiVersion);
+  else if (act === "authz") await runAuthz(proj2.projectName, proj2.apiVersion);
+  else await runMcp(proj2.projectName, proj2.apiVersion, {});
+}
+
+// src/commands/key.ts
 var import_chalk27 = __toESM(require("chalk"));
 var import_ora12 = __toESM(require("ora"));
+async function runApikeysMenu(opts) {
+  await runKeyList(opts);
+  if (opts.json) return;
+  const { default: inquirer2 } = await import("inquirer");
+  const { make } = await inquirer2.prompt([
+    { type: "confirm", name: "make", message: "Generate a new control-plane API key?", default: false }
+  ]);
+  if (!make) return;
+  const { desc } = await inquirer2.prompt([
+    { type: "input", name: "desc", message: "Description (optional):" }
+  ]);
+  await runKeyMint({ ...opts, desc: desc || void 0 });
+}
+async function runKeyList(opts) {
+  const { teamId, teamName } = await resolveTeam(opts.team);
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
+    summary: `List developer keys for team ${teamName ?? teamId}`
+  });
+  const keys = out?.keys ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify(keys));
+    return;
+  }
+  if (!keys.length) {
+    console.log(import_chalk27.default.yellow("No developer keys."));
+    return;
+  }
+  for (const k of keys) {
+    console.log(`  ${import_chalk27.default.bold(k.key_id ?? k.id)}  ${import_chalk27.default.dim(k.description ?? "")}  ${import_chalk27.default.dim(k.expires_at ?? "no expiry")}`);
+  }
+}
+async function runKeyMint(opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const body = { role: "consumer-admin" };
+  if (opts.desc) body.description = opts.desc;
+  if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
+  const spinner = (0, import_ora12.default)("Minting key...").start();
+  try {
+    const out = await admin({
+      method: "POST",
+      path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
+      body,
+      summary: `Mint a consumer-admin developer key`
+    });
+    spinner.succeed("Key minted.");
+    if (opts.json) {
+      console.log(JSON.stringify(out));
+      return;
+    }
+    console.log(`  ${import_chalk27.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk27.default.bold("key")}:     ${import_chalk27.default.green(out?.key)}  ${import_chalk27.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk27.default.dim("expires:")} ${out.expires_at}`);
+  } catch (err) {
+    spinner.fail("Mint failed.");
+    throw err;
+  }
+}
+async function runKeyRevoke(keyId, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const spinner = (0, import_ora12.default)("Revoking key...").start();
+  try {
+    await admin({
+      method: "DELETE",
+      path: `/teams/${encodeURIComponent(teamId)}/developer-keys/${encodeURIComponent(keyId)}`,
+      summary: `Revoke developer key ${keyId}`
+    });
+    spinner.succeed(`Revoked ${keyId}.`);
+  } catch (err) {
+    spinner.fail("Revoke failed.");
+    throw err;
+  }
+}
+
+// src/commands/consumer.ts
+var import_chalk28 = __toESM(require("chalk"));
+var import_ora13 = __toESM(require("ora"));
 var DEFAULT_SCOPE = "openid email profile offline_access";
 var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
@@ -3090,7 +3764,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk27.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk28.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -3101,20 +3775,20 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk27.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk28.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
     requireAuth();
     const { teamId, teamName } = await resolveTeam(opts.team);
-    const spinner = (0, import_ora12.default)("Loading your tenants...").start();
+    const spinner = (0, import_ora13.default)("Loading your tenants...").start();
     const tdata = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1`, summary: `List tenants for ${teamName ?? teamId}` });
     spinner.stop();
     const tenants = (tdata?.tenants ?? []).map(
       (t) => typeof t === "string" ? { tenant_name: t } : t
     );
     if (!tenants.length) {
-      console.error(import_chalk27.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk28.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       process.exit(1);
     }
     if (!tenant2) {
@@ -3124,25 +3798,25 @@ async function runConsumerLogin(opts) {
         tenant2 = chosen;
       }
     }
-    const s2 = (0, import_ora12.default)("Finding the login app...").start();
+    const s2 = (0, import_ora13.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk27.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk28.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk27.default.cyan("\u2192")} Logging in to ${import_chalk27.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk28.default.cyan("\u2192")} Logging in to ${import_chalk28.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk27.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk27.default.bold(userCode)}
+  Open: ${import_chalk28.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk28.default.bold(userCode)}
 `);
-    console.log(import_chalk27.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk28.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -3157,7 +3831,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk27.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk28.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -3170,29 +3844,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk27.default.cyan("Consumer")} ${import_chalk27.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk27.default.bold(fresh.tenant)}
+  console.log(`${import_chalk28.default.cyan("Consumer")} ${import_chalk28.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk28.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk27.default.bold("access_token")}  ${import_chalk27.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk28.default.bold("access_token")}  ${import_chalk28.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk27.default.bold("id_token")}      ${import_chalk27.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk28.default.bold("id_token")}      ${import_chalk28.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk27.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk28.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk27.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk28.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
