apiblaze 0.12.1 → 0.15.0

package/dist/index.js

@@ -51,6 +51,14 @@ var init_types = __esm({
 });
 
 // src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearCredentials: () => clearCredentials,
+  getAccessToken: () => getAccessToken,
+  getApiblazeDir: () => getApiblazeDir,
+  loadCredentials: () => loadCredentials,
+  saveCredentials: () => saveCredentials
+});
 function saveCredentials(creds) {
   fs.mkdirSync(APIBLAZE_DIR, { recursive: true });
   fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), "utf-8");
@@ -82,6 +90,9 @@ function getAccessToken() {
   }
   return creds.accessToken;
 }
+function getApiblazeDir() {
+  return APIBLAZE_DIR;
+}
 var fs, os, path, APIBLAZE_DIR, CREDENTIALS_PATH;
 var init_auth = __esm({
   "src/lib/auth.ts"() {
@@ -232,6 +243,65 @@ var init_api = __esm({
   }
 });
 
+// src/lib/team.ts
+var team_exports = {};
+__export(team_exports, {
+  resolveLinkedTeam: () => resolveLinkedTeam
+});
+async function resolveLinkedTeam(opts) {
+  let teams;
+  try {
+    teams = await getTeams();
+  } catch {
+    return opts.preferredId ? { teamId: opts.preferredId } : null;
+  }
+  if (teams.length === 0) return null;
+  const preferred = opts.preferredId ? teams.find((t) => t.teamId === opts.preferredId) : void 0;
+  if (preferred && !(opts.promptWhenMultiple && opts.interactive && teams.length > 1)) {
+    return { teamId: preferred.teamId, teamName: preferred.name };
+  }
+  if (preferred) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { chosen: chosen2 } = await inquirer3.prompt([{
+      type: "list",
+      name: "chosen",
+      message: "Which team do you want to work in?",
+      default: preferred.teamId,
+      choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
+    }]);
+    const picked2 = teams.find((t) => t.teamId === chosen2);
+    return { teamId: picked2.teamId, teamName: picked2.name };
+  }
+  if (opts.preferredId) {
+    console.log(import_chalk.default.yellow("\nYour previously linked team is no longer available."));
+  }
+  if (teams.length === 1) {
+    console.log(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);
+    return { teamId: teams[0].teamId, teamName: teams[0].name };
+  }
+  if (!opts.interactive) {
+    console.log(import_chalk.default.yellow(`Linking to "${teams[0].name}" \u2014 pass --team to choose another.`));
+    return { teamId: teams[0].teamId, teamName: teams[0].name };
+  }
+  const { default: inquirer2 } = await import("inquirer");
+  const { chosen } = await inquirer2.prompt([{
+    type: "list",
+    name: "chosen",
+    message: "Which team do you want to link to?",
+    choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
+  }]);
+  const picked = teams.find((t) => t.teamId === chosen);
+  return { teamId: picked.teamId, teamName: picked.name };
+}
+var import_chalk;
+var init_team = __esm({
+  "src/lib/team.ts"() {
+    "use strict";
+    import_chalk = __toESM(require("chalk"));
+    init_api();
+  }
+});
+
 // src/lib/anon-cred.ts
 var anon_cred_exports = {};
 __export(anon_cred_exports, {
@@ -300,180 +370,545 @@ var init_anon_cred = __esm({
   }
 });
 
-// src/lib/trace.ts
-function setVerbose(v) {
-  verbose = v;
-}
-function recordCall(e) {
-  if (verbose) entries.push(e);
-}
-function maskBody(body) {
-  if (body === void 0) return void 0;
-  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
-}
-function renderTrace() {
-  if (!verbose || entries.length === 0) return;
-  console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
-  console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
-  console.log(
-    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
-  );
-  entries.forEach((e, i) => {
-    const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
-    if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
-    const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
-    const masked = maskBody(e.body);
-    const hasBody = e.method !== "GET" && masked !== void 0;
-    console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
-    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
-    if (hasBody) {
-      console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
-      console.log(import_chalk15.default.green(`    -d '${masked}'`));
-    }
-    if (i < entries.length - 1) console.log();
-  });
-  entries.length = 0;
-}
-var import_chalk15, CONTROL_API_VERSION, verbose, entries, SECRET_KEY;
-var init_trace = __esm({
-  "src/lib/trace.ts"() {
-    "use strict";
-    import_chalk15 = __toESM(require("chalk"));
-    CONTROL_API_VERSION = "1.0.0";
-    verbose = false;
-    entries = [];
-    SECRET_KEY = /secret|token|password|api[_-]?key|client_secret/i;
-  }
+// src/commands/create.ts
+var create_exports = {};
+__export(create_exports, {
+  buildTryItCurl: () => buildTryItCurl,
+  runCreate: () => runCreate
 });
-
-// src/lib/admin.ts
-async function admin(call) {
-  const token = getAccessToken();
-  const res = await fetch(`${DASHBOARD_BASE3}/api/cli/admin`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
-  });
-  let data = null;
+function normalizeName(raw) {
+  return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isHttpUrl(s) {
   try {
-    data = await res.json();
+    const u = new URL((s || "").trim());
+    return u.protocol === "http:" || u.protocol === "https:";
   } catch {
+    return false;
   }
-  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
-  maybePrintBilling(data);
-  if (!res.ok) {
-    const msg = data?.details ?? data?.error ?? res.statusText;
-    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
-  }
-  return data;
 }
-function maybePrintBilling(data) {
-  const b = data?.billing;
-  if (b && typeof b.charged_cents === "number") {
-    const usd = (b.charged_cents / 100).toFixed(2);
-    const rem = typeof b.credits_remaining === "number" ? ` \xB7 $${(b.credits_remaining / 100).toFixed(2)} credit left` : "";
-    console.log(import_chalk16.default.magenta(`  \u{1F4B3} Charged $${usd}${rem}`));
+function stripTenantFromPortal(devPortal) {
+  try {
+    const u = new URL(devPortal);
+    const dot = u.hostname.indexOf(".");
+    if (dot < 0) return devPortal;
+    const product = u.hostname.slice(0, dot).split("-")[0];
+    u.hostname = `${product}${u.hostname.slice(dot)}`;
+    return u.toString();
+  } catch {
+    return devPortal;
   }
 }
-var import_chalk16, DASHBOARD_BASE3;
-var init_admin = __esm({
-  "src/lib/admin.ts"() {
-    "use strict";
-    import_chalk16 = __toESM(require("chalk"));
-    init_auth();
-    init_trace();
-    init_types();
-    DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+function fail(message) {
+  console.error(import_chalk6.default.red(`Error: ${message}`));
+  process.exit(1);
+}
+function buildTryItCurl(url, authType, apiKey) {
+  if (authType === "api_key") {
+    if (!apiKey) return null;
+    return `curl ${url} -H "X-API-Key: ${apiKey}"`;
   }
-});
-
-// src/lib/tenant-pick.ts
-var tenant_pick_exports = {};
-__export(tenant_pick_exports, {
-  pickTenant: () => pickTenant
-});
-async function fetchPage(teamId, q) {
-  const out = await admin({
-    method: "GET",
-    path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1&limit=${PAGE}${q ? `&q=${encodeURIComponent(q)}` : ""}`,
-    summary: q ? `Search tenants matching "${q}"` : "List tenants (first page)"
-  });
-  const rows = (out?.tenants ?? []).map(
-    (t) => typeof t === "string" ? { tenant_name: t } : t
-  );
-  return { rows, total: out?.total ?? rows.length, defaultTenant: out?.default_tenant ?? null };
+  if (authType === "none") return `curl ${url}`;
+  return null;
 }
-function label(t, defaultTenant, active) {
-  const tags = [
-    t.tenant_name === active ? import_chalk22.default.cyan("active scope") : "",
-    t.tenant_name === defaultTenant ? import_chalk22.default.dim("team default") : ""
-  ].filter(Boolean).join(", ");
-  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk22.default.dim(`  ${t.display_name}`) : "";
-  return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
+function printCurlExample(url, authType, apiKey, devPortal) {
+  const curl = buildTryItCurl(url, authType, apiKey);
+  console.log();
+  if (curl) {
+    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
+    console.log(`    ${import_chalk6.default.cyan(curl)}`);
+  } else if (authType === "oauth") {
+    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
+    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
+  }
 }
-async function pickTenant(teamId, opts = {}) {
-  const { default: inquirer2 } = await import("inquirer");
-  const active = loadCredentials()?.activeTenant;
-  let q = opts.initialQuery ?? "";
-  for (; ; ) {
-    const spinner = (0, import_ora8.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
-    const page = await fetchPage(teamId, q).finally(() => spinner.stop());
-    if (!page.total && !q) {
-      if (opts.allowCreate) {
-        const { make } = await inquirer2.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
-        if (make) return await createTenantInline(teamId);
+async function runCreate(opts = {}) {
+  const creds = loadCredentials();
+  if (!creds) {
+    await runAnonymousCreate(opts);
+    return;
+  }
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  const auth = (opts.auth ?? "api_key").toLowerCase();
+  if (!VALID_AUTH.includes(auth)) {
+    fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
+  }
+  let teamId = creds.teamId;
+  if (opts.team) {
+    if (opts.team.startsWith("team_")) {
