apiblaze 0.17.21 → 0.17.23

package/dist/index.js

@@ -572,7 +572,7 @@ async function createTenantInteractive(teamId) {
     type: "confirm",
     name: "users",
     default: false,
-    message: `Enable Users & groups? ${import_chalk23.default.dim(`(identity/key management at ${tenant2}.iam.apiblaze.com)`)}`
+    message: `Enable Users & groups? ${import_chalk23.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
   }]);
   if (users) {
     await admin({ method: "PATCH", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`, body: { enabled: true }, summary: "Enable Users & groups" }).catch(() => {
@@ -700,10 +700,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk38 = __toESM(require("chalk"));
+var import_chalk39 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.17.21";
+var version = "0.17.23";
 
 // src/index.ts
 init_types();
@@ -1385,9 +1385,9 @@ function printTunnelEndpoints(restore, targets) {
   if (restore.length === 0) return;
   console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
   for (const r of restore) {
-    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
+    const label3 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
     console.log(`
-  ${import_chalk4.default.bold(label2)}`);
+  ${import_chalk4.default.bold(label3)}`);
     const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
     const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
     for (const env of envs) {
@@ -2013,8 +2013,8 @@ async function runClaim(claimCodeArg, opts) {
   if (res.merged) {
     console.log(`  Merged ${import_chalk7.default.bold(String(res.proxy_count ?? ""))} prox${res.proxy_count === 1 ? "y" : "ies"} into team ${import_chalk7.default.bold(res.team_id)}.`);
   } else {
-    const label2 = res.team_name ? `\u201C${res.team_name}\u201D` : res.team_id;
-    console.log(`  It's now your team ${import_chalk7.default.bold(label2)}. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${res.team_id}`)}.`);
+    const label3 = res.team_name ? `\u201C${res.team_name}\u201D` : res.team_id;
+    console.log(`  It's now your team ${import_chalk7.default.bold(label3)}. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${res.team_id}`)}.`);
     console.log(import_chalk7.default.dim(`  (Tip: name it with --name, or --team <name> to merge into an existing team instead.)`));
   }
   console.log(`
@@ -3158,7 +3158,7 @@ Tenant ${tenant2}`));
       pageSize: 12,
       choices: [
         { name: `Login methods (${nLogin})  ${import_chalk26.default.dim("how your consumers sign in")}`, value: "login" },
-        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk26.default.dim(`identity & key management (${tenant2}.iam.apiblaze.com)`)}`, value: "iam" },
+        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk26.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
         { name: `Portal admins (${nEmails})  ${import_chalk26.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
         new inquirer3.Separator(import_chalk26.default.dim("  Settings")),
         { name: `CORS: ${cors?.cors ? import_chalk26.default.cyan(JSON.stringify(cors.cors)) : import_chalk26.default.dim("(unset)")}  ${import_chalk26.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
@@ -4224,9 +4224,9 @@ function printAll(proj2, cfg, json) {
   console.log(import_chalk30.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
-  for (const group of SETTING_GROUPS) {
-    console.log(import_chalk30.default.bold(group));
-    for (const s of SETTINGS.filter((x) => x.group === group)) {
+  for (const group2 of SETTING_GROUPS) {
+    console.log(import_chalk30.default.bold(group2));
+    for (const s of SETTINGS.filter((x) => x.group === group2)) {
       console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk30.default.dim(s.desc)}`);
     }
     console.log();
@@ -4335,14 +4335,14 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
     }
   }
 }
-async function settingsGroup(proj2, cfg, group) {
+async function settingsGroup(proj2, cfg, group2) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const items = SETTINGS.filter((s2) => s2.group === group);
+    const items = SETTINGS.filter((s2) => s2.group === group2);
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
-      message: group + ":",
+      message: group2 + ":",
       pageSize: 16,
       choices: [
         ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk30.default.dim(s2.desc)}`, value: s2 })),
@@ -4754,9 +4754,227 @@ async function agentsMenu(proj2, opts) {
   else await runMcp(proj2.projectName, proj2.apiVersion, {});
 }
 
-// src/commands/key.ts
+// src/commands/group.ts
 var import_chalk31 = __toESM(require("chalk"));
 var import_ora15 = __toESM(require("ora"));
+init_auth();
+init_admin();
+init_types();
+var DASHBOARD_BASE6 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+var IAM_BASE = process.env.APIBLAZE_IAM_BASE || "https://iam.apiblaze.com";
+async function resolveTransport(opts) {
+  const producer = loadCredentials();
+  if (producer) {
+    const { teamId } = await resolveTeam(void 0);
+    let tenant2 = (opts.tenant ?? "").trim().toLowerCase();
+    if (!tenant2) {
+      const out = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants`, summary: "List tenants" });
+      const tenants = (out?.tenants ?? []).map((t) => String(t.tenant_name ?? t.name ?? t)).filter((t) => !t.startsWith("op"));
+      if (tenants.length === 0) throw new Error("No tenants in your team yet. Create a proxy first, or pass --tenant.");
+      if (tenants.length === 1) tenant2 = tenants[0];
+      else {
+        const { default: inquirer3 } = await import("inquirer");
+        ({ tenant: tenant2 } = await inquirer3.prompt([{ type: "list", name: "tenant", message: "Which tenant?", choices: tenants }]));
+      }
+    }
+    const token = getAccessToken();
+    return {
+      tenant: tenant2,
+      call: async (path8, method = "GET", body) => {
+        const res = await fetch(`${DASHBOARD_BASE6}/api/cli/iam`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+          body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+        });
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
+        return data;
+      }
+    };
+  }
+  const consumer2 = loadConsumer();
+  if (consumer2) {
+    const fresh = await validConsumerToken(consumer2) ?? consumer2;
+    if (fresh !== consumer2) saveConsumer(fresh);
+    if (opts.tenant && opts.tenant.toLowerCase() !== fresh.tenant) {
+      throw new Error(`Your consumer login is for tenant "${fresh.tenant}". Log in to "${opts.tenant}" first (apiblaze consumer login --tenant ${opts.tenant}).`);
+    }
+    return {
+      tenant: fresh.tenant,
+      selfEmail: fresh.email,
+      call: async (path8, method = "GET", body) => {
+        const res = await fetch(`${IAM_BASE}${path8}`, {
+          method,
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${fresh.accessToken}`
+          },
+          ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+        });