   const { default: inquirer2 } = await import("inquirer");
-  const spinner = (0, import_ora12.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora13.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk27.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk27.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk28.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk28.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -3200,16 +3874,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk27.default.yellow("No API keys yet."));
+    console.log(import_chalk28.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk27.default.green(clear) : import_chalk27.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk27.default.dim(`exp ${k.expires_at}`) : import_chalk27.default.dim("no expiry");
-      console.log(`  ${import_chalk27.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk27.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk28.default.green(clear) : import_chalk28.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk28.default.dim(`exp ${k.expires_at}`) : import_chalk28.default.dim("no expiry");
+      console.log(`  ${import_chalk28.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk28.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk27.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk28.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -3223,7 +3897,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora12.default)("Creating key...").start();
+  const s2 = (0, import_ora13.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -3231,13 +3905,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk27.default.green(key)}  ${import_chalk27.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk27.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk28.default.green(key)}  ${import_chalk28.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk28.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk28 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_chalk29 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
 var fs7 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
 init_auth();
@@ -3277,18 +3951,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs7.existsSync(path4.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk28.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk29.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs7.existsSync(path4.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora13.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora14.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk28.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk28.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk29.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk29.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -3343,18 +4017,24 @@ export const dynamic = "force-dynamic";
 async function probe(u: string) {
   try {
     const res = await fetch(u, { headers: { "x-api-key": "demo-secret-value" }, cache: "no-store" });
-    return { url: u, status: res.status, echo: await res.json().catch(() => ({})) };
+    const echo = await res.json().catch(() => ({}));
+    // A routed call returns THROUGH APIblaze (Cloudflare) \u2192 cf-ray / server:cloudflare.
+    // A direct call to httpbingo (fly.io) has neither. This is the reliable signal.
+    const server = (res.headers.get("server") || "").toLowerCase();
+    const routed = Boolean(res.headers.get("cf-ray")) || server.indexOf("cloudflare") >= 0;
+    return { url: u, status: res.status, routed, echo };
   } catch (e: any) { return { url: u, error: e?.message ?? String(e) }; }
 }
 
 export default async function Page() {
   if (process.env.NODE_ENV === "production") return <main style={{ padding: 24 }}>Inspector disabled in production.</main>;
   const r: any = await probe("https://httpbingo.org/headers");
-  const hdrs = (r && r.echo && r.echo.headers) || {};
-  // The sidecar sets X-Abz-Fwd-X-Api-Key ONLY when it routes a call through a proxy.
-  const routed = Boolean(hdrs["X-Abz-Fwd-X-Api-Key"] || hdrs["x-abz-fwd-x-api-key"]);
+  const routed = Boolean(r && r.routed);
+  // An anonymous trial proxy routes, but completing the upstream call needs credits.
+  const needsCredits = Boolean(r && r.echo && r.echo.claim_required);
   const card: any = { background: "#0b0f17", border: "1px solid #232a36", borderRadius: 14, padding: 20 };
   const pill: any = { display: "inline-block", padding: "4px 10px", borderRadius: 999, fontSize: 12, fontWeight: 700 };
+  const codeBox: any = { background: "#070a10", border: "1px solid #232a36", borderRadius: 8, padding: 12, margin: 0, color: "#8ab4ff", overflowX: "auto" };
   return (
     <main style={{ fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace", background: "#070a10", minHeight: "100vh", padding: 32, color: "#e6e9ef", lineHeight: 1.6 }}>
       <div style={{ maxWidth: 720, margin: "0 auto" }}>
@@ -3369,16 +4049,23 @@ export default async function Page() {
               ? <span style={{ ...pill, background: "#0f2e20", color: "#4ade80" }}>\u25CF routed through APIblaze</span>
               : <span style={{ ...pill, background: "#33280c", color: "#fbbf24" }}>\u25CB going direct \u2014 not approved</span>}
           </div>
-          {routed ? (
+          {routed && needsCredits ? (
+            <div style={{ color: "#9aa4b2", fontSize: 14 }}>
+              <p style={{ margin: "0 0 10px" }}>Your call <b style={{ color: "#4ade80" }}>routed through APIblaze</b> \u2014 auth, rate limits, and observability, with no code change. It reached your proxy (not httpbingo directly).</p>
+              <p style={{ margin: "0 0 6px", color: "#e6e9ef" }}>This is an anonymous trial proxy, so completing the upstream call needs credits. Keep it and add credits by claiming your workspace:</p>
+              <pre style={codeBox}>apiblaze login  &&  apiblaze claim</pre>
+              <p style={{ margin: "10px 0 0" }}>\u2026then reload \u2014 the call completes end to end.</p>
+            </div>
+          ) : routed ? (
             <p style={{ color: "#9aa4b2", fontSize: 14, margin: 0 }}>
-              This request <b style={{ color: "#4ade80" }}>routed through your APIblaze proxy</b> \u2014 with auth, rate limits, and observability \u2014 and your app code never changed. The proxy swapped in your invoke key and preserved your original one (see <code>X-Abz-Fwd-X-Api-Key</code> in the raw response).
