apiblaze 0.18.8 → 0.19.0

package/dist/index.js

@@ -393,32 +393,32 @@ function maskBody(body) {
 }
 function renderTrace() {
   if (!verbose || entries.length === 0) return;
-  console.log(import_chalk12.default.dim("\n" + "\u2500".repeat(64)));
-  console.log(import_chalk12.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
+  console.log(import_chalk6.default.dim("\n" + "\u2500".repeat(64)));
+  console.log(import_chalk6.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
   console.log(
-    import_chalk12.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
+    import_chalk6.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
   );
   entries.forEach((e, i) => {
-    const n = entries.length > 1 ? import_chalk12.default.bold(`${i + 1}. `) : "";
-    if (e.summary) console.log(`${n}${import_chalk12.default.cyan(e.summary)}${e.status ? import_chalk12.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    const n = entries.length > 1 ? import_chalk6.default.bold(`${i + 1}. `) : "";
+    if (e.summary) console.log(`${n}${import_chalk6.default.cyan(e.summary)}${e.status ? import_chalk6.default.dim(`  (HTTP ${e.status})`) : ""}`);
     const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
     const masked = maskBody(e.body);
     const hasBody = e.method !== "GET" && masked !== void 0;
-    console.log(import_chalk12.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
-    console.log(import_chalk12.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
+    console.log(import_chalk6.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.log(import_chalk6.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
     if (hasBody) {
-      console.log(import_chalk12.default.green("    -H 'Content-Type: application/json' \\"));
-      console.log(import_chalk12.default.green(`    -d '${masked}'`));
+      console.log(import_chalk6.default.green("    -H 'Content-Type: application/json' \\"));
+      console.log(import_chalk6.default.green(`    -d '${masked}'`));
     }
     if (i < entries.length - 1) console.log();
   });
   entries.length = 0;
 }
-var import_chalk12, CONTROL_API_VERSION, verbose, entries, SECRET_KEY;
+var import_chalk6, CONTROL_API_VERSION, verbose, entries, SECRET_KEY;
 var init_trace = __esm({
   "src/lib/trace.ts"() {
     "use strict";
-    import_chalk12 = __toESM(require("chalk"));
+    import_chalk6 = __toESM(require("chalk"));
     CONTROL_API_VERSION = "1.0.0";
     verbose = false;
     entries = [];
@@ -459,13 +459,13 @@ function formatBilling(billing) {
 }
 function maybePrintBilling(data) {
   const line = formatBilling(data?.billing);
-  if (line) console.log(import_chalk13.default.magenta(`  ${line}`));
+  if (line) console.log(import_chalk7.default.magenta(`  ${line}`));
 }
-var import_chalk13, DASHBOARD_BASE3;
+var import_chalk7, DASHBOARD_BASE3;
 var init_admin = __esm({
   "src/lib/admin.ts"() {
     "use strict";
-    import_chalk13 = __toESM(require("chalk"));
+    import_chalk7 = __toESM(require("chalk"));
     init_auth();
     init_trace();
     init_types();
@@ -473,6 +473,233 @@ var init_admin = __esm({
   }
 });
 