+      teamId = opts.team;
+    } else {
+      const teams = await getTeams().catch(() => []);
+      const match = teams.find(
+        (t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase()
+      );
+      if (!match) {
+        fail(`Team "${opts.team}" not found. Run \`apiblaze team\` to see your teams.`);
       }
-      console.error(import_chalk22.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
-      return null;
-    }
-    const truncated = page.total > page.rows.length;
-    const choices = page.rows.map((t) => ({
-      name: label(t, page.defaultTenant, active),
-      value: t.tenant_name
-    }));
-    if (truncated || q) {
-      choices.push(new inquirer2.Separator(import_chalk22.default.dim(
-        truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
-      )));
-      choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
-    }
-    if (q) choices.push({ name: "\u21BA Show all (clear search)", value: "\0clear" });
-    if (opts.allowCreate) choices.push({ name: "\uFF0B Create a new tenant\u2026", value: "\0create" });
-    if (opts.allowBack) choices.push({ name: "\u2190 Back", value: "\0back" });
-    const { picked } = await inquirer2.prompt([{
-      type: "list",
-      name: "picked",
-      pageSize: PAGE + 5,
-      message: opts.message ?? "Which tenant?",
-      default: active && page.rows.some((t) => t.tenant_name === active) ? active : void 0,
-      choices
-    }]);
-    if (picked === "\0back") return null;
-    if (picked === "\0clear") {
-      q = "";
-      continue;
-    }
-    if (picked === "\0create") return await createTenantInline(teamId);
-    if (picked === "\0search") {
-      const { nq } = await inquirer2.prompt([{ type: "input", name: "nq", message: "Search (name or display name):", default: q }]);
-      q = String(nq ?? "").trim();
-      continue;
+      teamId = match.teamId;
     }
-    return picked;
   }
-}
-async function createTenantInline(teamId) {
-  const { default: inquirer2 } = await import("inquirer");
-  const { display } = await inquirer2.prompt([{ type: "input", name: "display", message: "Display name for the new tenant:", validate: (s) => !!s.trim() || "required" }]);
-  const out = await admin({
+  if (!opts.json) console.log(import_chalk6.default.bold("\nCreate an API proxy\n"));
+  let name = "";
+  if (opts.name !== void 0) {
+    name = normalizeName(opts.name);
+    if (name.length < 3) fail("Proxy name must be at least 3 characters (letters and digits only).");
+    const check = await checkProxyName(name, teamId, opts.apiversion).catch(() => null);
+    if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
+      fail(`Proxy name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
+    }
+  } else if (interactive) {
+    const { default: inquirer2 } = await import("inquirer");
+    for (; ; ) {
+      const { rawName } = await inquirer2.prompt([{
+        type: "input",
+        name: "rawName",
+        message: "Proxy name (your API will live at <name>.abz.run):",
+        transformer: (v) => normalizeName(v)
+      }]);
+      name = normalizeName(rawName);
+      if (name.length < 3) {
+        console.log(import_chalk6.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
+        continue;
+      }
+      const spinner2 = (0, import_ora4.default)("Checking availability...").start();
+      try {
+        const check = await checkProxyName(name, teamId, opts.apiversion);
+        spinner2.stop();
+        if (!check.canUseProjectName || !check.canUseApiVersion) {
+          console.log(import_chalk6.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
+`));
+          continue;
+        }
+      } catch {
+        spinner2.stop();
+        console.log(import_chalk6.default.dim("  (could not verify availability; continuing)"));
+      }
+      console.log(`${import_chalk6.default.cyan("\u2192")} Your API will live at ${import_chalk6.default.bold(`https://${name}.abz.run`)}
+`);
+      break;
+    }
+  } else {
+    fail("--name is required in non-interactive mode.");
+  }
+  let targetUrl = "";
+  if (opts.target !== void 0) {
+    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+    targetUrl = opts.target.trim();
+  } else if (interactive) {
+    const { default: inquirer2 } = await import("inquirer");
+    for (; ; ) {
+      const { url } = await inquirer2.prompt([{
+        type: "input",
+        name: "url",
+        message: "Target URL to forward requests to (e.g. https://httpbin.org):"
+      }]);
+      if (!isHttpUrl(url)) {
+        console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+        continue;
+      }
+      targetUrl = url.trim();
+      break;
+    }
+  } else {
+    fail("--target is required in non-interactive mode.");
+  }
+  if (interactive && !opts.yes) {
+    const { default: inquirer2 } = await import("inquirer");
+    console.log(`${import_chalk6.default.cyan("\u2192")} Auth: ${import_chalk6.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
+    const { ok } = await inquirer2.prompt([{
+      type: "confirm",
+      name: "ok",
+      message: `Create proxy "${name}" \u2192 ${targetUrl}?`,
+      default: true
+    }]);
+    if (!ok) {
+      console.log(import_chalk6.default.yellow("Cancelled."));
+      return;
+    }
+  }
+  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
+  let result;
+  try {
+    result = await createProxy({ name, target_url: targetUrl, auth_type: auth, team_id: teamId, ...opts.apiversion ? { api_version: opts.apiversion } : {} });
+    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+  } catch (err) {
+    spinner?.fail("Failed to create proxy.");
+    throw err;
+  }
+  const version2 = result.api_version || "1.0.0";
+  const keys = result.api_keys ?? {};
+  const adminKey = keys.dev ?? Object.values(keys)[0];
+  const proxyUrl = `https://${name}.abz.run/${version2}/dev`;
+  const devPortal = result.devPortal ? stripTenantFromPortal(result.devPortal) : void 0;
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({
+      project_id: result.project_id,
+      api_version: version2,
+      proxy_url: proxyUrl,
+      dev_portal: devPortal,
+      api_key: adminKey,
+      api_keys: keys,
+      team_id: teamId
+    }) + "\n");
+    return;
+  }
+  console.log();
+  console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(proxyUrl)}`);
+  if (devPortal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(devPortal)}`);
+  if (adminKey) {
+    console.log();
+    console.log(`  ${import_chalk6.default.dim("Consumer admin API key (dev):")}`);
+    console.log(`    ${import_chalk6.default.bold.green(adminKey)}`);
+    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+    const otherEnvs = Object.keys(keys).filter((e) => e !== "dev");
+    if (otherEnvs.length) {
+      console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
+    }
+  }
+  printCurlExample(proxyUrl, auth, adminKey, devPortal);
+  console.log();
+}
+async function runAnonymousCreate(opts) {
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  if (!opts.json) {
+    console.log(import_chalk6.default.bold("\nCreate an API proxy"));
+    console.log(import_chalk6.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
+  }
+  let body = {};
+  if (opts.config) {
+    let raw = "";
+    try {
+      raw = import_fs2.default.readFileSync(opts.config, "utf8");
+    } catch {
+      fail(`Cannot read --config file: ${opts.config}`);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      fail(`--config is not valid JSON: ${opts.config}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--config must be a JSON object.");
+    body = parsed;
+  }
+  let name = opts.name !== void 0 ? normalizeName(opts.name) : typeof body.name === "string" ? body.name : void 0;
+  if (opts.name !== void 0 && name.length < 3) {
+    fail("Proxy name must be at least 3 characters (letters and digits only).");
+  }
+  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+  let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
+  const hasOtherSource = !!(body.openapi || body.github);
+  if (!target && !hasOtherSource) {
+    if (interactive) {
+      const { default: inquirer2 } = await import("inquirer");
+      if (name === void 0) {
+        const { rawName } = await inquirer2.prompt([{
+          type: "input",
+          name: "rawName",
+          message: "Proxy name (leave blank to auto-generate):",
+          transformer: (v) => normalizeName(v)
+        }]);
+        const n = normalizeName(rawName);
+        name = n.length >= 3 ? n : void 0;
+      }
+      for (; ; ) {
+        const { url } = await inquirer2.prompt([{
+          type: "input",
+          name: "url",
+          message: "Target URL to forward requests to (e.g. https://httpbin.org):"
+        }]);
+        if (!isHttpUrl(url)) {
+          console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+          continue;
+        }
+        target = url.trim();
+        break;
+      }
+    } else {
+      fail("A source is required: pass --target, or target/openapi/github in --config.");
+    }
+  }
+  if (target) {
+    body.target = target;
+    body.target_url = target;
+  }
+  if (name) {
+    body.name = name;
+    body.subdomain = name;
+  }
+  if (opts.subdomain) body.subdomain = normalizeName(opts.subdomain);
+  if (opts.tenant) body.tenant = normalizeName(opts.tenant);
+  if (opts.product) body.product_slug = normalizeName(opts.product);
+  if (opts.displayName) body.display_name = opts.displayName;
+  if (opts.apiversion) body.api_version = opts.apiversion;