+        if (res.status === 204) return {};
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) throw new ApiError(res.status, data?.error?.message ?? data?.details ?? data?.error ?? res.statusText, data);
+        return data;
+      }
+    };
+  }
+  throw new Error("Not authenticated. Producers: `apiblaze login`. Tenant admins: `apiblaze consumer login`.");
+}
+async function listGroups(t) {
+  const out = await t.call("/v1/admin/groups");
+  return out?.groups ?? [];
+}
+async function groupByName(t, name) {
+  const g = (await listGroups(t)).find((x) => x.name === name || x.id === name);
+  if (!g) throw new Error(`Group "${name}" not found. Run \`apiblaze group list\`.`);
+  return g;
+}
+async function listUsers(t) {
+  const out = await t.call("/v1/admin/users");
+  return out?.users ?? [];
+}
+async function userByRef(t, ref) {
+  const users = await listUsers(t);
+  const r = ref.toLowerCase();
+  const u = users.find((x) => x.abz_sub === ref || (x.email ?? "").toLowerCase() === r || (x.display_name ?? "").toLowerCase() === r);
+  if (!u) throw new Error(`User "${ref}" not found in tenant. Run \`apiblaze group users\` to see the directory (or provision them from Seen-in-traffic in the dashboard).`);
+  return u;
+}
+var label2 = (u) => u.display_name || u.email || u.abz_sub;
+async function runGroupList(opts) {
+  const t = await resolveTransport(opts);
+  const groups = await listGroups(t);
+  if (opts.json) return void console.log(JSON.stringify(groups));
+  if (!groups.length) return void console.log(import_chalk31.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk31.default.dim(`Tenant ${t.tenant}:`));
+  for (const g of groups) {
+    const sealed = g.name === "apiblaze_admins" ? import_chalk31.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk31.default.bold(g.name)}  ${import_chalk31.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+  }
+}
+async function runGroupCreate(name, opts) {
+  const t = await resolveTransport(opts);
+  let adminSub;
+  if (opts.admin) adminSub = (await userByRef(t, opts.admin)).abz_sub;
+  else {
+    const users = await listUsers(t);
+    if (t.selfEmail) adminSub = users.find((u) => (u.email ?? "").toLowerCase() === t.selfEmail.toLowerCase())?.abz_sub;
+    if (!adminSub) {
+      if (!users.length) throw new Error("The tenant has no users yet, and a group needs an initial group-admin. Add a user first (widget/portal login or Seen-in-traffic), or pass --admin <user>.");
+      if (users.length === 1) adminSub = users[0].abz_sub;
+      else {
+        const { default: inquirer3 } = await import("inquirer");
+        const { pick: pick2 } = await inquirer3.prompt([{
+          type: "list",
+          name: "pick",
+          message: `Initial group-admin for "${name}"?`,
+          choices: users.map((u) => ({ name: label2(u), value: u.abz_sub }))
+        }]);
+        adminSub = pick2;
+      }
+    }
+  }
+  const spinner = (0, import_ora15.default)(`Creating group ${name}...`).start();
+  try {
+    await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
+    spinner.succeed(`Group ${import_chalk31.default.bold(name)} created in ${t.tenant}.`);
+  } catch (e) {
+    spinner.fail("Create failed.");
+    throw e;
+  }
+}
+async function runGroupDelete(name, opts) {
+  const t = await resolveTransport(opts);
+  const g = await groupByName(t, name);
+  const spinner = (0, import_ora15.default)(`Deleting group ${name}...`).start();
+  try {
+    await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
+    spinner.succeed(`Group ${import_chalk31.default.bold(name)} deleted.`);
+  } catch (e) {
+    spinner.fail("Delete failed.");
+    throw e;
+  }
+}
+async function runGroupMembers(name, opts) {
+  const t = await resolveTransport(opts);
+  const g = await groupByName(t, name);
+  const detail = await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`);
+  const subs = await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/subgroups`);
+  if (opts.json) return void console.log(JSON.stringify({ ...detail, subgroups: subs?.subgroups ?? [] }));
+  const members = detail?.members ?? [];
+  console.log(import_chalk31.default.bold(`${g.name}`) + import_chalk31.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk31.default.cyan("group-admin") : import_chalk31.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk31.default.dim("  no members"));
+  const sg = subs?.subgroups ?? [];
+  if (sg.length) console.log(import_chalk31.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+}
+async function runGroupAddUser(userRef, groupName, opts) {
+  const t = await resolveTransport(opts);
+  const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
+  const role = opts.role === "admin" ? "admin" : "member";
+  const spinner = (0, import_ora15.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  try {
+    await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
+    spinner.succeed(`${import_chalk31.default.bold(label2(u))} added to ${import_chalk31.default.bold(g.name)} as ${role}.`);
+  } catch (e) {
+    spinner.fail("Add failed.");
+    throw e;
+  }
+}
+async function runGroupRemoveUser(userRef, groupName, opts) {
+  const t = await resolveTransport(opts);
+  const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
+  const spinner = (0, import_ora15.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  try {
+    await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
+    spinner.succeed(`${import_chalk31.default.bold(label2(u))} removed from ${import_chalk31.default.bold(g.name)}.`);
+  } catch (e) {
+    spinner.fail("Remove failed.");
+    throw e;
+  }
+}
+async function runGroupAddGroup(childName, parentName, opts) {
+  const t = await resolveTransport(opts);
+  const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
+  const spinner = (0, import_ora15.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  try {
+    await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
+    spinner.succeed(`${import_chalk31.default.bold(child.name)} is now a subgroup of ${import_chalk31.default.bold(parent.name)}.`);
+  } catch (e) {
+    spinner.fail("Nest failed.");
+    throw e;
+  }
+}
+async function runGroupRemoveGroup(childName, parentName, opts) {
+  const t = await resolveTransport(opts);
+  const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
+  const spinner = (0, import_ora15.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  try {
+    await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
+    spinner.succeed(`${import_chalk31.default.bold(child.name)} un-nested from ${import_chalk31.default.bold(parent.name)}.`);
+  } catch (e) {
+    spinner.fail("Un-nest failed.");
+    throw e;
+  }
+}
+async function runGroupUsers(opts) {
+  const t = await resolveTransport(opts);
+  const users = await listUsers(t);
+  const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
+  if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
+  console.log(import_chalk31.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk31.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk31.default.dim("  no users yet"));