+// src/lib/resolve.ts
+function requireAuth() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error(import_chalk8.default.red("Not logged in. Run `apiblaze login` first."));
+    process.exit(1);
+  }
+  return creds;
+}
+async function resolveTeam(opt) {
+  const creds = requireAuth();
+  if (!opt) {
+    if (!creds.teamId) {
+      console.error(import_chalk8.default.red("No active team. Run `apiblaze login` or pass --team."));
+      process.exit(1);
+    }
+    return { teamId: creds.teamId, teamName: creds.teamName };
+  }
+  if (opt.startsWith("team_")) return { teamId: opt };
+  const teams = await getTeams().catch(() => []);
+  const match = teams.find((t) => t.name === opt || t.teamId === opt);
+  if (!match) {
+    console.error(import_chalk8.default.red(`Team "${opt}" not found.${teams.length ? " Available: " + teams.map((t) => t.name).join(", ") : ""}`));
+    process.exit(1);
+  }
+  return { teamId: match.teamId, teamName: match.name };
+}
+async function resolveProject(teamId, nameOrId, version2) {
+  const projects = await getProjects(teamId).catch(() => []);
+  const candidates = projects.filter(
+    (p) => p.projectId === nameOrId || p.projectName === nameOrId
+  );
+  if (candidates.length === 0) {
+    console.error(import_chalk8.default.red(`Project "${nameOrId}" not found in this team.`));
+    if (projects.length) console.error(import_chalk8.default.dim("  Known: " + projects.map((p) => p.projectName).join(", ")));
+    process.exit(1);
+  }
+  const chosen = version2 ? candidates.find((p) => p.apiVersion === version2) : candidates[0];
+  if (!chosen) {
+    console.error(import_chalk8.default.red(`Project "${nameOrId}" has no version ${version2}. Versions: ${candidates.map((p) => p.apiVersion).join(", ")}`));
+    process.exit(1);
+  }
+  return {
+    projectId: chosen.projectId,
+    projectName: chosen.projectName,
+    apiVersion: chosen.apiVersion,
+    teamId,
+    tenant: chosen.tenant
+  };
+}
+var import_chalk8;
+var init_resolve = __esm({
+  "src/lib/resolve.ts"() {
+    "use strict";
+    import_chalk8 = __toESM(require("chalk"));
+    init_auth();
+    init_api();
+  }
+});
+
+// src/lib/caller.ts
+function resolveCaller() {
+  const creds = loadCredentials();
+  if (creds && Date.now() < creds.expiresAt) return { mode: "session" };
+  const anon = loadAnonCred();
+  if (anon?.cp_key) return { mode: "anon", cpKey: anon.cp_key, teamId: anon.team_id };
+  return null;
+}
+function requireCaller() {
+  const caller = resolveCaller();
+  if (!caller) {
+    throw new Error(
+      "No credential. Run `apiblaze login`, or `apiblaze create` first (an anonymous workspace works too \u2014 its key drives these commands until you claim it)."
+    );
+  }
+  return caller;
+}
+async function resolveActingTeam(caller, optTeam) {
+  if (caller.mode === "anon") {
+    if (optTeam && optTeam !== caller.teamId) {
+      throw new Error(
+        `--team is not available in an anonymous workspace (your team is ${caller.teamId}). Run \`apiblaze login\` to act on other teams.`
+      );
+    }
+    return { teamId: caller.teamId };
+  }
+  return resolveTeam(optTeam);
+}
+async function producer(caller, call) {
+  if (caller.mode === "session") return admin(call);
+  const out = await cpFetch(caller.cpKey, call.path, {
+    method: call.method,
+    ...call.body !== void 0 ? { body: JSON.stringify(call.body) } : {}
+  });
+  recordCall({ method: call.method, path: call.path, body: call.body, status: 200, summary: call.summary });
+  return out;
+}
+async function resolveProjectVia(caller, teamId, nameOrId, version2) {
+  const out = await producer(caller, {
+    method: "GET",
+    path: `/projects?team_id=${encodeURIComponent(teamId)}`,
+    summary: `List projects for ${teamId}`
+  });
+  const rows = out?.projects ?? [];
+  const candidates = rows.filter((r) => r.project_id === nameOrId || r.project_name === nameOrId);
+  if (!candidates.length) {
+    throw new Error(
+      `Project "${nameOrId}" not found in this team.` + (rows.length ? ` Known: ${rows.map((r) => r.project_name).join(", ")}` : "")
+    );
+  }
+  const chosen = version2 ? candidates.find((r) => r.api_version === version2) : candidates[0];
+  if (!chosen) {
+    throw new Error(
+      `Project "${nameOrId}" has no version ${version2}. Versions: ${candidates.map((r) => r.api_version).join(", ")}`
+    );
+  }
+  return {
+    projectId: chosen.project_id,
+    projectName: chosen.project_name,
+    apiVersion: chosen.api_version,
+    teamId,
+    tenant: chosen.tenant ?? chosen.config?.tenant
+  };
+}
+var init_caller = __esm({
+  "src/lib/caller.ts"() {
+    "use strict";
+    init_auth();
+    init_anon_cred();
+    init_admin();
+    init_trace();
+    init_resolve();
+  }
+});
+
+// src/commands/iam.ts
+var iam_exports = {};
+__export(iam_exports, {
+  runIamToggle: () => runIamToggle,
+  runIdentifiedToggle: () => runIdentifiedToggle
+});
+async function runIamToggle(project, state, opts) {
+  if (state !== "on" && state !== "off") {
+    throw new Error(`Invalid state "${state}". Use: apiblaze iam <project> on|off`);
+  }
+  const enabled = state === "on";
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const tenant2 = opts.tenant ?? proj2.tenant;
+  if (!tenant2) {
+    throw new Error("Could not resolve the tenant for this project. Pass --tenant <name>.");
+  }
+  const spinner = (0, import_ora4.default)(`Turning IAM ${state} for tenant ${tenant2}...`).start();
+  try {
+    const out = await producer(caller, {
+      method: "PATCH",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`,
+      body: { iam_enabled: enabled },
+      summary: `IAM ${state} for tenant ${tenant2}`
+    });
+    spinner.succeed(`IAM is ${import_chalk9.default.bold(state)} for tenant ${tenant2}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { iam_enabled: enabled }));
+    else if (enabled) {
+      console.log(import_chalk9.default.dim("  Groups now apply to identified calls. Identify callers with"));
+      console.log(import_chalk9.default.dim("  X-End-User-Id, a login token, or per-user keys \u2014 and consider"));
+      console.log(import_chalk9.default.dim(`  \`apiblaze identified ${project} require\` to reject unattributed traffic.`));
+    }
+  } catch (err) {
+    spinner.fail(`IAM ${state} failed.`);
+    throw err;
+  }
+}
+async function runIdentifiedToggle(project, mode, opts) {
+  if (mode !== "require" && mode !== "allow-anon") {
+    throw new Error(`Invalid mode "${mode}". Use: apiblaze identified <project> require|allow-anon`);
+  }
+  const require2 = mode === "require";
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const spinner = (0, import_ora4.default)(
+    require2 ? "Requiring identified traffic..." : "Allowing unattributed traffic..."
+  ).start();
+  try {
+    const listing = await producer(caller, {
+      method: "GET",
+      path: `/projects?team_id=${encodeURIComponent(teamId)}`,
+      summary: `Read settings for ${proj2.projectName}`
+    });
+    const row = (listing?.projects ?? []).find(
+      (r) => r.project_id === proj2.projectId && r.api_version === proj2.apiVersion
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    ) ?? (listing?.projects ?? []).find((r) => r.project_id === proj2.projectId);
+    const current = row?.config?.requests_policy ?? {};
+    const merged = {
+      mode: current.mode ?? "passthrough",
+      methods: current.methods?.length ? current.methods : ["api_key"],
+      ...current,
+      identified_traffic_only: require2,
+      require_x_end_user_id: require2
+    };
+    const out = await producer(caller, {
+      method: "PATCH",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
+      body: { requests_policy: merged },
+      summary: `Set identified-traffic policy (${mode}) on ${proj2.projectName}`
+    });
+    spinner.succeed(
+      require2 ? `${proj2.projectName} now rejects calls that don't identify an end user.` : `${proj2.projectName} accepts unattributed calls again (they pass with no groups).`
+    );
+    if (opts.json) console.log(JSON.stringify(out ?? { identified_traffic_only: require2 }));
+  } catch (err) {
+    spinner.fail("Policy update failed.");
+    throw err;
+  }
+}
+var import_chalk9, import_ora4;
+var init_iam = __esm({
+  "src/commands/iam.ts"() {
+    "use strict";
+    import_chalk9 = __toESM(require("chalk"));
+    import_ora4 = __toESM(require("ora"));
+    init_caller();
+  }
+});
+
 // src/lib/tenant-create.ts
 var tenant_create_exports = {};
 __export(tenant_create_exports, {
@@ -485,7 +712,7 @@ async function createTenantRow(teamId) {
     const { name } = await inquirer3.prompt([{
       type: "input",
       name: "name",
-      message: `Tenant name ${import_chalk25.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      message: `Tenant name ${import_chalk26.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
       validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
     }]);
     const slug = name.trim();
@@ -500,7 +727,7 @@ async function createTenantRow(teamId) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
-        console.log(import_chalk25.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
+        console.log(import_chalk26.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
         continue;
       }
       throw err;
@@ -517,11 +744,11 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     pageSize: 10,
     choices: [
       ...PROVIDERS.map((p) => ({ name: p.label, value: p.id })),
-      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk25.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
+      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk26.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
     ]
   }]);
   if (!provider) {
-    console.log(import_chalk25.default.dim("  No login method yet \u2014 add one later under Login methods."));
+    console.log(import_chalk26.default.dim("  No login method yet \u2014 add one later under Login methods."));
     return false;
   }
   const opt = PROVIDERS.find((p) => p.id === provider);
@@ -552,7 +779,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     if (a.callbacks.trim()) clientBody.authorizedCallbackUrls = a.callbacks.split(/\s*,\s*/).map((s) => s.trim()).filter(Boolean);
     if (a.scopes.trim() && opt.own) providerBody.scopes = a.scopes.split(/\s+/).filter(Boolean);
   }
-  const spinner = (0, import_ora9.default)("Setting up login...").start();
+  const spinner = (0, import_ora10.default)("Setting up login...").start();
   try {
     const client = await admin({ method: "POST", path: `${base}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
     const clientId = client?.clientId ?? client?.client_id;
@@ -567,27 +794,27 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
 async function createTenantInteractive(teamId) {
   const { default: inquirer3 } = await import("inquirer");
   const tenant2 = await createTenantRow(teamId);
-  console.log(import_chalk25.default.green(`  Tenant ${import_chalk25.default.bold(tenant2)} created.`));
+  console.log(import_chalk26.default.green(`  Tenant ${import_chalk26.default.bold(tenant2)} created.`));
   const { users } = await inquirer3.prompt([{
     type: "confirm",
     name: "users",
     default: false,
-    message: `Enable Users & groups? ${import_chalk25.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
+    message: `Enable Users & groups? ${import_chalk26.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
   }]);
   if (users) {
     await admin({ method: "PATCH", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`, body: { enabled: true }, summary: "Enable Users & groups" }).catch(() => {
     });
-    console.log(import_chalk25.default.green("  Users & groups enabled."));
+    console.log(import_chalk26.default.green("  Users & groups enabled."));
   }
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk25, import_ora9, PROVIDERS, DEFAULT_SCOPES;
+var import_chalk26, import_ora10, PROVIDERS, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
-    import_chalk25 = __toESM(require("chalk"));
-    import_ora9 = __toESM(require("ora"));
+    import_chalk26 = __toESM(require("chalk"));
+    import_ora10 = __toESM(require("ora"));
     init_admin();
     PROVIDERS = [
       { id: "apiblaze", label: "APIblaze (via GitHub) \u2014 zero setup, recommended", own: false },
@@ -625,10 +852,10 @@ async function fetchPage(teamId, q) {
 }
 function label(t, defaultTenant, active) {
   const tags = [
-    t.tenant_name === active ? import_chalk26.default.cyan("active scope") : "",
-    t.tenant_name === defaultTenant ? import_chalk26.default.dim("team default") : ""
+    t.tenant_name === active ? import_chalk27.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk27.default.dim("team default") : ""
   ].filter(Boolean).join(", ");
-  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk26.default.dim(`  ${t.display_name}`) : "";
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk27.default.dim(`  ${t.display_name}`) : "";
   return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
 }
 async function pickTenant(teamId, opts = {}) {
@@ -636,14 +863,14 @@ async function pickTenant(teamId, opts = {}) {
   const active = loadCredentials()?.activeTenant;
   let q = opts.initialQuery ?? "";
   for (; ; ) {
-    const spinner = (0, import_ora10.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const spinner = (0, import_ora11.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
     const page = await fetchPage(teamId, q).finally(() => spinner.stop());
     if (!page.total && !q) {
       if (opts.allowCreate) {
         const { make } = await inquirer3.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
         if (make) return await createTenantInline(teamId);
       }
-      console.error(import_chalk26.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk27.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       return null;
     }
     const truncated = page.total > page.rows.length;
@@ -652,7 +879,7 @@ async function pickTenant(teamId, opts = {}) {
       value: t.tenant_name
     }));
     if (truncated || q) {
-      choices.push(new inquirer3.Separator(import_chalk26.default.dim(
+      choices.push(new inquirer3.Separator(import_chalk27.default.dim(
         truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
       )));
       choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
@@ -686,12 +913,12 @@ async function createTenantInline(teamId) {
   const { createTenantInteractive: createTenantInteractive2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
   return createTenantInteractive2(teamId);
 }
-var import_chalk26, import_ora10, PAGE;
+var import_chalk27, import_ora11, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
     "use strict";
-    import_chalk26 = __toESM(require("chalk"));
-    import_ora10 = __toESM(require("ora"));
+    import_chalk27 = __toESM(require("chalk"));
+    import_ora11 = __toESM(require("ora"));
     init_admin();
     init_auth();
     PAGE = 15;
@@ -700,10 +927,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk41 = __toESM(require("chalk"));
+var import_chalk43 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.18.8";
+var version = "0.19.0";
 