+  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
+  const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
+  if (opts.newSession) clearAnonCred2();
+  const cred = loadAnonCred2();
+  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
+  let result;
+  try {
+    if (cred) {
+      result = await cpFetch2(cred.cp_key, "/projects", { method: "POST", body: JSON.stringify(body) });
+      if (Array.isArray(result.endpoints)) {
+        result.endpoints = result.endpoints.map((e) => e.replace(/:\/\/[^/]+/, `://${result.project_id}.tryabz.run`));
+      }
+    } else {
+      result = await createProxyAnonymous(body);
+      if (result.cp_key && result.team_id) {
+        saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
+      }
+    }
+    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+  } catch (err) {
+    spinner?.fail("Failed to create proxy.");
+    throw err;
+  }
+  const version2 = result.api_version || "1.0.0";
+  const keys = result.api_keys ?? {};
+  const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
+  const prodEndpoint = (result.endpoints || []).find((e) => e.endsWith("/prod")) || (result.endpoints || [])[0];
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({
+      project_id: result.project_id,
+      api_version: version2,
+      endpoints: result.endpoints,
+      api_key: apiKey,
+      api_keys: keys,
+      claim_url: result.claim_url,
+      anonymous: true
+    }) + "\n");
+    return;
+  }
+  console.log();
+  if (prodEndpoint) console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(prodEndpoint)}`);
+  if (result.portal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(result.portal)}`);
+  if (apiKey) {
+    console.log();
+    console.log(`  ${import_chalk6.default.dim("API key:")}`);
+    console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
+    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+  }
+  if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
+  const claimCode = result.claim_code || cred?.claim_code;
+  if (claimCode) {
+    console.log();
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} Everything you create`);
+    console.log(`    with the CP key shares ONE workspace. To keep it all in one shot:`);
+    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}   ${import_chalk6.default.dim("(prompts to claim your workspace into your account)")}`);
+    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${claimCode}  (add --team <name> to merge into an existing team)`));
+  } else if (result.claim_url) {
+    console.log();
+    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
+    console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
+  }
+  console.log();
+}
+var import_fs2, import_chalk6, import_ora4, VALID_AUTH;
+var init_create = __esm({
+  "src/commands/create.ts"() {
+    "use strict";
+    import_fs2 = __toESM(require("fs"));
+    import_chalk6 = __toESM(require("chalk"));
+    import_ora4 = __toESM(require("ora"));
+    init_auth();
+    init_api();
+    VALID_AUTH = ["api_key", "none", "oauth"];
+  }
+});
+
+// src/lib/trace.ts
+function setVerbose(v) {
+  verbose = v;
+}
+function recordCall(e) {
+  if (verbose) entries.push(e);
+}
+function maskBody(body) {
+  if (body === void 0) return void 0;
+  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
+}
+function renderTrace() {
+  if (!verbose || entries.length === 0) return;
+  console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
+  console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
+  console.log(
+    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
+  );
+  entries.forEach((e, i) => {
+    const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
+    if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
+    const masked = maskBody(e.body);
+    const hasBody = e.method !== "GET" && masked !== void 0;
+    console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
+    if (hasBody) {
+      console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
+      console.log(import_chalk15.default.green(`    -d '${masked}'`));
+    }
+    if (i < entries.length - 1) console.log();
+  });
+  entries.length = 0;
+}
+var import_chalk15, CONTROL_API_VERSION, verbose, entries, SECRET_KEY;
+var init_trace = __esm({
+  "src/lib/trace.ts"() {
+    "use strict";
+    import_chalk15 = __toESM(require("chalk"));
+    CONTROL_API_VERSION = "1.0.0";
+    verbose = false;
+    entries = [];
+    SECRET_KEY = /secret|token|password|api[_-]?key|client_secret/i;
+  }
+});
+
+// src/lib/admin.ts
+async function admin(call) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE3}/api/cli/admin`, {
     method: "POST",
-    path: `/teams/${encodeURIComponent(teamId)}/tenants`,
-    body: { display_name: display.trim() },
-    summary: `Create tenant "${display.trim()}"`
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
   });
-  const slug = out?.tenant_name ?? out?.tenant?.tenant_name;
-  console.log(import_chalk22.default.green(`  Tenant ${import_chalk22.default.bold(slug)} created.`));
-  return slug;
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
+  maybePrintBilling(data);
+  if (!res.ok) {
+    const msg = data?.details ?? data?.error ?? res.statusText;
+    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
+  }
+  return data;
+}
+function maybePrintBilling(data) {
+  const b = data?.billing;
+  if (b && typeof b.charged_cents === "number") {
+    const usd = (b.charged_cents / 100).toFixed(2);
+    const rem = typeof b.credits_remaining === "number" ? ` \xB7 $${(b.credits_remaining / 100).toFixed(2)} credit left` : "";
+    console.log(import_chalk16.default.magenta(`  \u{1F4B3} Charged $${usd}${rem}`));
+  }
+}
+var import_chalk16, DASHBOARD_BASE3;
+var init_admin = __esm({
+  "src/lib/admin.ts"() {
+    "use strict";
+    import_chalk16 = __toESM(require("chalk"));
+    init_auth();
+    init_trace();
+    init_types();
+    DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+  }
+});
+
+// src/lib/tenant-pick.ts
+var tenant_pick_exports = {};
+__export(tenant_pick_exports, {
+  pickTenant: () => pickTenant
+});
+async function fetchPage(teamId, q) {
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1&limit=${PAGE}${q ? `&q=${encodeURIComponent(q)}` : ""}`,
+    summary: q ? `Search tenants matching "${q}"` : "List tenants (first page)"
+  });
+  const rows = (out?.tenants ?? []).map(
+    (t) => typeof t === "string" ? { tenant_name: t } : t
+  );
+  return { rows, total: out?.total ?? rows.length, defaultTenant: out?.default_tenant ?? null };
+}
+function label(t, defaultTenant, active) {
+  const tags = [
+    t.tenant_name === active ? import_chalk22.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk22.default.dim("team default") : ""
+  ].filter(Boolean).join(", ");
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk22.default.dim(`  ${t.display_name}`) : "";
+  return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
+}
+async function pickTenant(teamId, opts = {}) {
+  const { default: inquirer2 } = await import("inquirer");
+  const active = loadCredentials()?.activeTenant;
+  let q = opts.initialQuery ?? "";
+  for (; ; ) {
+    const spinner = (0, import_ora8.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const page = await fetchPage(teamId, q).finally(() => spinner.stop());
+    if (!page.total && !q) {
+      if (opts.allowCreate) {
+        const { make } = await inquirer2.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
+        if (make) return await createTenantInline(teamId);
+      }
+      console.error(import_chalk22.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      return null;
+    }
+    const truncated = page.total > page.rows.length;
+    const choices = page.rows.map((t) => ({
+      name: label(t, page.defaultTenant, active),
+      value: t.tenant_name
+    }));
+    if (truncated || q) {
+      choices.push(new inquirer2.Separator(import_chalk22.default.dim(
+        truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
+      )));
+      choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
+    }
+    if (q) choices.push({ name: "\u21BA Show all (clear search)", value: "\0clear" });
+    if (opts.allowCreate) choices.push({ name: "\uFF0B Create a new tenant\u2026", value: "\0create" });
+    if (opts.allowBack) choices.push({ name: "\u2190 Back", value: "\0back" });
+    const { picked } = await inquirer2.prompt([{
+      type: "list",
+      name: "picked",
+      pageSize: PAGE + 5,
+      message: opts.message ?? "Which tenant?",
+      default: active && page.rows.some((t) => t.tenant_name === active) ? active : void 0,
+      choices
+    }]);
+    if (picked === "\0back") return null;
+    if (picked === "\0clear") {
+      q = "";
+      continue;
+    }
+    if (picked === "\0create") return await createTenantInline(teamId);
+    if (picked === "\0search") {
+      const { nq } = await inquirer2.prompt([{ type: "input", name: "nq", message: "Search (name or display name):", default: q }]);
+      q = String(nq ?? "").trim();
+      continue;
+    }
+    return picked;
+  }
+}
+async function createTenantInline(teamId) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const { name } = await inquirer2.prompt([{
+      type: "input",
+      name: "name",
+      message: `Tenant name ${import_chalk22.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
+    }]);
+    const slugInput = name.trim();
+    try {
+      const out = await admin({