+  const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
+  if (fresh.length) {
+    console.log(import_chalk31.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk31.default.dim(o.source_label ?? "")}`);
+  }
+}
+
+// src/commands/key.ts
+var import_chalk32 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
 init_admin();
 async function runApikeysMenu(opts) {
   await runKeyList(opts);
@@ -4784,11 +5002,11 @@ async function runKeyList(opts) {
     return;
   }
   if (!keys.length) {
-    console.log(import_chalk31.default.yellow("No developer keys."));
+    console.log(import_chalk32.default.yellow("No developer keys."));
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk31.default.bold(k.key_id ?? k.id)}  ${import_chalk31.default.dim(k.description ?? "")}  ${import_chalk31.default.dim(k.expires_at ?? "no expiry")}`);
+    console.log(`  ${import_chalk32.default.bold(k.key_id ?? k.id)}  ${import_chalk32.default.dim(k.description ?? "")}  ${import_chalk32.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
@@ -4796,7 +5014,7 @@ async function runKeyMint(opts) {
   const body = { role: "consumer-admin" };
   if (opts.desc) body.description = opts.desc;
   if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
-  const spinner = (0, import_ora15.default)("Minting key...").start();
+  const spinner = (0, import_ora16.default)("Minting key...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -4809,9 +5027,9 @@ async function runKeyMint(opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    console.log(`  ${import_chalk31.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk31.default.bold("key")}:     ${import_chalk31.default.green(out?.key)}  ${import_chalk31.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk31.default.dim("expires:")} ${out.expires_at}`);
+    console.log(`  ${import_chalk32.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk32.default.bold("key")}:     ${import_chalk32.default.green(out?.key)}  ${import_chalk32.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk32.default.dim("expires:")} ${out.expires_at}`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
@@ -4819,7 +5037,7 @@ async function runKeyMint(opts) {
 }
 async function runKeyRevoke(keyId, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora15.default)("Revoking key...").start();
+  const spinner = (0, import_ora16.default)("Revoking key...").start();
   try {
     await admin({
       method: "DELETE",
@@ -4837,8 +5055,8 @@ async function runKeyRevoke(keyId, opts) {
 var fs9 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk33 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_chalk34 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
 var import_yaml = require("yaml");
 init_auth();
 init_anon_cred();
@@ -4848,7 +5066,7 @@ init_admin();
 // src/commands/llm.ts
 var fs8 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
-var import_chalk32 = __toESM(require("chalk"));
+var import_chalk33 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_auth();
 var LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
@@ -4892,27 +5110,27 @@ async function runLlmSetKey(keyArg, opts) {
   }
   const existing = loadLlmConfig();
   saveLlmConfig({ key, provider, model: opts.model ?? existing?.model });
-  console.log(`${import_chalk32.default.green("\u2713")} Saved ${import_chalk32.default.bold(provider)} key ${maskSecret(key)}`);
-  console.log(import_chalk32.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
-  if (opts.model) console.log(import_chalk32.default.gray(`  Model: ${opts.model}`));
+  console.log(`${import_chalk33.default.green("\u2713")} Saved ${import_chalk33.default.bold(provider)} key ${maskSecret(key)}`);
+  console.log(import_chalk33.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
+  if (opts.model) console.log(import_chalk33.default.gray(`  Model: ${opts.model}`));
 }
 async function runLlmShow() {
   const cfg = loadLlmConfig();
   if (!cfg) {
-    console.log(import_chalk32.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
+    console.log(import_chalk33.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
     return;
   }
-  console.log(`Provider: ${import_chalk32.default.bold(cfg.provider)}`);
+  console.log(`Provider: ${import_chalk33.default.bold(cfg.provider)}`);
   console.log(`Key:      ${maskSecret(cfg.key)}`);
   if (cfg.model) console.log(`Model:    ${cfg.model}`);
-  console.log(import_chalk32.default.gray(`Stored at ${LLM_PATH}`));
+  console.log(import_chalk33.default.gray(`Stored at ${LLM_PATH}`));
 }
 async function runLlmClearKey() {
   try {
     fs8.unlinkSync(LLM_PATH);
-    console.log(`${import_chalk32.default.green("\u2713")} Removed local LLM key.`);
+    console.log(`${import_chalk33.default.green("\u2713")} Removed local LLM key.`);
   } catch {
-    console.log(import_chalk32.default.gray("No LLM key was set."));
+    console.log(import_chalk33.default.gray("No LLM key was set."));
   }
 }
 
@@ -4920,9 +5138,9 @@ async function runLlmClearKey() {
 init_trace();
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk33.default.red(`
+  console.error(import_chalk34.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk33.default.dim(hint));
+  if (hint) console.error(import_chalk34.default.dim(hint));
   process.exit(1);
 }
 function normalizeName2(raw) {
@@ -5070,7 +5288,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk33.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk34.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -5147,7 +5365,7 @@ async function provision(spec2, target, opts) {
   if (!base && spec2.info && typeof spec2.info.title === "string") base = normalizeName2(spec2.info.title);
   if (!base || base.length < 3) base = "apichat";
   let name = opts.name ? base : `${base}${salt()}`;
-  const spinner = (0, import_ora16.default)("Provisioning an api_key proxy...").start();
+  const spinner = (0, import_ora17.default)("Provisioning an api_key proxy...").start();
   let result;
   for (let attempt = 0; attempt < 4; attempt++) {
     try {
@@ -5227,7 +5445,7 @@ async function provision(spec2, target, opts) {
   return { projectId, version: version2, environment, dpKey, mcpHost, proxyUrl, anon };
 }
 async function writeTargetAuth(p, auth, secret) {
-  const spinner = (0, import_ora16.default)("Storing target credentials (encrypted)...").start();
+  const spinner = (0, import_ora17.default)("Storing target credentials (encrypted)...").start();
   try {
     await cpPost(
       p.anon,
@@ -5249,7 +5467,7 @@ async function writeTargetAuth(p, auth, secret) {
   }
 }
 async function uploadSpec(p, specText, opts) {
-  const spinner = (0, import_ora16.default)("Uploading the spec...").start();
+  const spinner = (0, import_ora17.default)("Uploading the spec...").start();
   let out;
   try {
     out = await cpPost(