 // src/index.ts
 init_types();
@@ -836,9 +1063,9 @@ async function offerClaimPendingAnon() {
   }
   try {
     const { claimTeam: claimTeam2 } = await Promise.resolve().then(() => (init_api(), api_exports));
-    const t = await claimTeam2(cred.claim_code);
+    const t = await claimTeam2(cred.claim_code, loadCredentials()?.teamId);
     clearAnonCred2();
-    console.log(import_chalk2.default.green(`  \u2714 Claimed your anonymous proxies into your account (team ${import_chalk2.default.bold(t.team_id)}).`));
+    console.log(import_chalk2.default.green(`  \u2714 Claimed your anonymous proxies into your account (team ${import_chalk2.default.bold(t.team_name || t.team_id)}).`));
   } catch (err) {
     const { ApiError: ApiError2 } = await Promise.resolve().then(() => (init_types(), types_exports));
     const code = err instanceof ApiError2 && typeof err.body === "object" && err.body ? err.body.error : void 0;
@@ -1613,8 +1840,8 @@ ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 
 // src/commands/create.ts
 var import_fs2 = __toESM(require("fs"));
-var import_chalk6 = __toESM(require("chalk"));
-var import_ora4 = __toESM(require("ora"));
+var import_chalk10 = __toESM(require("chalk"));
+var import_ora5 = __toESM(require("ora"));
 init_auth();
 init_api();
 function normalizeName(raw) {
@@ -1641,7 +1868,7 @@ function stripTenantFromPortal(devPortal) {
   }
 }
 function fail(message) {
-  console.error(import_chalk6.default.red(`Error: ${message}`));
+  console.error(import_chalk10.default.red(`Error: ${message}`));
   process.exit(1);
 }
 function buildTryItCurl(url, authType, apiKey) {
@@ -1656,11 +1883,11 @@ function printCurlExample(url, authType, apiKey, devPortal) {
   const curl = buildTryItCurl(url, authType, apiKey);
   console.log();
   if (curl) {
-    console.log(`  ${import_chalk6.default.dim("Try it \u2014 copy/paste:")}`);
-    console.log(`    ${import_chalk6.default.cyan(curl)}`);
+    console.log(`  ${import_chalk10.default.dim("Try it \u2014 copy/paste:")}`);
+    console.log(`    ${import_chalk10.default.cyan(curl)}`);
   } else if (authType === "oauth") {
-    console.log(`  ${import_chalk6.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk6.default.bold(devPortal ?? "the dev portal")} to get a token,`);
-    console.log(`  ${import_chalk6.default.dim(`then call ${url} with`)} ${import_chalk6.default.cyan('-H "Authorization: Bearer <token>"')}`);
+    console.log(`  ${import_chalk10.default.dim("Try it:")} this proxy uses OAuth \u2014 sign in at ${import_chalk10.default.bold(devPortal ?? "the dev portal")} to get a token,`);
+    console.log(`  ${import_chalk10.default.dim(`then call ${url} with`)} ${import_chalk10.default.cyan('-H "Authorization: Bearer <token>"')}`);
   }
 }
 var VALID_AUTH = ["api_key", "none", "oauth"];
@@ -1690,7 +1917,7 @@ async function runCreate(opts = {}) {
       teamId = match.teamId;
     }
   }
-  if (!opts.json) console.log(import_chalk6.default.bold("\nCreate an API proxy\n"));
+  if (!opts.json) console.log(import_chalk10.default.bold("\nCreate an API proxy\n"));
   let name = "";
   if (opts.name !== void 0) {
     name = normalizeName(opts.name);
@@ -1710,23 +1937,23 @@ async function runCreate(opts = {}) {
       }]);
       name = normalizeName(rawName);
       if (name.length < 3) {
-        console.log(import_chalk6.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
+        console.log(import_chalk10.default.yellow("  Name must be at least 3 characters (letters and digits only).\n"));
         continue;
       }
-      const spinner2 = (0, import_ora4.default)("Checking availability...").start();
+      const spinner2 = (0, import_ora5.default)("Checking availability...").start();
       try {
         const check = await checkProxyName(name, teamId, opts.apiversion);
         spinner2.stop();
         if (!check.canUseProjectName || !check.canUseApiVersion) {
-          console.log(import_chalk6.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
+          console.log(import_chalk10.default.yellow(`  "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Try another.
 `));
           continue;
         }
       } catch {
         spinner2.stop();
-        console.log(import_chalk6.default.dim("  (could not verify availability; continuing)"));
+        console.log(import_chalk10.default.dim("  (could not verify availability; continuing)"));
       }
-      console.log(`${import_chalk6.default.cyan("\u2192")} Your API will live at ${import_chalk6.default.bold(`https://${name}.abz.run`)}
+      console.log(`${import_chalk10.default.cyan("\u2192")} Your API will live at ${import_chalk10.default.bold(`https://${name}.abz.run`)}
 `);
       break;
     }
@@ -1746,7 +1973,7 @@ async function runCreate(opts = {}) {
         message: "Target URL to forward requests to (e.g. https://httpbin.org):"
       }]);
       if (!isHttpUrl(url)) {
-        console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+        console.log(import_chalk10.default.yellow("  Enter a valid http(s) URL.\n"));
         continue;
       }
       targetUrl = url.trim();
@@ -1757,7 +1984,7 @@ async function runCreate(opts = {}) {
   }
   if (interactive && !opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
-    console.log(`${import_chalk6.default.cyan("\u2192")} Auth: ${import_chalk6.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
+    console.log(`${import_chalk10.default.cyan("\u2192")} Auth: ${import_chalk10.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
     const { ok } = await inquirer3.prompt([{
       type: "confirm",
       name: "ok",
@@ -1765,15 +1992,15 @@ async function runCreate(opts = {}) {
       default: true
     }]);
     if (!ok) {
-      console.log(import_chalk6.default.yellow("Cancelled."));
+      console.log(import_chalk10.default.yellow("Cancelled."));
       return;
     }
   }
-  const spinner = !opts.json ? (0, import_ora4.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
+  const spinner = !opts.json ? (0, import_ora5.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
   let result;
   try {
     result = await createProxy({ name, target_url: targetUrl, auth_type: auth, team_id: teamId, ...opts.apiversion ? { api_version: opts.apiversion } : {} });
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+    spinner?.succeed(import_chalk10.default.green("Proxy created!"));
   } catch (err) {
     spinner?.fail("Failed to create proxy.");
     throw err;
@@ -1796,26 +2023,37 @@ async function runCreate(opts = {}) {
     return;
   }
   console.log();
-  console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(proxyUrl)}`);
-  if (devPortal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(devPortal)}`);
+  console.log(`  ${import_chalk10.default.dim("Proxy URL: ")} ${import_chalk10.default.bold(proxyUrl)}`);
+  if (devPortal) console.log(`  ${import_chalk10.default.dim("Dev portal:")} ${import_chalk10.default.bold(devPortal)}`);
   if (adminKey) {
     console.log();
-    console.log(`  ${import_chalk6.default.dim("Consumer admin API key (dev):")}`);
-    console.log(`    ${import_chalk6.default.bold.green(adminKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+    console.log(`  ${import_chalk10.default.dim("Consumer admin API key (dev):")}`);
+    console.log(`    ${import_chalk10.default.bold.green(adminKey)}`);
+    console.log(import_chalk10.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
     const otherEnvs = Object.keys(keys).filter((e) => e !== "dev");
     if (otherEnvs.length) {
-      console.log(import_chalk6.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
+      console.log(import_chalk10.default.dim(`  (Separate keys were also created for: ${otherEnvs.join(", ")}.)`));
     }
   }
   printCurlExample(proxyUrl, auth, adminKey, devPortal);
   console.log();
+  await applyCreateToggles(name, opts);
+}
+async function applyCreateToggles(name, opts) {
+  if (!opts.identified && !opts.iam) return;
+  const { runIamToggle: runIamToggle2, runIdentifiedToggle: runIdentifiedToggle2 } = await Promise.resolve().then(() => (init_iam(), iam_exports));
+  if (opts.identified) {
+    await runIdentifiedToggle2(name, "require", { team: opts.team, json: opts.json });
+  }
+  if (opts.iam) {
+    await runIamToggle2(name, "on", { team: opts.team, json: opts.json });
+  }
 }
 async function runAnonymousCreate(opts) {
   const interactive = !!process.stdin.isTTY && !opts.json;
   if (!opts.json) {
-    console.log(import_chalk6.default.bold("\nCreate an API proxy"));
-    console.log(import_chalk6.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
+    console.log(import_chalk10.default.bold("\nCreate an API proxy"));
+    console.log(import_chalk10.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
   }
   let body = {};
   if (opts.config) {
@@ -1861,7 +2099,7 @@ async function runAnonymousCreate(opts) {
           message: "Target URL to forward requests to (e.g. https://httpbin.org):"
         }]);
         if (!isHttpUrl(url)) {
-          console.log(import_chalk6.default.yellow("  Enter a valid http(s) URL.\n"));
+          console.log(import_chalk10.default.yellow("  Enter a valid http(s) URL.\n"));
           continue;
         }
         target = url.trim();
@@ -1888,7 +2126,7 @@ async function runAnonymousCreate(opts) {
   const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
   const cred = loadAnonCred2();
-  const spinner = !opts.json ? (0, import_ora4.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
+  const spinner = !opts.json ? (0, import_ora5.default)(cred ? "Creating proxy (in your anonymous workspace)..." : "Creating proxy...").start() : null;
   let result;
   try {
     if (cred) {
@@ -1902,7 +2140,7 @@ async function runAnonymousCreate(opts) {
         saveAnonCred2(result.cp_key, result.team_id, result.claim_code);
       }
     }
-    spinner?.succeed(import_chalk6.default.green("Proxy created!"));
+    spinner?.succeed(import_chalk10.default.green("Proxy created!"));
   } catch (err) {
     spinner?.fail("Failed to create proxy.");
     throw err;
@@ -1924,36 +2162,37 @@ async function runAnonymousCreate(opts) {
     return;
   }
   console.log();
-  if (prodEndpoint) console.log(`  ${import_chalk6.default.dim("Proxy URL: ")} ${import_chalk6.default.bold(prodEndpoint)}`);
-  if (result.portal) console.log(`  ${import_chalk6.default.dim("Dev portal:")} ${import_chalk6.default.bold(result.portal)}`);
+  if (prodEndpoint) console.log(`  ${import_chalk10.default.dim("Proxy URL: ")} ${import_chalk10.default.bold(prodEndpoint)}`);
+  if (result.portal) console.log(`  ${import_chalk10.default.dim("Dev portal:")} ${import_chalk10.default.bold(result.portal)}`);
   if (apiKey) {
     console.log();
-    console.log(`  ${import_chalk6.default.dim("API key:")}`);
-    console.log(`    ${import_chalk6.default.bold.green(apiKey)}`);
-    console.log(import_chalk6.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
+    console.log(`  ${import_chalk10.default.dim("API key:")}`);
+    console.log(`    ${import_chalk10.default.bold.green(apiKey)}`);
+    console.log(import_chalk10.default.dim("\n  Save this now \u2014 send it as the X-API-Key header. It may not be shown again."));
   }
   if (prodEndpoint) printCurlExample(prodEndpoint, opts.auth || "api_key", apiKey, result.portal);
   const claimCode = result.claim_code || cred?.claim_code;
   if (claimCode) {
     console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} To claim these proxies:`);
-    console.log(`      ${import_chalk6.default.cyan(`npx apiblaze login && npx apiblaze claim ${claimCode}`)}`);
+    console.log(`  ${import_chalk10.default.yellow("\u26A0 Anonymous \u2014 claim within 30 days or it expires.")} To claim these proxies:`);
+    console.log(`      ${import_chalk10.default.cyan(`npx apiblaze login && npx apiblaze claim ${claimCode}`)}`);
   } else if (result.claim_url) {
     console.log();
-    console.log(`  ${import_chalk6.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
-    console.log(`    ${import_chalk6.default.bold(result.claim_url)}`);
+    console.log(`  ${import_chalk10.default.yellow("\u26A0 Anonymous proxy \u2014 claim it to your account within 30 days or it expires:")}`);
+    console.log(`    ${import_chalk10.default.bold(result.claim_url)}`);
   }
   console.log();
+  if (name) await applyCreateToggles(name, opts);
 }
 