+        method: "POST",
+        path: `/teams/${encodeURIComponent(teamId)}/tenants`,
+        body: { tenant_name: slugInput, display_name: slugInput },
+        summary: `Create tenant "${slugInput}"`
+      });
+      const slug = out?.tenant_name ?? out?.tenant?.tenant_name ?? slugInput;
+      console.log(import_chalk22.default.green(`  Tenant ${import_chalk22.default.bold(slug)} created.`));
+      return slug;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
+        console.log(import_chalk22.default.yellow(`  "${slugInput}" is not available (tenant names are global): ${msg}`));
+        continue;
+      }
+      throw err;
+    }
+  }
 }
 var import_chalk22, import_ora8, PAGE;
 var init_tenant_pick = __esm({
@@ -492,7 +927,7 @@ var import_commander = require("commander");
 var import_chalk34 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.12.1";
+var version = "0.15.0";
 
 // src/index.ts
 init_types();
@@ -501,43 +936,7 @@ init_types();
 var import_chalk2 = __toESM(require("chalk"));
 var import_ora = __toESM(require("ora"));
 init_auth();
-
-// src/lib/team.ts
-var import_chalk = __toESM(require("chalk"));
-init_api();
-async function resolveLinkedTeam(opts) {
-  let teams;
-  try {
-    teams = await getTeams();
-  } catch {
-    return opts.preferredId ? { teamId: opts.preferredId } : null;
-  }
-  if (teams.length === 0) return null;
-  const preferred = opts.preferredId ? teams.find((t) => t.teamId === opts.preferredId) : void 0;
-  if (preferred) return { teamId: preferred.teamId, teamName: preferred.name };
-  if (opts.preferredId) {
-    console.log(import_chalk.default.yellow("\nYour previously linked team is no longer available."));
-  }
-  if (teams.length === 1) {
-    console.log(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);
-    return { teamId: teams[0].teamId, teamName: teams[0].name };
-  }
-  if (!opts.interactive) {
-    console.log(import_chalk.default.yellow(`Linking to "${teams[0].name}" \u2014 pass --team to choose another.`));
-    return { teamId: teams[0].teamId, teamName: teams[0].name };
-  }
-  const { default: inquirer2 } = await import("inquirer");
-  const { chosen } = await inquirer2.prompt([{
-    type: "list",
-    name: "chosen",
-    message: "Which team do you want to link to?",
-    choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
-  }]);
-  const picked = teams.find((t) => t.teamId === chosen);
-  return { teamId: picked.teamId, teamName: picked.name };
-}
-
-// src/commands/login.ts
+init_team();
 var DASHBOARD_BASE2 = "https://dashboard.apiblaze.com";
 function openBrowser(url) {
   const { exec } = require("child_process");
@@ -613,7 +1012,12 @@ async function runLogin() {
   }
   let teamId = defaultTeamId ?? void 0;
   let teamName;
-  const linked = await resolveLinkedTeam({ preferredId: defaultTeamId ?? void 0, interactive: !!process.stdin.isTTY });
+  const linked = await resolveLinkedTeam({
+    preferredId: defaultTeamId ?? void 0,
+    interactive: !!process.stdin.isTTY,
+    // >1 team → ASK (JWT default is just the cursor). One team → link silently.
+    promptWhenMultiple: true
+  });
   if (linked) {
     teamId = linked.teamId;
     teamName = linked.teamName;
@@ -838,6 +1242,9 @@ function formatCapturedRequest(req, note) {
   ].join("\n");
 }
 
+// src/commands/dev.ts
+init_team();
+
 // src/lib/random-name.ts
 var ADJECTIVES = [
   "amber",
@@ -1178,587 +1585,253 @@ async function offerAutoCreate(teamId, port) {
   const targets = await getLocalhostTargets(teamId).catch(() => []);
   const created = targets.find((t) => t.projectId === result.project_id);
   if (!created) {
-    console.log(import_chalk4.default.yellow("  Proxy created, but it did not appear as a localhost target \u2014 try `apiblaze dev` again."));
-    return null;
-  }
-  return created;
-}
-function isInternalTarget(url) {
-  if (!url) return false;
-  try {
-    const h = new URL(url).hostname.toLowerCase();
-    return h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "0.0.0.0" || /^127\./.test(h) || /^10\./.test(h) || /^192\.168\./.test(h) || /^169\.254\./.test(h) || /^172\.(1[6-9]|2\d|3[01])\./.test(h);
-  } catch {
-    return false;
-  }
-}
-function printTunnelEndpoints(restore, targets) {
-  if (restore.length === 0) return;
-  console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
-  for (const r of restore) {
-    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
-    console.log(`
-  ${import_chalk4.default.bold(label2)}`);
-    const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
-    const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
-    for (const env of envs) {
-      console.log(`    ${import_chalk4.default.dim("API: ")} ${import_chalk4.default.cyan(`https://${r.projectId}.abz.run/${r.apiVersion}/${env}/`)}`);
-    }
-    if (r.tenant) {
-      console.log(`    ${import_chalk4.default.dim("Portal:")} ${import_chalk4.default.cyan(`https://${r.tenant}.portal.apiblaze.com/${r.apiVersion}`)}`);
-    }
-  }
-}
-async function probeLocalServer(port) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 1500);
-  try {
-    await fetch(`http://127.0.0.1:${port}/`, { method: "HEAD", signal: controller.signal });
-    return true;
-  } catch (err) {
-    if (err?.name === "AbortError") return true;
-    const code = err?.cause?.code;
-    return !(code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH");
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function runDev(options) {
-  const creds = await ensureLoggedIn(!!process.stdin.isTTY);
-  const linked = await resolveLinkedTeam({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
-  if (!linked) {
-    console.error(import_chalk4.default.red("No team available. Run `apiblaze login` to set up your team."));
-    process.exit(1);
-  }
-  const teamId = linked.teamId;
-  if (linked.teamId !== creds.teamId || linked.teamName !== creds.teamName) {
-    saveCredentials({ ...creds, teamId: linked.teamId, teamName: linked.teamName });
-  }
-  if (linked.teamName) {
-    console.log(`${import_chalk4.default.cyan("\u2192")} Team: ${import_chalk4.default.bold(linked.teamName)}`);
-  }
-  let targets;
-  {
-    const spinner = (0, import_ora2.default)("Fetching your localhost projects...").start();
-    try {
-      targets = await getLocalhostTargets(teamId);
-      spinner.stop();
-    } catch (err) {
-      spinner.fail("Failed to fetch projects.");
-      throw err;
-    }
-  }
-  let selectedTargets;
-  if (targets.length === 0) {
-    const created = await offerAutoCreate(teamId, options.port);
-    if (!created) {
-      console.log("Set a project's upstream target to localhost or a private IP, then try again.");
-      process.exit(0);
-    }
-    selectedTargets = [created];
-  } else if (targets.length === 1) {
-    const { confirmed } = await import_inquirer.default.prompt([{
-      type: "confirm",
-      name: "confirmed",
-      message: `Found 1 project with an internal target \u2014 tunnel "${import_chalk4.default.bold(targets[0].projectName)}" (${targets[0].tenantName})?`,
-      default: true
-    }]);
-    if (!confirmed) {
-      console.log("Aborted.");
-      process.exit(0);
-    }
-    selectedTargets = targets;
-  } else {
-    const ALL = "__all__";
-    const { chosen } = await import_inquirer.default.prompt([{
-      type: "list",
-      name: "chosen",
-      message: `Found ${targets.length} projects with an internal target \u2014 pick one to tunnel:`,
-      choices: [
-        ...targets.map((t) => ({
-          name: `${import_chalk4.default.bold(t.projectName)} (${t.tenantName}) \u2014 ${t.target}`,
-          value: t
-        })),
-        new import_inquirer.default.Separator(),
-        { name: `Tunnel all ${targets.length}`, value: ALL }
-      ]
-    }]);
-    selectedTargets = chosen === ALL ? targets : [chosen];
-  }
-  console.log(
-    import_chalk4.default.green(`
-Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
-`)
-  );
-  let recordSink;
-  let captureStream;
-  if (options.captureFile) {
-    captureStream = import_fs.default.createWriteStream(options.captureFile, { flags: "a" });
-    recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
-    console.log(import_chalk4.default.gray(`Streaming full traffic to ${options.captureFile}
-`));
-  }
-  let restore = [];
-  let connect;
-  {
-    const spinner = (0, import_ora2.default)("Registering tunnel with APIblaze...").start();
-    try {
-      const result = await putDevTunnel({
-        targets: selectedTargets.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId }))
-      });
-      restore = result.restore ?? [];
-      connect = result.connect;
-      spinner.succeed("Tunnel registered.");
-    } catch (err) {
-      spinner.fail("Failed to register tunnel.");
-      throw err;
-    }
-  }
-  printTunnelEndpoints(restore, selectedTargets);
-  const clients = connect.projects.map(
-    (projectId) => startTunnelClient({
-      connectUrl: connect.url,
-      token: connect.token,
-      projectId,
-      localPort: options.port,
-      onEntry: (entry) => console.log(formatLogLine(entry)),
-      onStatus: (status) => console.log(import_chalk4.default.gray(`[${projectId}] ${status}`)),
-      onCapture: (req, note) => console.log(formatCapturedRequest(req, note)),
-      onCaptureStart: () => console.log(
-        import_chalk4.default.magenta(`
-\u26B2 No local server on port ${options.port} yet \u2014 capturing requests below. Start your server and they'll forward automatically.