@@ -5264,7 +5482,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk33.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk34.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -5272,12 +5490,12 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk33.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk34.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
 async function publishMcp(p, spec2) {
-  const spinner = (0, import_ora16.default)("Publishing the MCP catalogue...").start();
+  const spinner = (0, import_ora17.default)("Publishing the MCP catalogue...").start();
   try {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
@@ -5313,14 +5531,14 @@ var revealAuth = false;
 function renderToolEvents(events, dpKey) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk33.default.green("\u2713") : import_chalk33.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk33.default.cyan(e.name)} ${import_chalk33.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
+    const mark = ok ? import_chalk34.default.green("\u2713") : import_chalk34.default.red("\u2717");
+    console.log(`  ${mark} ${import_chalk34.default.cyan(e.name)} ${import_chalk34.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk33.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
+      console.log(import_chalk34.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
       if (dpKey) {
         const keyLine = `        -H 'X-API-Key: ${revealAuth ? dpKey : maskKey(dpKey)}'`;
-        const hint = revealAuth ? "" : import_chalk33.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk33.default.dim(keyLine) + hint);
+        const hint = revealAuth ? "" : import_chalk34.default.yellow("  \u2190 /showauth will reveal this");
+        console.log(import_chalk34.default.dim(keyLine) + hint);
       }
     }
   }
@@ -5328,9 +5546,9 @@ function renderToolEvents(events, dpKey) {
 function billingLine(billing) {
   if (!billing || typeof billing.cents !== "number") return null;
   const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk33.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk33.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
+  let line = import_chalk34.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk34.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
   if (typeof billing.credits_remaining === "number") {
-    line += import_chalk33.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk34.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -5339,14 +5557,14 @@ function freeBudgetWarning(billing, anon) {
   const perTurn = Math.max(billing.cents || 0, 0.02);
   const left = Math.floor(billing.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk33.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk33.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk34.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk34.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 function printAssistant(delta) {
   for (let i = delta.length - 1; i >= 0; i--) {
     const m = delta[i];
     if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk33.default.green("assistant \u203A ") + m.content + "\n");
+      console.log("\n" + import_chalk34.default.green("assistant \u203A ") + m.content + "\n");
       return;
     }
   }
@@ -5356,7 +5574,7 @@ async function replTurn(p, messages, userText) {
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
   for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora16.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
+    const spinner = (0, import_ora17.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
     const body = {
       turn_id: turnId,
       messages,
@@ -5372,7 +5590,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk33.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk34.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     let data = null;
@@ -5390,12 +5608,12 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (res.status === 401) {
-      console.log(import_chalk33.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
+      console.log(import_chalk34.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
       return;
     }
     if (!res.ok || !data) {
       const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk33.default.red(`  Chat error: ${err}`));
+      console.log(import_chalk34.default.red(`  Chat error: ${err}`));
       return;
     }
     if (Array.isArray(data.delta)) {
@@ -5409,19 +5627,25 @@ async function replTurn(p, messages, userText) {
     if (warn) console.log(warn);
     if (!data.continue) return;
   }
-  console.log(import_chalk33.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
+  console.log(import_chalk34.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
 }
 function renderUpsell(p, upsell) {
   const loggedIn = !!loadCredentials();
-  console.log("\n" + import_chalk33.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  if (upsell.reason === "CAPPED" && !loggedIn) {
+    console.log("\n" + import_chalk34.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk34.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log();
+    return;
+  }
+  console.log("\n" + import_chalk34.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "PAUSED") {
     if (!loggedIn) {
-      console.log(import_chalk33.default.dim("  Options: `/login` for free login credit and higher limits, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk34.default.dim("  Options: `/login` for free login credit and higher limits, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk33.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk34.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk33.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk34.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
@@ -5490,9 +5714,9 @@ async function openServerProxy(project) {
   const prior = loadApichats().find((a) => a.projectId === project.projectId && a.dpKey);
   let dpKey = prior?.dpKey;
   if (!dpKey) {
-    console.log(import_chalk33.default.dim(`  Minting an API key for tenant ${import_chalk33.default.bold(tenant2)} to query project ${import_chalk33.default.bold(project.projectName)}\u2026`));
+    console.log(import_chalk34.default.dim(`  Minting an API key for tenant ${import_chalk34.default.bold(tenant2)} to query project ${import_chalk34.default.bold(project.projectName)}\u2026`));
     dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-    console.log(`  ${import_chalk33.default.green("\u2714")} API key: ${import_chalk33.default.dim(maskKey(dpKey))}`);
+    console.log(`  ${import_chalk34.default.green("\u2714")} API key: ${import_chalk34.default.dim(maskKey(dpKey))}`);
   }
   const p = {
     projectId: project.projectId,
@@ -5503,7 +5727,7 @@ async function openServerProxy(project) {
     proxyUrl: `https://${project.projectId}.abz.run/${version2}/${environment}`,
     anon: false
   };
-  const spinner = (0, import_ora16.default)("Preparing the chat\u2026").start();
+  const spinner = (0, import_ora17.default)("Preparing the chat\u2026").start();
   try {
     const raw = await admin({
       method: "GET",