 // src/commands/claim.ts
-var import_chalk7 = __toESM(require("chalk"));
+var import_chalk11 = __toESM(require("chalk"));
 init_auth();
 init_anon_cred();
 init_api();
 init_types();
 function fail2(message) {
-  console.error(import_chalk7.default.red(`Error: ${message}`));
+  console.error(import_chalk11.default.red(`Error: ${message}`));
   process.exit(1);
 }
 async function runClaim(claimCodeArg, opts) {
@@ -1989,9 +2228,9 @@ async function runClaim(claimCodeArg, opts) {
       const c = typeof err.body === "object" && err.body ? err.body.error : void 0;
       if (c === "already_claimed" || c === "not_claimable") {
         if (fromLocal) clearAnonCred();
-        console.log(import_chalk7.default.yellow("\nThis workspace was already claimed (e.g. on dashboard.apiblaze.com)."));
-        if (fromLocal) console.log(import_chalk7.default.dim("  Cleared the local anonymous key."));
-        console.log(import_chalk7.default.dim("  Your proxies are safe under your account \u2014 manage them with `apiblaze login`."));
+        console.log(import_chalk11.default.yellow("\nThis workspace was already claimed (e.g. on dashboard.apiblaze.com)."));
+        if (fromLocal) console.log(import_chalk11.default.dim("  Cleared the local anonymous key."));
+        console.log(import_chalk11.default.dim("  Your proxies are safe under your account \u2014 manage them with `apiblaze login`."));
         return;
       }
       if (c === "expired") {
@@ -2009,20 +2248,20 @@ async function runClaim(claimCodeArg, opts) {
     console.log(JSON.stringify(res, null, 2));
     return;
   }
-  console.log(import_chalk7.default.green("\n\u2714 Claimed your anonymous workspace into your account."));
+  console.log(import_chalk11.default.green("\n\u2714 Claimed your anonymous workspace into your account."));
   if (res.merged) {
-    console.log(`  Merged ${import_chalk7.default.bold(String(res.proxy_count ?? ""))} prox${res.proxy_count === 1 ? "y" : "ies"} into team ${import_chalk7.default.bold(res.team_id)}.`);
+    console.log(`  Merged ${import_chalk11.default.bold(String(res.proxy_count ?? ""))} prox${res.proxy_count === 1 ? "y" : "ies"} into team ${import_chalk11.default.bold(res.team_id)}.`);
   } else {
     const label3 = res.team_name ? `\u201C${res.team_name}\u201D` : res.team_id;
-    console.log(`  It's now your team ${import_chalk7.default.bold(label3)}. Switch to it with ${import_chalk7.default.cyan(`apiblaze team ${res.team_id}`)}.`);
-    console.log(import_chalk7.default.dim(`  (Tip: name it with --name, or --team <name> to merge into an existing team instead.)`));
+    console.log(`  It's now your team ${import_chalk11.default.bold(label3)}. Switch to it with ${import_chalk11.default.cyan(`apiblaze team ${res.team_id}`)}.`);
+    console.log(import_chalk11.default.dim(`  (Tip: name it with --name, or --team <name> to merge into an existing team instead.)`));
   }
   console.log(`
-  Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
+  Manage it at ${import_chalk11.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
 }
 
 // src/commands/logout.ts
-var import_chalk8 = __toESM(require("chalk"));
+var import_chalk12 = __toESM(require("chalk"));
 init_auth();
 
 // src/lib/consumer-auth.ts
@@ -2154,7 +2393,7 @@ async function runLogout(opts = {}) {
   const creds = loadCredentials();
   const consumer2 = loadConsumer();
   if (!creds && !consumer2) {
-    console.log(import_chalk8.default.yellow("You were not logged in."));
+    console.log(import_chalk12.default.yellow("You were not logged in."));
     return;
   }
   let target;
@@ -2181,16 +2420,16 @@ async function runLogout(opts = {}) {
   }
   if (target === "producer" || target === "all") {
     clearCredentials();
-    console.log(import_chalk8.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
+    console.log(import_chalk12.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
   }
   if (target === "consumer" || target === "all") {
     clearConsumer();
-    console.log(import_chalk8.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
+    console.log(import_chalk12.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
   }
 }
 