-`)
-      ),
-      onResume: () => console.log(
-        import_chalk4.default.green(`
-\u2713 Local server detected on port ${options.port} \u2014 forwarding resumed.
-`)
-      ),
-      onRecord: recordSink
-    })
-  );
-  const localUp = await probeLocalServer(options.port);
-  console.log("\n" + import_chalk4.default.gray("\u2500".repeat(60)));
-  console.log(import_chalk4.default.bold("Live traffic") + import_chalk4.default.gray(" (Ctrl+C to stop)"));
-  console.log(
-    localUp ? import_chalk4.default.green(`\u2713 Local server detected on port ${options.port} \u2014 forwarding live.`) : import_chalk4.default.magenta(`\u26B2 Nothing listening on port ${options.port} yet \u2014 requests will be captured until your server starts.`)
-  );
-  console.log(import_chalk4.default.gray("\u2500".repeat(60)) + "\n");
-  let isCleaningUp = false;
-  async function cleanup() {
-    if (isCleaningUp) return;
-    isCleaningUp = true;
-    console.log(import_chalk4.default.gray("\n\nShutting down..."));
-    for (const client of clients) client.close();
-    captureStream?.end();
-    await deleteDevTunnel(restore).catch(() => {
-    });
-    console.log(import_chalk4.default.green("Tunnel stopped."));
-    process.exit(0);
-  }
-  process.on("SIGINT", () => void cleanup());
-  process.on("SIGTERM", () => void cleanup());
-  await new Promise(() => {
-  });
-}
-
-// src/commands/projects.ts
-var import_chalk5 = __toESM(require("chalk"));
-var import_ora3 = __toESM(require("ora"));
-init_auth();
-init_api();
-async function runProjects() {
-  const creds = loadCredentials();
-  if (!creds) {
-    console.error(import_chalk5.default.red("Not logged in. Run `apiblaze login` first."));
-    process.exit(1);
-  }
-  if (creds.githubHandle) {
-    console.log(`${import_chalk5.default.cyan("\u2192")} Logged in as ${import_chalk5.default.bold("@" + creds.githubHandle)}`);
-  }
-  let teamId = creds.teamId;
-  let teamName = creds.teamName;
-  if (!teamId) {
-    const teams = await getTeams().catch(() => []);
-    if (teams.length === 1) {
-      teamId = teams[0].teamId;
-      teamName = teams[0].name;
-    } else if (teams.length > 1) {
-      const { default: inquirer2 } = await import("inquirer");
-      const { chosen } = await inquirer2.prompt([{
-        type: "list",
-        name: "chosen",
-        message: "Which team do you want to use?",
-        choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
-      }]);
-      teamId = chosen;
-      teamName = teams.find((t) => t.teamId === chosen)?.name;
-    }
-  }
-  if (!teamId) {
-    console.error(import_chalk5.default.red("No team found. Run `apiblaze login` to set up your team."));
-    process.exit(1);
-  }
-  console.log(`${import_chalk5.default.cyan("\u2192")} Team: ${import_chalk5.default.bold(teamName ?? teamId)}
-`);
-  const spinner = (0, import_ora3.default)("Fetching projects...").start();
-  let projects;
-  try {
-    projects = await getProjects(teamId);
-    spinner.stop();
-  } catch (err) {
-    spinner.fail("Failed to fetch projects.");
-    throw err;
-  }
-  if (projects.length === 0) {
-    console.log(import_chalk5.default.yellow("No projects found for this team."));
-    return;
-  }
-  const width = Math.max(...projects.map((p) => p.projectName.length));
-  for (const p of projects) {
-    console.log(`  ${import_chalk5.default.bold(p.projectName.padEnd(width))}   ${import_chalk5.default.dim("v" + p.apiVersion)}`);
-  }
-  console.log(import_chalk5.default.dim(`
-${projects.length} project${projects.length === 1 ? "" : "s"}`));
-}
-
-// src/commands/create.ts
-var import_fs2 = __toESM(require("fs"));
-var import_chalk6 = __toESM(require("chalk"));
-var import_ora4 = __toESM(require("ora"));
-init_auth();
-init_api();
-function normalizeName(raw) {
-  return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
-}
-function isHttpUrl(s) {
-  try {
-    const u = new URL((s || "").trim());
-    return u.protocol === "http:" || u.protocol === "https:";
-  } catch {
-    return false;
+    console.log(import_chalk4.default.yellow("  Proxy created, but it did not appear as a localhost target \u2014 try `apiblaze dev` again."));
+    return null;
   }
+  return created;
 }
-function stripTenantFromPortal(devPortal) {
+function isInternalTarget(url) {
+  if (!url) return false;
   try {
-    const u = new URL(devPortal);
-    const dot = u.hostname.indexOf(".");
-    if (dot < 0) return devPortal;
-    const product = u.hostname.slice(0, dot).split("-")[0];
-    u.hostname = `${product}${u.hostname.slice(dot)}`;
-    return u.toString();
+    const h = new URL(url).hostname.toLowerCase();
+    return h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "0.0.0.0" || /^127\./.test(h) || /^10\./.test(h) || /^192\.168\./.test(h) || /^169\.254\./.test(h) || /^172\.(1[6-9]|2\d|3[01])\./.test(h);
   } catch {
-    return devPortal;
+    return false;
   }
 }
-function fail(message) {
-  console.error(import_chalk6.default.red(`Error: ${message}`));
-  process.exit(1);
-}
-function buildTryItCurl(url, authType, apiKey) {
-  if (authType === "api_key") {
-    if (!apiKey) return null;
-    return `curl ${url} -H "X-API-Key: ${apiKey}"`;
+function printTunnelEndpoints(restore, targets) {
+  if (restore.length === 0) return;
+  console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
+  for (const r of restore) {
+    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
+    console.log(`
+  ${import_chalk4.default.bold(label2)}`);
+    const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
+    const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
+    for (const env of envs) {
+      console.log(`    ${import_chalk4.default.dim("API: ")} ${import_chalk4.default.cyan(`https://${r.projectId}.abz.run/${r.apiVersion}/${env}/`)}`);
+    }
+    if (r.tenant) {
+      console.log(`    ${import_chalk4.default.dim("Portal:")} ${import_chalk4.default.cyan(`https://${r.tenant}.portal.apiblaze.com/${r.apiVersion}`)}`);
+    }
   }
-  if (authType === "none") return `curl ${url}`;
-  return null;
 }
-function printCurlExample(url, authType, apiKey, devPortal) {
-  const curl = buildTryItCurl(url, authType, apiKey);
-  console.log();
-  if (curl) {
-    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
-    console.log(`    ${import_chalk6.default.cyan(curl)}`);
-  } else if (authType === "oauth") {
-    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
-    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
+async function probeLocalServer(port) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1500);
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { method: "HEAD", signal: controller.signal });
+    return true;
+  } catch (err) {
+    if (err?.name === "AbortError") return true;
+    const code = err?.cause?.code;
+    return !(code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH");
+  } finally {
+    clearTimeout(timer);
   }
 }
-var VALID_AUTH = ["api_key", "none", "oauth"];
-async function runCreate(opts = {}) {
-  const creds = loadCredentials();
-  if (!creds) {
-    await runAnonymousCreate(opts);
-    return;
+async function runDev(options) {
+  const creds = await ensureLoggedIn(!!process.stdin.isTTY);
+  const linked = await resolveLinkedTeam({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
+  if (!linked) {
+    console.error(import_chalk4.default.red("No team available. Run `apiblaze login` to set up your team."));
+    process.exit(1);
   }
-  const interactive = !!process.stdin.isTTY && !opts.json;
-  const auth = (opts.auth ?? "api_key").toLowerCase();
-  if (!VALID_AUTH.includes(auth)) {
-    fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
+  const teamId = linked.teamId;
+  if (linked.teamId !== creds.teamId || linked.teamName !== creds.teamName) {
+    saveCredentials({ ...creds, teamId: linked.teamId, teamName: linked.teamName });
   }
-  let teamId = creds.teamId;
-  if (opts.team) {
-    if (opts.team.startsWith("team_")) {
-      teamId = opts.team;
-    } else {
-      const teams = await getTeams().catch(() => []);
-      const match = teams.find(
-        (t) => t.teamId === opts.team || t.name.toLowerCase() === opts.team.toLowerCase()
-      );
-      if (!match) {
-        fail(`Team "${opts.team}" not found. Run \`apiblaze team\` to see your teams.`);
-      }
-      teamId = match.teamId;
-    }
+  if (linked.teamName) {
+    console.log(`${import_chalk4.default.cyan("\u2192")} Team: ${import_chalk4.default.bold(linked.teamName)}`);
   }
-  if (!opts.json) console.log(import_chalk6.default.bold("\nCreate an API proxy\n"));
-  let name = "";
-  if (opts.name !== void 0) {
-    name = normalizeName(opts.name);
-    if (name.length < 3) fail("Proxy name must be at least 3 characters (letters and digits only).");