+              Your call <b style={{ color: "#4ade80" }}>routed through APIblaze</b> \u2014 auth, rate limits, and observability \u2014 and your app code never changed. The proxy carried your original <code>x-api-key</code> upstream so httpbingo still sees it.
             </p>
           ) : (
             <div style={{ color: "#9aa4b2", fontSize: 14 }}>
               <p style={{ margin: "0 0 10px" }}>This call went <b style={{ color: "#fbbf24" }}>direct</b> \u2014 httpbingo.org isn&apos;t approved yet, so the sidecar left it untouched and reported it as a candidate.</p>
               <p style={{ margin: "0 0 6px", color: "#e6e9ef" }}>Route it through APIblaze:</p>
-              <pre style={{ background: "#070a10", border: "1px solid #232a36", borderRadius: 8, padding: 12, margin: 0, color: "#8ab4ff", overflowX: "auto" }}>npx apiblaze sidecar approve httpbingo.org</pre>
-              <p style={{ margin: "10px 0 0" }}>\u2026wait ~5 min, then <b style={{ color: "#e6e9ef" }}>reload</b>. The badge above turns green.</p>
+              <pre style={codeBox}>npx apiblaze sidecar approve httpbingo.org</pre>
+              <p style={{ margin: "10px 0 0" }}>\u2026wait ~5 min (or restart the dev server), then <b style={{ color: "#e6e9ef" }}>reload</b>. The badge above turns green.</p>
             </div>
           )}
         </div>
@@ -3414,7 +4101,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora13.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora14.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -3426,29 +4113,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk29.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk29.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk28.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk28.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk29.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk29.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk28.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk29.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk28.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk28.default.cyan("apiblaze login")}  then  ${import_chalk28.default.cyan("apiblaze claim")}   ${import_chalk28.default.dim("(no code needed here)")}`);
-  console.log(import_chalk28.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk29.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk29.default.cyan("apiblaze login")}  then  ${import_chalk29.default.cyan("apiblaze claim")}   ${import_chalk29.default.dim("(no code needed here)")}`);
+  console.log(import_chalk29.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path4.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk28.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk29.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -3459,10 +4146,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk28.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk29.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk28.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk29.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -3471,7 +4158,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora13.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora14.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -3485,39 +4172,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk28.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk29.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk29.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk28.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk28.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk29.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk28.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk28.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk28.default.bold("candidates")} \u2014 list them:  ${import_chalk28.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk28.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk29.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk29.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk29.default.bold("candidates")} \u2014 list them:  ${import_chalk29.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk29.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk28.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk28.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk29.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk29.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk28.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk28.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk28.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk29.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk29.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk29.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk28.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk28.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk29.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk29.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk29 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_chalk30 = __toESM(require("chalk"));
+var import_ora15 = __toESM(require("ora"));
 init_auth();
 init_anon_cred();
 async function runOriginsList(opts) {
@@ -3525,7 +4212,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk29.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk30.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -3543,30 +4230,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk29.default.bold(`
+  console.log(import_chalk30.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk29.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk29.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk29.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk29.default.bold(`
+  if (!routed.length) console.log(import_chalk30.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk30.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk30.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk30.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk29.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk30.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk29.default.yellow("\u25CB")} ${c.origin}  ${import_chalk29.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk30.default.yellow("\u25CB")} ${c.origin}  ${import_chalk30.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk29.default.dim(`