 // src/commands/flush.ts
-var import_chalk9 = __toESM(require("chalk"));
+var import_chalk13 = __toESM(require("chalk"));
 var fs6 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
 init_auth();
@@ -2198,22 +2437,22 @@ async function runFlush(opts) {
   const dir = getApiblazeDir();
   const entries2 = fs6.existsSync(dir) ? fs6.readdirSync(dir) : [];
   if (!entries2.length) {
-    console.log(import_chalk9.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
+    console.log(import_chalk13.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
   }
-  console.log(import_chalk9.default.yellow("This removes ALL local apiblaze state from this machine:"));
-  console.log(import_chalk9.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
-  console.log(import_chalk9.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
-  console.log(import_chalk9.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
-  console.log(import_chalk9.default.dim(`  (${entries2.length} item(s) in ${dir})`));
-  console.log(import_chalk9.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
+  console.log(import_chalk13.default.yellow("This removes ALL local apiblaze state from this machine:"));
+  console.log(import_chalk13.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
+  console.log(import_chalk13.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
+  console.log(import_chalk13.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
+  console.log(import_chalk13.default.dim(`  (${entries2.length} item(s) in ${dir})`));
+  console.log(import_chalk13.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
   if (!opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
     const { ok } = await inquirer3.prompt([
       { type: "confirm", name: "ok", message: "Delete all local state?", default: false }
     ]);
     if (!ok) {
-      console.log(import_chalk9.default.dim("Cancelled \u2014 nothing removed."));
+      console.log(import_chalk13.default.dim("Cancelled \u2014 nothing removed."));
       return;
     }
   }
@@ -2223,14 +2462,14 @@ async function runFlush(opts) {
       fs6.rmSync(path4.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
-      console.log(import_chalk9.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
+      console.log(import_chalk13.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
     }
   }
-  console.log(`${import_chalk9.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
+  console.log(`${import_chalk13.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
 }
 
 // src/commands/whoami.ts
-var import_chalk10 = __toESM(require("chalk"));
+var import_chalk14 = __toESM(require("chalk"));
 init_auth();
 init_anon_cred();
 async function runWhoami(opts = {}) {
@@ -2253,43 +2492,43 @@ async function runWhoami(opts = {}) {
     }, null, 2));
     return;
   }
-  console.log(import_chalk10.default.bold("API Producer"));
+  console.log(import_chalk14.default.bold("API Producer"));
   if (!creds) {
-    console.log(import_chalk10.default.dim("  Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk14.default.dim("  Not logged in. Run `apiblaze login`."));
   } else {
     const who = creds.githubHandle ?? creds.email ?? creds.apiblazeUserId ?? "unknown";
-    console.log(`  ${import_chalk10.default.cyan("Signed in as")} ${import_chalk10.default.bold(who)}`);
+    console.log(`  ${import_chalk14.default.cyan("Signed in as")} ${import_chalk14.default.bold(who)}`);
     if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
-    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk10.default.bold(creds.teamName ?? creds.teamId)}`);
-    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk10.default.bold(creds.activeTenant)}  ${import_chalk10.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
-    if (Date.now() >= creds.expiresAt) console.log(import_chalk10.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
+    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk14.default.bold(creds.teamName ?? creds.teamId)}`);
+    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk14.default.bold(creds.activeTenant)}  ${import_chalk14.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
+    if (Date.now() >= creds.expiresAt) console.log(import_chalk14.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
   }
   if (anon) {
     const masked = `${anon.cp_key.slice(0, 11)}\u2026${anon.cp_key.slice(-4)}`;
-    console.log(import_chalk10.default.bold("\nAnonymous workspace") + import_chalk10.default.dim("  (created without an account \u2014 unclaimed)"));
-    console.log(`  Team:    ${import_chalk10.default.bold(anon.team_id)}`);
-    console.log(`  CP key:  ${import_chalk10.default.bold(masked)}  ${import_chalk10.default.dim("controls the proxies you created anonymously")}`);
+    console.log(import_chalk14.default.bold("\nAnonymous workspace") + import_chalk14.default.dim("  (created without an account \u2014 unclaimed)"));
+    console.log(`  Team:    ${import_chalk14.default.bold(anon.team_id)}`);
+    console.log(`  CP key:  ${import_chalk14.default.bold(masked)}  ${import_chalk14.default.dim("controls the proxies you created anonymously")}`);
     console.log(
-      import_chalk10.default.dim(`  Keep it: ${import_chalk10.default.cyan("apiblaze login")} then ${import_chalk10.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk10.default.dim(`  \xB7  from another machine: ${import_chalk10.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
+      import_chalk14.default.dim(`  Keep it: ${import_chalk14.default.cyan("apiblaze login")} then ${import_chalk14.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk14.default.dim(`  \xB7  from another machine: ${import_chalk14.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
     );
-    if (creds) console.log(import_chalk10.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
+    if (creds) console.log(import_chalk14.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
   }
-  console.log(import_chalk10.default.bold("\nAPI Consumer"));
+  console.log(import_chalk14.default.bold("\nAPI Consumer"));
   if (!consumer2) {
-    console.log(import_chalk10.default.dim("  Not logged in. Run `apiblaze consumer login`."));
+    console.log(import_chalk14.default.dim("  Not logged in. Run `apiblaze consumer login`."));
   } else {
-    console.log(`  ${import_chalk10.default.cyan("Signed in as")} ${import_chalk10.default.bold(consumer2.email ?? consumer2.tenant)}`);
-    console.log(`  Tenant:  ${import_chalk10.default.bold(consumer2.tenant)}`);
-    if (Date.now() >= consumer2.expiresAt) console.log(import_chalk10.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
+    console.log(`  ${import_chalk14.default.cyan("Signed in as")} ${import_chalk14.default.bold(consumer2.email ?? consumer2.tenant)}`);
+    console.log(`  Tenant:  ${import_chalk14.default.bold(consumer2.tenant)}`);
+    if (Date.now() >= consumer2.expiresAt) console.log(import_chalk14.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
   }
 }
 
 // src/commands/team.ts
-var import_chalk11 = __toESM(require("chalk"));
+var import_chalk15 = __toESM(require("chalk"));
 init_auth();
 init_api();
 function fail3(message) {
-  console.error(import_chalk11.default.red(`Error: ${message}`));
+  console.error(import_chalk15.default.red(`Error: ${message}`));
   process.exit(1);
 }
 async function runTeam(arg) {
@@ -2311,7 +2550,7 @@ async function runTeam(arg) {
     }
   } else if (teams.length === 1) {
     chosen = teams[0];
-    console.log(`${import_chalk11.default.cyan("\u2192")} You only have one team: ${import_chalk11.default.bold(chosen.name)}`);
+    console.log(`${import_chalk15.default.cyan("\u2192")} You only have one team: ${import_chalk15.default.bold(chosen.name)}`);
   } else if (process.stdin.isTTY) {
     const { default: inquirer3 } = await import("inquirer");
     const { picked } = await inquirer3.prompt([{
@@ -2326,47 +2565,47 @@ async function runTeam(arg) {
     fail3(`Specify a team: \`apiblaze team <name|id>\`. Available: ${teams.map((t) => t.name).join(", ")}.`);
   }
   saveCredentials({ ...creds, teamId: chosen.teamId, teamName: chosen.name });
-  console.log(import_chalk11.default.green(`
-\u2714 Active team: ${import_chalk11.default.bold(chosen.name)}`));
+  console.log(import_chalk15.default.green(`
+\u2714 Active team: ${import_chalk15.default.bold(chosen.name)}`));
 }
 
 // src/commands/authz.ts
-var import_chalk16 = __toESM(require("chalk"));
+var import_chalk18 = __toESM(require("chalk"));
 init_auth();
 init_api();
 