-    const check = await checkProxyName(name, teamId, opts.apiversion).catch(() => null);
-    if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
-      fail(`Proxy name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
-    }
-  } else if (interactive) {
-    const { default: inquirer2 } = await import("inquirer");
-    for (; ; ) {
-      const { rawName } = await inquirer2.prompt([{
-        type: "input",
-        name: "rawName",
-        message: "Proxy name (your API will live at <name>.abz.run):",
-        transformer: (v) => normalizeName(v)
-      }]);
-      name = normalizeName(rawName);
-      if (name.length < 3) {
-        console.log(import_chalk6.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
-        continue;
-      }
-      const spinner2 = (0, import_ora4.default)("Checking availability...").start();
-      try {
-        const check = await checkProxyName(name, teamId, opts.apiversion);
-        spinner2.stop();
-        if (!check.canUseProjectName || !check.canUseApiVersion) {
-          console.log(import_chalk6.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
-`));
-          continue;
-        }
-      } catch {
-        spinner2.stop();
-        console.log(import_chalk6.default.dim("  (could not verify availability; continuing)"));
-      }
-      console.log(`${import_chalk6.default.cyan("\u2192")} Your API will live at ${import_chalk6.default.bold(`https://${name}.abz.run`)}
-`);
-      break;
+  let targets;
+  {
+    const spinner = (0, import_ora2.default)("Fetching your localhost projects...").start();
+    try {
+      targets = await getLocalhostTargets(teamId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail("Failed to fetch projects.");
+      throw err;
     }
-  } else {
-    fail("--name is required in non-interactive mode.");
   }
-  let targetUrl = "";
-  if (opts.target !== void 0) {
-    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
-    targetUrl = opts.target.trim();
-  } else if (interactive) {
-    const { default: inquirer2 } = await import("inquirer");
-    for (; ; ) {
-      const { url } = await inquirer2.prompt([{
-        type: "input",
-        name: "url",
-        message: "Target URL to forward requests to (e.g. https://httpbin.org):"
-      }]);
-      if (!isHttpUrl(url)) {
-        console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
-        continue;
-      }
-      targetUrl = url.trim();
-      break;
+  let selectedTargets;
+  if (targets.length === 0) {
+    const created = await offerAutoCreate(teamId, options.port);
+    if (!created) {
+      console.log("Set a project's upstream target to localhost or a private IP, then try again.");
+      process.exit(0);
     }
-  } else {
-    fail("--target is required in non-interactive mode.");
-  }
-  if (interactive && !opts.yes) {
-    const { default: inquirer2 } = await import("inquirer");
-    console.log(`${import_chalk6.default.cyan("\u2192")} Auth: ${import_chalk6.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
-    const { ok } = await inquirer2.prompt([{
+    selectedTargets = [created];
+  } else if (targets.length === 1) {
+    const { confirmed } = await import_inquirer.default.prompt([{
       type: "confirm",
-      name: "ok",
-      message: `Create proxy "${name}" \u2192 ${targetUrl}?`,
+      name: "confirmed",
+      message: `Found 1 project with an internal target \u2014 tunnel "${import_chalk4.default.bold(targets[0].projectName)}" (${targets[0].tenantName})?`,
       default: true
     }]);
-    if (!ok) {
-      console.log(import_chalk6.default.yellow("Cancelled."));
-      return;
-    }
-  }
-  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
-  let result;
-  try {
-    result = await createProxy({ name, target_url: targetUrl, auth_type: auth, team_id: teamId, ...opts.apiversion ? { api_version: opts.apiversion } : {} });
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
-  } catch (err) {
-    spinner?.fail("Failed to create proxy.");
-    throw err;
-  }
-  const version2 = result.api_version || "1.0.0";
-  const keys = result.api_keys ?? {};
-  const adminKey = keys.dev ?? Object.values(keys)[0];
-  const proxyUrl = `https://${name}.abz.run/${version2}/dev`;
-  const devPortal = result.devPortal ? stripTenantFromPortal(result.devPortal) : void 0;
-  if (opts.json) {
-    process.stdout.write(JSON.stringify({
-      project_id: result.project_id,
-      api_version: version2,
-      proxy_url: proxyUrl,
-      dev_portal: devPortal,
-      api_key: adminKey,
-      api_keys: keys,
-      team_id: teamId
-    }) + "\n");
-    return;
-  }
-  console.log();
-  console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(proxyUrl)}`);
-  if (devPortal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(devPortal)}`);
-  if (adminKey) {
-    console.log();
-    console.log(`  ${import_chalk6.default.dim("Consumer admin API key (dev):")}`);
-    console.log(`    ${import_chalk6.default.bold.green(adminKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
-    const otherEnvs = Object.keys(keys).filter((e) => e !== "dev");
-    if (otherEnvs.length) {
-      console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
+    if (!confirmed) {
+      console.log("Aborted.");
+      process.exit(0);
     }
+    selectedTargets = targets;
+  } else {
+    const ALL = "__all__";
+    const { chosen } = await import_inquirer.default.prompt([{
+      type: "list",
+      name: "chosen",
+      message: `Found ${targets.length} projects with an internal target \u2014 pick one to tunnel:`,
+      choices: [
+        ...targets.map((t) => ({
+          name: `${import_chalk4.default.bold(t.projectName)} (${t.tenantName}) \u2014 ${t.target}`,
+          value: t
+        })),
+        new import_inquirer.default.Separator(),
+        { name: `Tunnel all ${targets.length}`, value: ALL }
+      ]
+    }]);
+    selectedTargets = chosen === ALL ? targets : [chosen];
   }
-  printCurlExample(proxyUrl, auth, adminKey, devPortal);
-  console.log();
-}
-async function runAnonymousCreate(opts) {
-  const interactive = !!process.stdin.isTTY && !opts.json;
-  if (!opts.json) {
-    console.log(import_chalk6.default.bold("\nCreate an API proxy"));
-    console.log(import_chalk6.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
+  console.log(
+    import_chalk4.default.green(`
+Tunneling ${selectedTargets.length} project(s) to localhost:${options.port}
+`)
+  );
+  let recordSink;
+  let captureStream;
+  if (options.captureFile) {
+    captureStream = import_fs.default.createWriteStream(options.captureFile, { flags: "a" });
+    recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
+    console.log(import_chalk4.default.gray(`Streaming full traffic to ${options.captureFile}
+`));
   }
-  let body = {};
-  if (opts.config) {
-    let raw = "";
-    try {
-      raw = import_fs2.default.readFileSync(opts.config, "utf8");
-    } catch {
-      fail(`Cannot read --config file: ${opts.config}`);
-    }
-    let parsed;
+  let restore = [];
+  let connect;
+  {
+    const spinner = (0, import_ora2.default)("Registering tunnel with APIblaze...").start();
     try {
-      parsed = JSON.parse(raw);
-    } catch {
-      fail(`--config is not valid JSON: ${opts.config}`);
+      const result = await putDevTunnel({
+        targets: selectedTargets.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId }))
+      });
+      restore = result.restore ?? [];
+      connect = result.connect;
+      spinner.succeed("Tunnel registered.");
+    } catch (err) {
+      spinner.fail("Failed to register tunnel.");
+      throw err;
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--config must be a JSON object.");
-    body = parsed;
   }
-  let name = opts.name !== void 0 ? normalizeName(opts.name) : typeof body.name === "string" ? body.name : void 0;
-  if (opts.name !== void 0 && name.length < 3) {
-    fail("Proxy name must be at least 3 characters (letters and digits only).");
+  printTunnelEndpoints(restore, selectedTargets);
+  const clients = connect.projects.map(
+    (projectId) => startTunnelClient({
+      connectUrl: connect.url,
+      token: connect.token,
+      projectId,
+      localPort: options.port,
+      onEntry: (entry) => console.log(formatLogLine(entry)),
+      onStatus: (status) => console.log(import_chalk4.default.gray(`[${projectId}] ${status}`)),
+      onCapture: (req, note) => console.log(formatCapturedRequest(req, note)),
+      onCaptureStart: () => console.log(
+        import_chalk4.default.magenta(`
+\u26B2 No local server on port ${options.port} yet \u2014 capturing requests below. Start your server and they'll forward automatically.