@@ -5515,7 +5739,7 @@ async function openServerProxy(project) {
     if (spec2 && (spec2.paths || spec2.openapi)) {
       await publishMcp(p, spec2);
     } else {
-      console.log(import_chalk33.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk34.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -5568,7 +5792,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk33.default.bold(a.name)} ${import_chalk33.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk34.default.bold(a.name)} ${import_chalk34.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -5578,14 +5802,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk33.default.bold(pr.projectName)} ${import_chalk33.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk34.default.bold(pr.projectName)} ${import_chalk34.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk33.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk34.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -5657,31 +5881,31 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk33.default.cyan.bold("Chat with your API") + import_chalk33.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk33.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk34.default.cyan.bold("Chat with your API") + import_chalk34.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk34.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk33.default.dim(
+    import_chalk34.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for credit \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk33.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk34.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk33.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk34.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk33.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk34.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       if (!loadCredentials()) {
-        console.log(import_chalk33.default.yellow("  Log in first: `/login`, then `/claim`."));
+        console.log(import_chalk34.default.yellow("  Log in first: `/login`, then `/claim`."));
         continue;
       }
       try {
@@ -5690,30 +5914,30 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk33.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk34.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk33.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk34.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk33.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk34.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk33.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk34.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk33.default.dim("\nBye."));
+  console.log(import_chalk34.default.dim("\nBye."));
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk33.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk34.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -5726,7 +5950,7 @@ async function runApichat(opts) {
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk33.default.dim("Target:")} ${import_chalk33.default.bold(target)}`);
+  console.log(`  ${import_chalk34.default.dim("Target:")} ${import_chalk34.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -5735,7 +5959,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk33.default.dim("Proxy: ")} ${import_chalk33.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk34.default.dim("Proxy: ")} ${import_chalk34.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -5754,23 +5978,23 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk33.default.dim("  Target auth: none required."));
+    console.log(import_chalk34.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk33.default.green("\u2713")} proxy  ${import_chalk33.default.bold(p.proxyUrl)}`);
-  if (mcpUrl) console.log(`  ${import_chalk33.default.green("\u2713")} mcp    ${import_chalk33.default.bold(mcpUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk34.default.green("\u2713")} proxy  ${import_chalk34.default.bold(p.proxyUrl)}`);
+  if (mcpUrl) console.log(`  ${import_chalk34.default.green("\u2713")} mcp    ${import_chalk34.default.bold(mcpUrl)}`);
   if (p.anon) {
-    console.log(import_chalk33.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat (after /login) to keep it beyond 30 days."));
+    console.log(import_chalk34.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat (after /login) to keep it beyond 30 days."));
   }
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk34 = __toESM(require("chalk"));
-var import_ora17 = __toESM(require("ora"));
+var import_chalk35 = __toESM(require("chalk"));
+var import_ora18 = __toESM(require("ora"));
 init_admin();
 var DEFAULT_SCOPE = "openid email profile offline_access";
 var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
@@ -5790,7 +6014,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk34.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk35.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -5801,7 +6025,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk34.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk35.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -5813,25 +6037,25 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora17.default)("Finding the login app...").start();
+    const s2 = (0, import_ora18.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk34.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk35.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk34.default.cyan("\u2192")} Logging in to ${import_chalk34.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk35.default.cyan("\u2192")} Logging in to ${import_chalk35.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk34.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk34.default.bold(userCode)}
+  Open: ${import_chalk35.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk35.default.bold(userCode)}
 `);
-    console.log(import_chalk34.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk35.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -5846,7 +6070,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk34.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk35.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -5859,29 +6083,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk34.default.cyan("Consumer")} ${import_chalk34.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk34.default.bold(fresh.tenant)}
+  console.log(`${import_chalk35.default.cyan("Consumer")} ${import_chalk35.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk35.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk34.default.bold("access_token")}  ${import_chalk34.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk35.default.bold("access_token")}  ${import_chalk35.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk34.default.bold("id_token")}      ${import_chalk34.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk35.default.bold("id_token")}      ${import_chalk35.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk34.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk35.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk34.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk35.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora17.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora18.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk34.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk34.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk35.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk35.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -5889,16 +6113,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk34.default.yellow("No API keys yet."));