+    console.log(import_chalk30.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk29.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk30.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk29.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk30.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora14.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora15.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -3577,7 +4264,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora14.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora15.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -3594,7 +4281,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora14.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora15.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -3605,7 +4292,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora14.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora15.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -3615,6 +4302,131 @@ async function runOriginsRemove(origin, opts) {
   }
 }
 
+// src/commands/op.ts
+var import_chalk31 = __toESM(require("chalk"));
+init_auth();
+init_types();
+var OPERATOR_EMAILS = /* @__PURE__ */ new Set(["julienpmjacquet@gmail.com", "chkev@umich.edu"]);
+var DASHBOARD_BASE6 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+function isOperatorLogin() {
+  const email = loadCredentials()?.email?.toLowerCase();
+  return !!email && OPERATOR_EMAILS.has(email);
+}
+async function opCall(call) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE6}/api/cli/op`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
+  if (!res.ok) {
+    const msg = data?.details ?? data?.error ?? res.statusText;
+    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
+  }
+  return data;
+}
+function printResidue(report, applied) {
+  const up = report?.upstash ?? {};
+  const fga = report?.fga ?? {};
+  console.log(import_chalk31.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk31.default.bold("\n  Upstash"));
+  const orphans = up.orphans ?? [];
+  if (orphans.length === 0) console.log(import_chalk31.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk31.default.yellow(o.key)} ${import_chalk31.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk31.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (up.unknown?.length) console.log(import_chalk31.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk31.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk31.default.red(`    error: ${e}`));
+  console.log(import_chalk31.default.bold("\n  OpenFGA / Neon"));
+  if (applied) {
+    const swept = fga?.swept ?? [];
+    if (swept.length === 0) console.log(import_chalk31.default.green("    no orphaned stores"));
+    for (const s of swept) {
+      console.log(
+        `    ${import_chalk31.default.yellow(s.store_id)} ${import_chalk31.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+      );
+    }
+    if (fga?.remaining) console.log(import_chalk31.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+  } else {
+    const fgaOrphans = fga?.orphans ?? [];
+    if (fgaOrphans.length === 0) console.log(import_chalk31.default.green("    no orphaned stores"));
+    for (const s of fgaOrphans) {
+      const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
+      console.log(`    ${import_chalk31.default.yellow(s.store_id)} ${import_chalk31.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+    }
+    console.log(import_chalk31.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+  }
+  for (const e of fga?.errors ?? []) console.log(import_chalk31.default.red(`    error: ${e}`));
+  console.log();
+}
+async function runOp(sub, opts = {}) {
+  if (!loadCredentials()) {
+    console.log(import_chalk31.default.dim("Not logged in. Run `apiblaze login`."));
+    return;
+  }
+  if (!isOperatorLogin()) {
+    console.log(import_chalk31.default.dim("`apiblaze op` is only available to platform operators."));
+    return;
+  }
+  switch (sub) {
+    case void 0:
+    case "menu": {
+      console.log(import_chalk31.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk31.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk31.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk31.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk31.default.cyan("apiblaze op credits")}        list credit wallets
+`);
+      return;
+    }
+    case "residue": {
+      const report = await opCall({ method: "GET", path: "/operator/external-residue", summary: "external residue report" });
+      if (opts.json) return void console.log(JSON.stringify(report, null, 2));
+      printResidue(report, false);
+      return;
+    }
+    case "sweep": {
+      const report = await opCall({ method: "GET", path: "/operator/external-residue", summary: "external residue report" });
+      const nUp = report?.upstash?.orphans?.length ?? 0;
+      const nFga = report?.fga?.orphans?.length ?? 0;
+      printResidue(report, false);
+      if (nUp + nFga === 0) {
+        console.log(import_chalk31.default.green("Nothing to sweep."));
+        return;
+      }
+      if (!opts.yes) {
+        const readline2 = await import("readline/promises");
+        const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await rl.question(import_chalk31.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s)? Type 'sweep' to confirm: `));
+        rl.close();
+        if (answer.trim() !== "sweep") return void console.log(import_chalk31.default.dim("Aborted."));
+      }
+      const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
+      if (opts.json) return void console.log(JSON.stringify(result, null, 2));
+      printResidue(result, true);
+      return;
+    }
+    case "credits": {
+      const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
+      if (opts.json) return void console.log(JSON.stringify(data, null, 2));
+      const accounts = data?.accounts ?? [];
+      if (accounts.length === 0) return void console.log(import_chalk31.default.dim("No credit wallets."));
+      for (const a of accounts) {
+        const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
+        console.log(`  ${import_chalk31.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk31.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk31.default.dim(" \u2014 anon") : ""}`);
+      }
+      return;
+    }
+    default:
+      console.log(import_chalk31.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+  }
+}
+
 // src/index.ts
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
@@ -3654,16 +4466,19 @@ var agent = program.command("agent").description("Chat with an assistant that bu
 agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("init").aliases(["sidecar"]).description("Wire a Next.js app to route its external fetches through APIblaze (one command)").option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("--rotate", "Mint a fresh invoke key even if one already exists").option("--new-session", "Start a fresh anonymous session (logged-out only)").option("-y, --yes", "Skip prompts").action(action((opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false, rotate: opts.rotate, newSession: opts.newSession })));
-var origins = program.command("sidecar").alias("origins").description("See which external origins your app calls; approve the ones to route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
-origins.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
-origins.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
-origins.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
+var runSetup = (opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.yes, noInspector: opts.inspector === false, rotate: opts.rotate, newSession: opts.newSession });
+var withSetupOptions = (cmd) => cmd.option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("--rotate", "Mint a fresh invoke key even if one already exists").option("--new-session", "Start a fresh anonymous session (logged-out only)").option("-y, --yes", "Skip prompts");
+withSetupOptions(program.command("init").description("Set up the APIblaze sidecar in a Next.js app (shortcut for `apiblaze sidecar setup`)")).action(action((opts) => runSetup(opts)));
+var sidecar = program.command("sidecar").description("The APIblaze sidecar \u2014 set it up, then approve which origins route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
+withSetupOptions(sidecar.command("setup").description("Wire a Next.js app to route its external fetches through APIblaze")).action(action((opts) => runSetup(opts)));
+sidecar.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
+sidecar.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
+sidecar.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
 program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk30.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk32.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -3711,6 +4526,7 @@ program.command("projects").description("List the projects in your team").action
 });
 program.command("delete").description("Delete a proxy and everything under it (asks first)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--team <id|name>", "Team the project is in (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON").action(action((project, version2, opts) => runDelete(project, version2, opts)));
 program.command("export").description("Export config and data for migration out of APIblaze (Kong, ...)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--kong", "Produce a runnable Kong OSS bundle (decK config + plugins + docker-compose)").option("--data", "Plain data export (default)").option("--secrets", "Include decrypted producer-supplied secrets (member role; audit-logged)").option("--keys <mode>", "API-key export: hashes (default, consumers keep keys) | mint | none").option("--no-consumers", "Skip the end-user lane (users, groups, keys)").option("-o, --out <file>", "Output zip path").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, opts) => runExport(project, version2, { ...opts, noConsumers: opts.consumers === false })));
+program.command("config").description("Browse and change every proxy setting & feature (interactive; git-config-style get/set)").argument("[project]", "Project name or id (omit to pick interactively)").argument("[key]", "Setting key, e.g. throttling.proxyQuota (omit for the menu)").argument("[value]", "New value (omit to read the current value)").option("--list", "Print every setting and its current value").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Machine-readable output (with --list or a key read)").action(action((project, key, value, opts) => runConfig(project, key, value, opts)));
 program.command("target").description("Change where a proxy forwards requests").argument("<project>", "Project name or id").requiredOption("--url <url>", "Target URL to forward to").option("--env <env>", "Environment to scope the target to (e.g. prod, dev)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTargetSet(project, opts)));
 program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
 program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
@@ -3731,13 +4547,15 @@ apikeys.command("list").description("List control-plane API keys in your team").
 apikeys.command("mint").description("Create a control-plane API key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
 apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts) => runKeyRevoke(keyId, opts)));
 program.addCommand(apikeys, { hidden: true });
+var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "residue | sweep | credits (omit for the menu)").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").action(action((sub, opts) => runOp(sub, opts)));
+program.addCommand(op, { hidden: true });
 var spec = program.command("spec").description("View or update a proxy's OpenAPI spec (or build one by chatting: apiblaze agent openapi)");
 spec.command("get").description("Print the current OpenAPI document").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Compact JSON output").action(action((project, opts) => runSpecGet(project, opts)));
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
 var HELP_GROUPS = [
   { title: "Chat", commands: ["agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
-  { title: "Control plane commands", commands: ["projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" }
@@ -3756,7 +4574,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk30.default.bold(g.title)}
+    return `${import_chalk32.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -3770,7 +4588,9 @@ program.addHelpText("after", () => `
 ${groupedCommandHelp()}
 
 Tips:
+  \u2022 \`apiblaze config <project>\` browses EVERY setting & feature (works logged-out to explore).
   \u2022 Add --verbose to any command to see the equivalent API calls.
+  \u2022 Full API reference: https://api.apiblaze.com/openapi.json
   \u2022 Run \`apiblaze <command> --help\` (e.g. \`apiblaze consumer --help\`) for sub-commands.
 
 Examples:
@@ -3782,13 +4602,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk30.default.red(`
+    console.error(import_chalk32.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk30.default.red(`
+    console.error(import_chalk32.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk30.default.red("\nUnknown error"));
+    console.error(import_chalk32.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);