 // src/lib/agent-chat.ts
 var import_readline = __toESM(require("readline"));
-var import_chalk14 = __toESM(require("chalk"));
+var import_chalk16 = __toESM(require("chalk"));
 init_api();
 init_admin();
 async function runAgentChatRepl(opts) {
   const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
-  console.log("\n" + import_chalk14.default.cyan.bold(title));
-  if (subtitle) console.log(import_chalk14.default.dim(subtitle));
+  console.log("\n" + import_chalk16.default.cyan.bold(title));
+  if (subtitle) console.log(import_chalk16.default.dim(subtitle));
   const messages = [];
   const ctx = { proposal: null, lastData: null, log: (s) => console.log(s) };
   const cmdByName = new Map(commands.map((c) => [c.name, c]));
   const footer = () => {
     const parts = [
-      import_chalk14.default.dim("type to chat/refine"),
-      ...commands.map((c) => import_chalk14.default.dim(`/${c.name} ${c.describe}`)),
-      import_chalk14.default.dim("/show"),
-      import_chalk14.default.dim("/drop discard & exit")
+      import_chalk16.default.dim("type to chat/refine"),
+      ...commands.map((c) => import_chalk16.default.dim(`/${c.name} ${c.describe}`)),
+      import_chalk16.default.dim("/show"),
+      import_chalk16.default.dim("/drop discard & exit")
     ];
-    return "  " + import_chalk14.default.dim("[ ") + parts.join(import_chalk14.default.dim(" \xB7 ")) + import_chalk14.default.dim(" ]");
+    return "  " + import_chalk16.default.dim("[ ") + parts.join(import_chalk16.default.dim(" \xB7 ")) + import_chalk16.default.dim(" ]");
   };
   async function turn(content) {
     messages.push({ role: "user", content });
-    process.stdout.write(import_chalk14.default.dim("  \u2026thinking\n"));
+    process.stdout.write(import_chalk16.default.dim("  \u2026thinking\n"));
     const { status, data } = await agentCall(endpoint, "POST", { messages, ...buildBody(messages) });
     if (status === 402) {
-      console.log(import_chalk14.default.red("  Insufficient credits \u2014 top up to keep using the agents.\n"));
+      console.log(import_chalk16.default.red("  Insufficient credits \u2014 top up to keep using the agents.\n"));
       messages.pop();
       return;
     }
     if (status >= 400 || !data) {
-      console.log(import_chalk14.default.red(`  Error (${status}): ${(data && data.error) ?? "request failed"}
+      console.log(import_chalk16.default.red(`  Error (${status}): ${(data && data.error) ?? "request failed"}
 `));
       messages.pop();
       return;
@@ -2374,19 +2613,19 @@ async function runAgentChatRepl(opts) {
     ctx.lastData = data;
     const reply = data.reply ?? data.message ?? "(no reply)";
     messages.push({ role: "assistant", content: reply });
-    console.log("\n" + import_chalk14.default.cyan("agent \u203A ") + reply + "\n");
+    console.log("\n" + import_chalk16.default.cyan("agent \u203A ") + reply + "\n");
     if (data.proposal) {
       ctx.proposal = data.proposal;
       const summary = summarizeProposal?.(data);
-      if (summary) console.log(import_chalk14.default.yellow("  " + summary));
+      if (summary) console.log(import_chalk16.default.yellow("  " + summary));
       const ready = commands.filter((c) => c.needsProposal).map((c) => `/${c.name}`).join(" or ");
-      if (ready) console.log(import_chalk14.default.dim(`  Ready \u2014 ${ready} to make it official, or keep refining.`));
+      if (ready) console.log(import_chalk16.default.dim(`  Ready \u2014 ${ready} to make it official, or keep refining.`));
       console.log();
     }
     const line = formatBilling(data.billing);
     if (line) {
       const llm2 = data.llm;
-      console.log(import_chalk14.default.dim(`  ${line}${llm2?.model ? ` \xB7 ${llm2.model}` : ""}`));
+      console.log(import_chalk16.default.dim(`  ${line}${llm2?.model ? ` \xB7 ${llm2.model}` : ""}`));
     }
   }
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
@@ -2394,26 +2633,26 @@ async function runAgentChatRepl(opts) {
   await turn(seedPrompt);
   for (; ; ) {
     console.log(footer());
-    const line = (await ask(import_chalk14.default.green("you \u203A "))).trim();
+    const line = (await ask(import_chalk16.default.green("you \u203A "))).trim();
     if (!line) continue;
     if (line === "/drop" || line === "/exit" || line === "/quit") {
-      console.log(import_chalk14.default.dim("  Dropped \u2014 nothing applied.\n"));
+      console.log(import_chalk16.default.dim("  Dropped \u2014 nothing applied.\n"));
       break;
     }
     if (line === "/show") {
-      if (!ctx.proposal) console.log(import_chalk14.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
+      if (!ctx.proposal) console.log(import_chalk16.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
       else console.log("\n" + JSON.stringify(ctx.proposal, null, 2) + "\n");
       continue;
     }
     if (line.startsWith("/")) {
       const cmd = cmdByName.get(line.slice(1));
       if (!cmd) {
-        console.log(import_chalk14.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
+        console.log(import_chalk16.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
 `));
         continue;
       }
       if (cmd.needsProposal && !ctx.proposal) {
-        console.log(import_chalk14.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
+        console.log(import_chalk16.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
         continue;
       }
       await cmd.run(ctx);
@@ -2425,19 +2664,48 @@ async function runAgentChatRepl(opts) {
 }
 
 // src/lib/authz-apply.ts
-var import_chalk15 = __toESM(require("chalk"));
+var import_chalk17 = __toESM(require("chalk"));
 init_api();
+async function gatherSampleIds(projectId, apiVersion, cap = 50) {
+  try {
+    const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
+    const routes = routesRes?.data?.routes ?? [];
+    const total = routes.reduce((n, r) => n + (Number(r.total) || 0), 0);
+    if (!routes.length || total === 0) return { ids: [], total: 0 };
+    const ordered = routes.filter((r) => r.route_hash).sort((a, b) => (Number(b.total) || 0) - (Number(a.total) || 0)).slice(0, 20);
+    const ids = [];
+    for (const r of ordered) {
+      if (ids.length >= cap) break;
+      const sRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes/${encodeURIComponent(r.route_hash)}/samples`, "GET");
+      for (const s of sRes?.data?.samples ?? []) {
+        if (ids.length >= cap) break;
+        if (s.sample_id) ids.push(s.sample_id);
+      }
+    }
+    return { ids, total };
+  } catch {
+    return { ids: [], total: 0 };
+  }
+}
+function maybeWarnNoTraffic(total, projectArg) {
+  if (total >= 3) return;
+  console.log(import_chalk17.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
+  console.log(import_chalk17.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
+  console.log(import_chalk17.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
+  console.log(import_chalk17.default.dim(`    curl a few endpoints, or `) + import_chalk17.default.cyan("npx apiblaze dev") + import_chalk17.default.dim(` \u2014 then re-run.
+`));
+}
 async function applyProposal(opts) {
   const log = opts.log ?? ((s) => console.log(s));
   const { projectId, apiVersion, tenant: tenant2, proposal, enable } = opts;
   if (!enable) {
     const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant2)}`, "POST", proposal.model);
     if (m.status === 404) {
-      log(import_chalk15.default.red("  Authorization store not provisioned yet. Open the dashboard Authorization tab for this project once (it auto-provisions the store), then re-run.\n"));
+      log(import_chalk17.default.red("  Authorization store not provisioned yet. Open the dashboard Authorization tab for this project once (it auto-provisions the store), then re-run.\n"));
       return { ok: 0, fail: 0, enabled: false, storeMissing: true };
     }
     if (m.status >= 400) {
-      log(import_chalk15.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
+      log(import_chalk17.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
 `));
       return { ok: 0, fail: 0, enabled: false };
     }
@@ -2466,7 +2734,7 @@ async function applyProposal(opts) {
   if (enable) {
     const e = await agentCall(`/${projectId}/${apiVersion}/config`, "PATCH", { authorization: { enforce_authorization: true }, tenant: tenant2 });
     if (e.status >= 400) {
-      log(import_chalk15.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
+      log(import_chalk17.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
 `));
       return { ok, fail: fail5, enabled: false };
     }
@@ -2492,18 +2760,20 @@ async function runAuthz(projectArg, apiVersionArg) {
     const r = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable, log: ctx.log });
     if (r.storeMissing) return;
     if (enable && r.enabled) {
-      ctx.log(import_chalk16.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on${r.fail ? `, ${r.fail} failed` : ""}.
+      ctx.log(import_chalk18.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on${r.fail ? `, ${r.fail} failed` : ""}.
 `));
     } else if (!enable) {
-      ctx.log(import_chalk16.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s)${r.fail ? `, ${r.fail} failed` : ""}. Review, then /enable.
+      ctx.log(import_chalk18.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s)${r.fail ? `, ${r.fail} failed` : ""}. Review, then /enable.
 `));
     }
   }
+  const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
+  maybeWarnNoTraffic(sampleTotal, projectArg);
   await runAgentChatRepl({
     title: `Authorization assistant \u2014 ${projectId} ${apiVersion}`,
-    subtitle: `tenant ${tenant2} \xB7 discuss what authorization fits this API, then make it official.`,
+    subtitle: sampleIds.length ? `tenant ${tenant2} \xB7 ${sampleIds.length} traffic sample(s) \xB7 discuss what fits, then make it official.` : `tenant ${tenant2} \xB7 discuss what authorization fits this API, then make it official.`,
     endpoint: `/projects/${projectId}/${apiVersion}/authz/chat`,
-    buildBody: () => ({ included_sample_ids: [], existing_model: null, existing_routes: [] }),
+    buildBody: () => ({ included_sample_ids: sampleIds, existing_model: null, existing_routes: [] }),
     seedPrompt: "Analyze this API and tell me what authorization is feasible. If it is read-only, say so plainly. Then propose options \u2014 do not generate rules yet.",
     summarizeProposal: (data) => {
       const proposal = data.proposal;
@@ -2520,8 +2790,8 @@ async function runAuthz(projectArg, apiVersionArg) {
 }
 