+    console.log(import_chalk35.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk34.default.green(clear) : import_chalk34.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk34.default.dim(`exp ${k.expires_at}`) : import_chalk34.default.dim("no expiry");
-      console.log(`  ${import_chalk34.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk34.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk35.default.green(clear) : import_chalk35.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk35.default.dim(`exp ${k.expires_at}`) : import_chalk35.default.dim("no expiry");
+      console.log(`  ${import_chalk35.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk35.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk34.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk35.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -5912,7 +6136,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora17.default)("Creating key...").start();
+  const s2 = (0, import_ora18.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -5920,13 +6144,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk34.default.green(key)}  ${import_chalk34.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk34.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk35.default.green(key)}  ${import_chalk35.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk35.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk35 = __toESM(require("chalk"));
-var import_ora18 = __toESM(require("ora"));
+var import_chalk36 = __toESM(require("chalk"));
+var import_ora19 = __toESM(require("ora"));
 var fs10 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_admin();
@@ -5967,18 +6191,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk35.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk36.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs10.existsSync(path7.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora18.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora19.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk35.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk35.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk36.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk36.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -6117,7 +6341,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora18.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora19.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -6129,29 +6353,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk35.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk35.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk36.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk36.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk35.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk36.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk35.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk35.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk36.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk36.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk35.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk36.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk35.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk35.default.cyan("apiblaze login")}  then  ${import_chalk35.default.cyan("apiblaze claim")}   ${import_chalk35.default.dim("(no code needed here)")}`);
-  console.log(import_chalk35.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk36.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk36.default.cyan("apiblaze login")}  then  ${import_chalk36.default.cyan("apiblaze claim")}   ${import_chalk36.default.dim("(no code needed here)")}`);
+  console.log(import_chalk36.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path7.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk35.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk36.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -6162,10 +6386,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk35.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk35.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk36.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk36.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk35.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk36.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -6174,7 +6398,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora18.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora19.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -6188,39 +6412,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk35.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk36.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk35.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk36.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk35.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk36.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk35.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk36.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk35.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk35.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk35.default.bold("candidates")} \u2014 list them:  ${import_chalk35.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk35.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk36.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk36.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk36.default.bold("candidates")} \u2014 list them:  ${import_chalk36.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk36.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk35.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk35.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk36.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk36.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk35.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk35.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk35.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk36.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk36.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk36.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk35.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk35.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk36.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk36.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk36 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_chalk37 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 init_admin();