+`)
+      ),
+      onResume: () => console.log(
+        import_chalk4.default.green(`
+\u2713 Local server detected on port ${options.port} \u2014 forwarding resumed.
+`)
+      ),
+      onRecord: recordSink
+    })
+  );
+  const localUp = await probeLocalServer(options.port);
+  console.log("\n" + import_chalk4.default.gray("\u2500".repeat(60)));
+  console.log(import_chalk4.default.bold("Live traffic") + import_chalk4.default.gray(" (Ctrl+C to stop)"));
+  console.log(
+    localUp ? import_chalk4.default.green(`\u2713 Local server detected on port ${options.port} \u2014 forwarding live.`) : import_chalk4.default.magenta(`\u26B2 Nothing listening on port ${options.port} yet \u2014 requests will be captured until your server starts.`)
+  );
+  console.log(import_chalk4.default.gray("\u2500".repeat(60)) + "\n");
+  let isCleaningUp = false;
+  async function cleanup() {
+    if (isCleaningUp) return;
+    isCleaningUp = true;
+    console.log(import_chalk4.default.gray("\n\nShutting down..."));
+    for (const client of clients) client.close();
+    captureStream?.end();
+    await deleteDevTunnel(restore).catch(() => {
+    });
+    console.log(import_chalk4.default.green("Tunnel stopped."));
+    process.exit(0);
   }
-  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
-  let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
-  const hasOtherSource = !!(body.openapi || body.github);
-  if (!target && !hasOtherSource) {
-    if (interactive) {
+  process.on("SIGINT", () => void cleanup());
+  process.on("SIGTERM", () => void cleanup());
+  await new Promise(() => {
+  });
+}
+
+// src/commands/projects.ts
+var import_chalk5 = __toESM(require("chalk"));
+var import_ora3 = __toESM(require("ora"));
+init_auth();
+init_api();
+async function runProjects() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error(import_chalk5.default.red("Not logged in. Run `apiblaze login` first."));
+    process.exit(1);
+  }
+  if (creds.githubHandle) {
+    console.log(`${import_chalk5.default.cyan("\u2192")} Logged in as ${import_chalk5.default.bold("@" + creds.githubHandle)}`);
+  }
+  let teamId = creds.teamId;
+  let teamName = creds.teamName;
+  if (!teamId) {
+    const teams = await getTeams().catch(() => []);
+    if (teams.length === 1) {
+      teamId = teams[0].teamId;
+      teamName = teams[0].name;
+    } else if (teams.length > 1) {
       const { default: inquirer2 } = await import("inquirer");
-      if (name === void 0) {
-        const { rawName } = await inquirer2.prompt([{
-          type: "input",
-          name: "rawName",
-          message: "Proxy name (leave blank to auto-generate):",
-          transformer: (v) => normalizeName(v)
-        }]);
-        const n = normalizeName(rawName);
-        name = n.length >= 3 ? n : void 0;
-      }
-      for (; ; ) {
-        const { url } = await inquirer2.prompt([{
-          type: "input",
-          name: "url",
-          message: "Target URL to forward requests to (e.g. https://httpbin.org):"
-        }]);
-        if (!isHttpUrl(url)) {
-          console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
-          continue;
-        }
-        target = url.trim();
-        break;
-      }
-    } else {
-      fail("A source is required: pass --target, or target/openapi/github in --config.");
+      const { chosen } = await inquirer2.prompt([{
+        type: "list",
+        name: "chosen",
+        message: "Which team do you want to use?",
+        choices: teams.map((t) => ({ name: t.name, value: t.teamId }))
+      }]);
+      teamId = chosen;
+      teamName = teams.find((t) => t.teamId === chosen)?.name;
     }
   }
-  if (target) {
-    body.target = target;
-    body.target_url = target;
-  }
-  if (name) {
-    body.name = name;
-    body.subdomain = name;
+  if (!teamId) {
+    console.error(import_chalk5.default.red("No team found. Run `apiblaze login` to set up your team."));
+    process.exit(1);
   }
-  if (opts.subdomain) body.subdomain = normalizeName(opts.subdomain);
-  if (opts.tenant) body.tenant = normalizeName(opts.tenant);
-  if (opts.product) body.product_slug = normalizeName(opts.product);
-  if (opts.displayName) body.display_name = opts.displayName;
-  if (opts.apiversion) body.api_version = opts.apiversion;
-  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
-  const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
-  if (opts.newSession) clearAnonCred2();
-  const cred = loadAnonCred2();
-  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
-  let result;
+  console.log(`${import_chalk5.default.cyan("\u2192")} Team: ${import_chalk5.default.bold(teamName ?? teamId)}
+`);
+  const spinner = (0, import_ora3.default)("Fetching projects...").start();
+  let projects;
   try {
-    if (cred) {
-      result = await cpFetch2(cred.cp_key, "/projects", { method: "POST", body: JSON.stringify(body) });
-      if (Array.isArray(result.endpoints)) {
-        result.endpoints = result.endpoints.map((e) => e.replace(/:\/\/[^/]+/, `://${result.project_id}.tryabz.run`));
-      }
-    } else {
-      result = await createProxyAnonymous(body);
-      if (result.cp_key && result.team_id) {
-        saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
-      }
-    }
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+    projects = await getProjects(teamId);
+    spinner.stop();
   } catch (err) {
-    spinner?.fail("Failed to create proxy.");
+    spinner.fail("Failed to fetch projects.");
     throw err;
   }
-  const version2 = result.api_version || "1.0.0";
-  const keys = result.api_keys ?? {};
-  const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
-  const prodEndpoint = (result.endpoints || []).find((e) => e.endsWith("/prod")) || (result.endpoints || [])[0];
-  if (opts.json) {
-    process.stdout.write(JSON.stringify({
-      project_id: result.project_id,
-      api_version: version2,
-      endpoints: result.endpoints,
-      api_key: apiKey,
-      api_keys: keys,
-      claim_url: result.claim_url,
-      anonymous: true
-    }) + "\n");
+  if (projects.length === 0) {
+    console.log(import_chalk5.default.yellow("No projects found for this team."));
     return;
   }
-  console.log();
-  if (prodEndpoint) console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(prodEndpoint)}`);
-  if (result.portal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(result.portal)}`);
-  if (apiKey) {
-    console.log();
-    console.log(`  ${import_chalk6.default.dim("API key:")}`);
-    console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
-  }
-  if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
-  const claimCode = result.claim_code || cred?.claim_code;
-  if (claimCode) {
-    console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} Everything you create`);
-    console.log(`    with the CP key shares ONE workspace. To keep it all in one shot:`);
-    console.log(`      ${import_chalk6.default.cyan("apiblaze login")}   ${import_chalk6.default.dim("(prompts to claim your workspace into your account)")}`);
-    console.log(import_chalk6.default.dim(`    From another machine: apiblaze claim ${claimCode}  (add --team <name> to merge into an existing team)`));
-  } else if (result.claim_url) {
-    console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
-    console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
+  const width = Math.max(...projects.map((p) => p.projectName.length));
+  for (const p of projects) {
+    console.log(`  ${import_chalk5.default.bold(p.projectName.padEnd(width))}   ${import_chalk5.default.dim("v" + p.apiVersion)}`);
   }
-  console.log();
+  console.log(import_chalk5.default.dim(`
+${projects.length} project${projects.length === 1 ? "" : "s"}`));
 }
 
+// src/index.ts
+init_create();
+
 // src/commands/claim.ts
 var import_chalk7 = __toESM(require("chalk"));
 init_auth();
@@ -2858,13 +2931,28 @@ var trailingComma = /\s*,\s*/;
 var parseList = (s) => s.split(trailingComma).map((x) => x.trim()).filter(Boolean);
 async function runTenantManage(query, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const slug = opts.tenant ?? loadCredentialsTenant(query) ?? await pickTenant(teamId, { message: "Manage which tenant?", initialQuery: query, allowCreate: true });
+  const slug = opts.tenant ?? await validScopedTenant(teamId, query) ?? await pickTenant(teamId, { message: "Manage which tenant?", initialQuery: query, allowCreate: true });
   if (!slug) return;
   await tenantHome(teamId, slug);
 }
-function loadCredentialsTenant(query) {
+async function validScopedTenant(teamId, query) {
   if (query) return void 0;
-  return loadCredentials()?.activeTenant ?? void 0;
+  const creds = loadCredentials();
+  const scoped = creds?.activeTenant;
+  if (!scoped) return void 0;
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants?q=${encodeURIComponent(scoped)}&limit=15`,
+    summary: `Verify tenant scope ${scoped}`
+  }).catch(() => null);
+  const names = (out?.tenants ?? []).map((t) => typeof t === "string" ? t : t.tenant_name);
+  if (names.includes(scoped)) return scoped;
+  const { saveCredentials: saveCredentials2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+  const next = { ...creds };
+  delete next.activeTenant;
+  saveCredentials2(next);
+  console.log(import_chalk24.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
+  return void 0;
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer2 } = await import("inquirer");
@@ -3078,10 +3166,20 @@ async function clientsMenu(teamId, tenant2, base) {
     }]);
     if (pick2 === " back") return;
     if (pick2 === " create") {
-      const projects = await getProjects(teamId).catch(() => []);
+      let projects = await getProjects(teamId).catch(() => []);
       if (!projects.length) {
-        console.log(import_chalk24.default.yellow("  No projects in this team \u2014 create a proxy first."));
-        continue;
+        console.log(import_chalk24.default.yellow("\n  An app client needs a proxy to derive its token identity (iss/aud), and this team has none yet."));
+        const { make } = await inquirer2.prompt([{
+          type: "confirm",
+          name: "make",
+          default: true,
+          message: "Create a proxy now (interactive)?"