 // src/commands/rule.ts
-var import_chalk17 = __toESM(require("chalk"));
-var import_ora5 = __toESM(require("ora"));
+var import_chalk19 = __toESM(require("chalk"));
+var import_ora6 = __toESM(require("ora"));
 init_auth();
 init_api();
 async function runRule(ruleText, projectArg, opts) {
@@ -2538,7 +2808,9 @@ async function runRule(ruleText, projectArg, opts) {
   const projectId = match.projectId;
   const apiVersion = opts.apiversion || match.apiVersion;
   const tenant2 = match.tenant || projectId;
-  const spinner = (0, import_ora5.default)("Designing the rule\u2026").start();
+  const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
+  maybeWarnNoTraffic(sampleTotal, projectArg);
+  const spinner = (0, import_ora6.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
   const messages = [{
     role: "user",
     content: `Author this authorization rule and generate the COMPLETE proposal (OpenFGA model + per-route rules) NOW for every affected route. Do not ask clarifying questions; make reasonable assumptions and state them briefly. Rule: "${rule}"`
@@ -2546,7 +2818,7 @@ async function runRule(ruleText, projectArg, opts) {
   const { status, data } = await agentCall(
     `/projects/${projectId}/${apiVersion}/authz/chat`,
     "POST",
-    { messages, included_sample_ids: [], existing_model: null, existing_routes: [] }
+    { messages, included_sample_ids: sampleIds, existing_model: null, existing_routes: [] }
   );
   if (status >= 400) {
     spinner.fail(`Authorization agent error (${status}): ${data?.error ?? ""}`);
@@ -2555,27 +2827,27 @@ async function runRule(ruleText, projectArg, opts) {
   const proposal = data?.proposal;
   if (!proposal || !Array.isArray(proposal.routes) || proposal.routes.length === 0) {
     spinner.fail("The agent couldn\u2019t turn that into a rule in one shot.");
-    if (data?.reply) console.log(import_chalk17.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
-    console.log(import_chalk17.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk17.default.cyan(`apiblaze agent authz ${projectArg}`));
+    if (data?.reply) console.log(import_chalk19.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
+    console.log(import_chalk19.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk19.default.cyan(`apiblaze agent authz ${projectArg}`));
     return;
   }
   spinner.succeed(`Rule designed \u2014 ${proposal.routes.length} route(s) affected.`);
-  if (data?.reply) console.log(import_chalk17.default.dim("  " + String(data.reply).slice(0, 240)));
+  if (data?.reply) console.log(import_chalk19.default.dim("  " + String(data.reply).slice(0, 240)));
   const pub = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: false });
   if (pub.storeMissing) return;
-  console.log(import_chalk17.default.green(`  \u2713 Published in shadow mode \u2014 model + ${pub.ok} route(s)${pub.fail ? `, ${pub.fail} failed` : ""}.`));
+  console.log(import_chalk19.default.green(`  \u2713 Published in shadow mode \u2014 model + ${pub.ok} route(s)${pub.fail ? `, ${pub.fail} failed` : ""}.`));
   if (opts.enforce) {
     const enf = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: true });
     if (enf.enabled) {
-      console.log(import_chalk17.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on${enf.fail ? `, ${enf.fail} failed` : ""}.`));
+      console.log(import_chalk19.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on${enf.fail ? `, ${enf.fail} failed` : ""}.`));
     }
   } else {
-    console.log(import_chalk17.default.dim(`  Review it (shadow logs), then enforce: `) + import_chalk17.default.cyan(`apiblaze rule "${rule}" ${projectArg} --enforce`));
+    console.log(import_chalk19.default.dim(`  Review it (shadow logs), then enforce: `) + import_chalk19.default.cyan(`apiblaze rule "${rule}" ${projectArg} --enforce`));
   }
 }
 
 // src/commands/openapi.ts
-var import_chalk18 = __toESM(require("chalk"));
+var import_chalk20 = __toESM(require("chalk"));
 init_auth();
 init_api();
 async function runOpenapi(projectArg, apiVersionArg) {
@@ -2586,10 +2858,10 @@ async function runOpenapi(projectArg, apiVersionArg) {
   if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
   const projectId = match.projectId;
   const apiVersion = apiVersionArg || match.apiVersion;
-  console.log(import_chalk18.default.dim("Gathering captured traffic samples\u2026"));
+  console.log(import_chalk20.default.dim("Gathering captured traffic samples\u2026"));
   const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
   if (routesRes.status >= 400) {
-    console.log(import_chalk18.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
+    console.log(import_chalk20.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
     return;
   }
   const routes = routesRes.data?.routes ?? (Array.isArray(routesRes.data) ? routesRes.data : []);
@@ -2602,25 +2874,25 @@ async function runOpenapi(projectArg, apiVersionArg) {
   }
   const sampleIds = [...ids];
   if (sampleIds.length === 0) {
-    console.log(import_chalk18.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
+    console.log(import_chalk20.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
     return;
   }
   async function publish(ctx) {
     const patch = ctx.proposal.patch;
     if (!Array.isArray(patch) || patch.length === 0) {
-      ctx.log(import_chalk18.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
+      ctx.log(import_chalk20.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
       return;
     }
     const specSource = ctx.lastData?.spec_source ?? "unknown";
     const endpoint = specSource === "github" ? "open-pr" : "publish-openapi";
     const pub = await agentCall(`/projects/${projectId}/${apiVersion}/samples/${endpoint}`, "POST", { patch, sample_ids_used: sampleIds });
     if (pub.status >= 400) {
-      ctx.log(import_chalk18.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+      ctx.log(import_chalk20.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
       return;
     }
     const prUrl = pub.data?.pr_url;
-    ctx.log(import_chalk18.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
+    ctx.log(import_chalk20.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
 ` : "  \u2713 Published updated OpenAPI spec.\n"));
   }
   await runAgentChatRepl({
@@ -2641,7 +2913,7 @@ async function runOpenapi(projectArg, apiVersionArg) {
 }
 
 // src/commands/mcp.ts
-var import_chalk19 = __toESM(require("chalk"));
+var import_chalk21 = __toESM(require("chalk"));
 init_auth();
 init_api();
 async function runMcp(projectArg, apiVersionArg, opts) {
@@ -2658,11 +2930,11 @@ async function runMcp(projectArg, apiVersionArg, opts) {
     const spec2 = ctx.proposal;
     const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec: spec2 });
     if (pub.status >= 400) {
-      ctx.log(import_chalk19.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+      ctx.log(import_chalk21.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
       return;
     }
-    ctx.log(import_chalk19.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost}.mcp.apiblaze.com/${apiVersion}/${environment}.
+    ctx.log(import_chalk21.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost}.mcp.apiblaze.com/${apiVersion}/${environment}.
 `));
   }
   await runAgentChatRepl({
@@ -2684,69 +2956,14 @@ async function runMcp(projectArg, apiVersionArg, opts) {
 }
 