 init_auth();
 init_anon_cred();
@@ -6229,7 +6453,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk36.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk37.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -6247,30 +6471,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk36.default.bold(`
+  console.log(import_chalk37.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk36.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk36.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk36.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk36.default.bold(`
+  if (!routed.length) console.log(import_chalk37.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk37.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk37.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk37.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk36.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk37.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk36.default.yellow("\u25CB")} ${c.origin}  ${import_chalk36.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk37.default.yellow("\u25CB")} ${c.origin}  ${import_chalk37.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk36.default.dim(`
+    console.log(import_chalk37.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk36.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk37.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk36.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk37.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora19.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora20.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -6281,7 +6505,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora19.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora20.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -6298,7 +6522,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora19.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora20.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -6309,7 +6533,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora19.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora20.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -6320,19 +6544,19 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk37 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
 var OPERATOR_EMAILS = /* @__PURE__ */ new Set(["julienpmjacquet@gmail.com", "chkev@umich.edu"]);
-var DASHBOARD_BASE6 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+var DASHBOARD_BASE7 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 function isOperatorLogin() {
   const email = loadCredentials()?.email?.toLowerCase();
   return !!email && OPERATOR_EMAILS.has(email);
 }
 async function opCall(call) {
   const token = getAccessToken();
-  const res = await fetch(`${DASHBOARD_BASE6}/api/cli/op`, {
+  const res = await fetch(`${DASHBOARD_BASE7}/api/cli/op`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
     body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
@@ -6353,82 +6577,82 @@ function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk37.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk37.default.bold("\n  Upstash"));
+  console.log(import_chalk38.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk38.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk37.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk37.default.yellow(o.key)} ${import_chalk37.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk37.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk38.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk38.default.yellow(o.key)} ${import_chalk38.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk38.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk37.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk38.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk37.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk38.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk37.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk37.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk37.default.red(`    error: ${e}`));
-  console.log(import_chalk37.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk38.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk38.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk38.default.red(`    error: ${e}`));
+  console.log(import_chalk38.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk37.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk38.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk37.default.yellow(s.store_id)} ${import_chalk37.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk38.default.yellow(s.store_id)} ${import_chalk38.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk37.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk38.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk37.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk38.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk37.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk38.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk37.default.yellow(s.store_id)} ${import_chalk37.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk38.default.yellow(s.store_id)} ${import_chalk38.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk37.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk38.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk37.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk38.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk37.default.red(`    error: ${e}`));
-  console.log(import_chalk37.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk38.default.red(`    error: ${e}`));
+  console.log(import_chalk38.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk37.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk37.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk37.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk38.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk38.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk38.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk37.default.green(`    no ghost tuples ${import_chalk37.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk38.default.green(`    no ghost tuples ${import_chalk38.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk37.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk38.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk37.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk38.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk37.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk38.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk37.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk38.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk37.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk38.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk37.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk38.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk37.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk37.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk37.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk37.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk37.default.cyan("apiblaze op credits")}        list credit wallets`);