+        }]);
+        if (!make) continue;
+        const { runCreate: runCreate2 } = await Promise.resolve().then(() => (init_create(), create_exports));
+        await runCreate2({});
+        projects = await getProjects(teamId).catch(() => []);
+        if (!projects.length) continue;
       }
       const a = await inquirer2.prompt([
         { type: "input", name: "name", message: "Client name:", validate: (s) => !!s.trim() || "required" },
@@ -3347,6 +3445,7 @@ init_auth();
 var import_chalk26 = __toESM(require("chalk"));
 init_admin();
 init_api();
+init_create();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -5050,16 +5149,25 @@ async function opCall(call) {
 function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
+  const ghosts = report?.ghosts ?? {};
   console.log(import_chalk33.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
   console.log(import_chalk33.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
   if (orphans.length === 0) console.log(import_chalk33.default.green("    no orphaned keys"));
   for (const o of orphans) console.log(`    ${import_chalk33.default.yellow(o.key)} ${import_chalk33.default.dim(`\u2014 ${o.reason}`)}`);
   console.log(import_chalk33.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (up.anon_wallet_detail) {
+    const d = up.anon_wallet_detail;
+    console.log(import_chalk33.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+  }
+  if (up.keyspace_census) {
+    const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
+    console.log(import_chalk33.default.dim(`    keyspace: ${census}`));
+  }
   if (up.unknown?.length) console.log(import_chalk33.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
   if (applied) console.log(`    ${import_chalk33.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
   for (const e of up.errors ?? []) console.log(import_chalk33.default.red(`    error: ${e}`));
-  console.log(import_chalk33.default.bold("\n  OpenFGA / Neon"));
+  console.log(import_chalk33.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
     if (swept.length === 0) console.log(import_chalk33.default.green("    no orphaned stores"));
@@ -5069,6 +5177,8 @@ function printResidue(report, applied) {
       );
     }
     if (fga?.remaining) console.log(import_chalk33.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    const st = fga?.side_tables;
+    if (st) console.log(import_chalk33.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
     if (fgaOrphans.length === 0) console.log(import_chalk33.default.green("    no orphaned stores"));
@@ -5077,8 +5187,26 @@ function printResidue(report, applied) {
       console.log(`    ${import_chalk33.default.yellow(s.store_id)} ${import_chalk33.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
     console.log(import_chalk33.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    const st = fga?.side_tables;
+    if (st) console.log(import_chalk33.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
   for (const e of fga?.errors ?? []) console.log(import_chalk33.default.red(`    error: ${e}`));
+  console.log(import_chalk33.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  if (applied) {
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk33.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk33.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk33.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+  } else {
+    const n = ghosts?.ghost_count ?? 0;
+    if (n === 0) console.log(import_chalk33.default.green(`    no ghost tuples ${import_chalk33.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    else {
+      console.log(import_chalk33.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
+        console.log(import_chalk33.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+      }
+      if (n > 20) console.log(import_chalk33.default.dim(`      \u2026 and ${n - 20} more`));
+    }
+  }
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk33.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
@@ -5096,8 +5224,9 @@ async function runOp(sub, opts = {}) {
       console.log(import_chalk33.default.bold("\nOperator menu"));
       console.log(`  ${import_chalk33.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
       console.log(`  ${import_chalk33.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk33.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk33.default.cyan("apiblaze op credits")}        list credit wallets
-`);
+      console.log(`  ${import_chalk33.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk33.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+`));
       return;
     }
     case "residue": {
@@ -5110,15 +5239,20 @@ async function runOp(sub, opts = {}) {
       const report = await opCall({ method: "GET", path: "/operator/external-residue", summary: "external residue report" });
       const nUp = report?.upstash?.orphans?.length ?? 0;
       const nFga = report?.fga?.orphans?.length ?? 0;
+      const nGhost = report?.ghosts?.ghost_count ?? 0;
+      const st = report?.fga?.side_tables ?? {};
+      const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
-      if (nUp + nFga === 0) {
+      if (nUp + nFga + nGhost + nSide === 0) {
         console.log(import_chalk33.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline2 = await import("readline/promises");
         const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
-        const answer = await rl.question(import_chalk33.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s)? Type 'sweep' to confirm: `));
+        const answer = await rl.question(
+          import_chalk33.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+        );
         rl.close();
         if (answer.trim() !== "sweep") return void console.log(import_chalk33.default.dim("Aborted."));
       }
@@ -5145,6 +5279,7 @@ async function runOp(sub, opts = {}) {
 
 // src/index.ts
 init_trace();
+init_auth();
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
 program.hook("preAction", () => {
@@ -5158,7 +5293,7 @@ function action(fn) {
       renderTrace();
     } catch (err) {
       renderTrace();
-      printError(err);
+      await printError(err);
       process.exit(1);
     }
   };
@@ -5167,7 +5302,7 @@ program.command("login").description("Authenticate with APIblaze").action(async
   try {
     await runLogin();
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5175,7 +5310,7 @@ program.command("create").description("Create a new API proxy (no login needed \
   try {
     await runCreate(opts);
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5200,7 +5335,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5213,7 +5348,7 @@ program.command("whoami").description("Show who you are \u2014 both API Producer
   try {
     await runWhoami(opts);
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5221,7 +5356,7 @@ program.command("claim").description("Claim your anonymous workspace into your a
   try {
     await runClaim(code, opts);
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5229,7 +5364,7 @@ program.command("team").description("Switch the active team").argument("[team]",
   try {
     await runTeam(team);
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5237,7 +5372,7 @@ program.command("projects").description("List the projects in your team").action
   try {
     await runProjects();
   } catch (err) {
-    printError(err);
+    await printError(err);
     process.exit(1);
   }
 });
@@ -5257,7 +5392,7 @@ var tenant = program.command("tenant").description("Manage tenants \u2014 bare c
 tenant.command("manage").description("Browse & edit one tenant: settings, login app clients, providers, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
 tenant.command("list").description("List tenants in your team (--q searches server-side)").option("--q <search>", "Filter by tenant name or display name").option("--limit <n>", "Page size (max 200)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
-tenant.command("create").description("Create a tenant in your team").requiredOption("--name <display>", "Display name").option("--slug <tenant_name>", "Explicit tenant slug (generated if omitted)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
+tenant.command("create").description("Create a tenant in your team (tenant names are lowercase alphanumeric and globally unique)").requiredOption("--name <name>", "Tenant name \u2014 becomes the slug ({name}.portal.apiblaze.com) unless --slug overrides; also the display label").option("--slug <tenant_name>", "Explicit tenant slug when it should differ from --name").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
@@ -5319,14 +5454,32 @@ Examples:
   $ npx apiblaze throttle myapi --rate 50 --verbose      # configure + show the API call
   $ npx apiblaze consumer login                          # act as a consumer of your API
 `);
-function printError(err) {
+async function recoverStaleTeam() {
+  try {
+    const creds = loadCredentials();
+    if (!creds?.teamId) return;
+    const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
+    const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
+    if (!linked) {
+      console.error(import_chalk34.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      return;
+    }
+    if (linked.teamId === creds.teamId) return;
+    const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
+    delete next.activeTenant;
+    saveCredentials(next);
+    console.error(import_chalk34.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk34.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+  } catch {
+  }
+}
+async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
     console.error(import_chalk34.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
-      console.error(import_chalk34.default.dim("If your team/tenant was recently deleted or recreated, re-run `apiblaze login` or switch with `apiblaze team`."));
+      await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
     console.error(import_chalk34.default.red(`