-      console.log(import_chalk37.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+      console.log(import_chalk38.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk38.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk38.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk38.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk38.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk38.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
 `));
       return;
     }
@@ -6447,17 +6671,17 @@ async function runOp(sub, opts = {}) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk37.default.green("Nothing to sweep."));
+        console.log(import_chalk38.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline2 = await import("readline/promises");
         const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk37.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk38.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk37.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk38.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -6468,15 +6692,15 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk37.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk38.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk37.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk37.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk37.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk38.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk38.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk38.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk37.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk38.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -6538,7 +6762,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk38.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk39.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -6597,6 +6821,16 @@ domain.command("list").description("List custom domains for a proxy").argument("
 domain.command("status").description("Check a custom domain's validation status").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
 domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
 domain.command("set-base").description("Choose which version/environment your main URL serves").argument("<project>", "Project name or id").option("--env <env>", "Environment (default: prod)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainSetBase(project, opts)));
+var group = program.command("group").description("Manage a tenant's users & groups \u2014 bare command lists groups").action(action(() => runGroupList({})));
+group.command("list").description("List groups").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((opts) => runGroupList(opts)));
+group.command("create").description("Create a group (e.g. `group create admin`)").argument("<name>", "Group name").option("--admin <user>", "Initial group-admin (email, name, or user id)").option("--tenant <slug>", "Tenant").action(action((name, opts) => runGroupCreate(name, opts)));
+group.command("delete").description("Delete a group").argument("<name>", "Group name").option("--tenant <slug>", "Tenant").action(action((name, opts) => runGroupDelete(name, opts)));
+group.command("members").description("Show a group's members and subgroups").argument("<name>", "Group name").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((name, opts) => runGroupMembers(name, opts)));
+group.command("add-user").description("Add a user to a group (e.g. `group add-user john admin`)").argument("<user>", "User (email, name, or user id)").argument("<group>", "Group name").option("--role <role>", "member | admin (group-admin)", "member").option("--tenant <slug>", "Tenant").action(action((user, grp, opts) => runGroupAddUser(user, grp, opts)));
+group.command("remove-user").description("Remove a user from a group").argument("<user>", "User (email, name, or user id)").argument("<group>", "Group name").option("--tenant <slug>", "Tenant").action(action((user, grp, opts) => runGroupRemoveUser(user, grp, opts)));
+group.command("add-group").description("Nest a group inside another (e.g. `group add-group reservationists admin`)").argument("<child>", "Child group name").argument("<parent>", "Parent group name").option("--tenant <slug>", "Tenant").action(action((child, parent, opts) => runGroupAddGroup(child, parent, opts)));
+group.command("remove-group").description("Un-nest a subgroup from its parent").argument("<child>", "Child group name").argument("<parent>", "Parent group name").option("--tenant <slug>", "Tenant").action(action((child, parent, opts) => runGroupRemoveGroup(child, parent, opts)));
+group.command("users").description("List the tenant user directory + identities seen in traffic").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((opts) => runGroupUsers(opts)));
 var tenant = program.command("tenant").description("Manage tenants \u2014 bare command opens the interactive picker (settings, app clients, providers)").action(action(() => runTenantManage(void 0, {})));
 tenant.command("manage").description("Browse & edit one tenant: settings, login app clients, providers, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
@@ -6618,7 +6852,7 @@ spec.command("set").description("Replace the stored OpenAPI spec from a local fi
 var HELP_GROUPS = [
   { title: "Chat", commands: ["apichat", "agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
-  { title: "Control plane commands", commands: ["config", "projects", "tenant", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" }
@@ -6637,7 +6871,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk38.default.bold(g.title)}
+    return `${import_chalk39.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -6671,14 +6905,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk38.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk39.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk38.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk38.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk39.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk39.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -6686,16 +6920,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk38.default.red(`
+    console.error(import_chalk39.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk38.default.red(`
+    console.error(import_chalk39.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk38.default.red("\nUnknown error"));
+    console.error(import_chalk39.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);