 // src/commands/delete.ts
-var import_chalk21 = __toESM(require("chalk"));
-var import_ora6 = __toESM(require("ora"));
+var import_chalk22 = __toESM(require("chalk"));
+var import_ora7 = __toESM(require("ora"));
 init_admin();
-
-// src/lib/resolve.ts
-var import_chalk20 = __toESM(require("chalk"));
-init_auth();
-init_api();
-function requireAuth() {
-  const creds = loadCredentials();
-  if (!creds) {
-    console.error(import_chalk20.default.red("Not logged in. Run `apiblaze login` first."));
-    process.exit(1);
-  }
-  return creds;
-}
-async function resolveTeam(opt) {
-  const creds = requireAuth();
-  if (!opt) {
-    if (!creds.teamId) {
-      console.error(import_chalk20.default.red("No active team. Run `apiblaze login` or pass --team."));
-      process.exit(1);
-    }
-    return { teamId: creds.teamId, teamName: creds.teamName };
-  }
-  if (opt.startsWith("team_")) return { teamId: opt };
-  const teams = await getTeams().catch(() => []);
-  const match = teams.find((t) => t.name === opt || t.teamId === opt);
-  if (!match) {
-    console.error(import_chalk20.default.red(`Team "${opt}" not found.${teams.length ? " Available: " + teams.map((t) => t.name).join(", ") : ""}`));
-    process.exit(1);
-  }
-  return { teamId: match.teamId, teamName: match.name };
-}
-async function resolveProject(teamId, nameOrId, version2) {
-  const projects = await getProjects(teamId).catch(() => []);
-  const candidates = projects.filter(
-    (p) => p.projectId === nameOrId || p.projectName === nameOrId
-  );
-  if (candidates.length === 0) {
-    console.error(import_chalk20.default.red(`Project "${nameOrId}" not found in this team.`));
-    if (projects.length) console.error(import_chalk20.default.dim("  Known: " + projects.map((p) => p.projectName).join(", ")));
-    process.exit(1);
-  }
-  const chosen = version2 ? candidates.find((p) => p.apiVersion === version2) : candidates[0];
-  if (!chosen) {
-    console.error(import_chalk20.default.red(`Project "${nameOrId}" has no version ${version2}. Versions: ${candidates.map((p) => p.apiVersion).join(", ")}`));
-    process.exit(1);
-  }
-  return {
-    projectId: chosen.projectId,
-    projectName: chosen.projectName,
-    apiVersion: chosen.apiVersion,
-    teamId,
-    tenant: chosen.tenant
-  };
-}
-
-// src/commands/delete.ts
+init_resolve();
 async function runDelete(project, version2, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, version2);
-  const spinner = (0, import_ora6.default)("Checking delete impact...").start();
+  const spinner = (0, import_ora7.default)("Checking delete impact...").start();
   let impact;
   try {
     impact = await admin({
@@ -2765,10 +2982,10 @@ async function runDelete(project, version2, opts) {
       return;
     }
   } else {
-    console.log(`${import_chalk21.default.red.bold("Delete")} ${import_chalk21.default.bold(proj2.projectName)} ${import_chalk21.default.dim("v" + proj2.apiVersion)} ${import_chalk21.default.dim("(" + proj2.projectId + ")")}`);
+    console.log(`${import_chalk22.default.red.bold("Delete")} ${import_chalk22.default.bold(proj2.projectName)} ${import_chalk22.default.dim("v" + proj2.apiVersion)} ${import_chalk22.default.dim("(" + proj2.projectId + ")")}`);
     if (impact && typeof impact === "object") {
       const counts = impact.counts ?? impact.impact ?? impact;
-      console.log(import_chalk21.default.dim("  This removes (cascade): ") + import_chalk21.default.yellow(JSON.stringify(counts)));
+      console.log(import_chalk22.default.dim("  This removes (cascade): ") + import_chalk22.default.yellow(JSON.stringify(counts)));
     }
     if (!opts.yes) {
       const { default: inquirer3 } = await import("inquirer");
@@ -2776,12 +2993,12 @@ async function runDelete(project, version2, opts) {
         { type: "confirm", name: "confirm", message: `Permanently delete ${proj2.projectName} v${proj2.apiVersion}? This cannot be undone.`, default: false }
       ]);
       if (!confirm) {
-        console.log(import_chalk21.default.dim("Aborted."));
+        console.log(import_chalk22.default.dim("Aborted."));
         return;
       }
     }
   }
-  const s2 = (0, import_ora6.default)("Deleting...").start();
+  const s2 = (0, import_ora7.default)("Deleting...").start();
   try {
     await admin({
       method: "DELETE",
@@ -2797,10 +3014,11 @@ async function runDelete(project, version2, opts) {
 }
 
 // src/commands/export.ts
-var import_chalk22 = __toESM(require("chalk"));
+var import_chalk23 = __toESM(require("chalk"));
 var import_fs3 = require("fs");
 init_admin();
 init_auth();
+init_resolve();
 var DASHBOARD_BASE4 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 async function runExport(projectArg, versionArg, opts) {
   const token = getAccessToken();
@@ -2815,7 +3033,7 @@ async function runExport(projectArg, versionArg, opts) {
   if (opts.noConsumers) q.set("include_consumers", "0");
   if (opts.keys) q.set("keys", opts.keys);
   const qs = q.toString() ? `?${q.toString()}` : "";
-  console.log(import_chalk22.default.dim(`Queuing ${target} export of ${projectId}@${version2}\u2026`));
+  console.log(import_chalk23.default.dim(`Queuing ${target} export of ${projectId}@${version2}\u2026`));
   const job = await admin({
     path: `/projects/${projectId}/${version2}/export/${target}${qs}`,
     method: "GET",
@@ -2825,11 +3043,11 @@ async function runExport(projectArg, versionArg, opts) {
   const statusPath = `/projects/${projectId}/${version2}/export/jobs/${job.job_id}`;
   let status = "queued";
   const started = Date.now();
-  process.stdout.write(import_chalk22.default.dim("Building bundle"));
+  process.stdout.write(import_chalk23.default.dim("Building bundle"));
   while (status !== "ready" && status !== "failed") {
     if (Date.now() - started > 10 * 6e4) throw new Error("Export timed out after 10 minutes.");
     await new Promise((r) => setTimeout(r, 3e3));
-    process.stdout.write(import_chalk22.default.dim("."));
+    process.stdout.write(import_chalk23.default.dim("."));
     const st = await admin({ path: statusPath, method: "GET", summary: "poll export" });
     status = st?.status ?? "queued";
     if (status === "failed") {
@@ -2847,20 +3065,21 @@ async function runExport(projectArg, versionArg, opts) {
   if (!res.ok) throw new Error(`Download failed (${res.status}): ${await res.text().catch(() => "")}`);
   const buf = Buffer.from(await res.arrayBuffer());
   (0, import_fs3.writeFileSync)(outFile, buf);
-  console.log(import_chalk22.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
-  if (job.decryption_key) console.log(import_chalk22.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
-  console.log(import_chalk22.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
-  if (target === "kong") console.log(import_chalk22.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
+  console.log(import_chalk23.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
+  if (job.decryption_key) console.log(import_chalk23.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
+  console.log(import_chalk23.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
+  if (target === "kong") console.log(import_chalk23.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
 }
 
 // src/commands/config.ts
-var import_chalk23 = __toESM(require("chalk"));
-var import_ora7 = __toESM(require("ora"));
+var import_chalk24 = __toESM(require("chalk"));
+var import_ora8 = __toESM(require("ora"));
 init_admin();
+init_resolve();
 async function patchConfig(project, opts, body, summary) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora7.default)(summary + "...").start();
+  const spinner = (0, import_ora8.default)(summary + "...").start();
   try {
     const out = await admin({
       method: "PATCH",
@@ -2877,7 +3096,7 @@ async function patchConfig(project, opts, body, summary) {
 }
 async function runTargetSet(project, opts) {
   if (!opts.url) {
-    console.error(import_chalk23.default.red("--url is required."));
+    console.error(import_chalk24.default.red("--url is required."));
     process.exit(1);
   }
   const body = opts.env ? { environments: { [opts.env]: { target: opts.url } } } : { target_url: opts.url };
@@ -2890,43 +3109,45 @@ async function runThrottleSet(project, opts) {
   if (opts.quota !== void 0) throttling.proxyQuota = Number(opts.quota);
   if (opts.period !== void 0) {
     if (!["daily", "weekly", "monthly"].includes(opts.period)) {
-      console.error(import_chalk23.default.red("--period must be daily, weekly, or monthly."));
+      console.error(import_chalk24.default.red("--period must be daily, weekly, or monthly."));
       process.exit(1);
     }
     throttling.quotaPeriod = opts.period;
   }
   if (Object.keys(throttling).length === 0) {
-    console.error(import_chalk23.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
+    console.error(import_chalk24.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
     process.exit(1);
   }
   await patchConfig(project, opts, { throttling }, `Update throttling ${JSON.stringify(throttling)}`);
 }
 async function runRename(project, opts) {
   if (!opts.displayName) {
-    console.error(import_chalk23.default.red("--display-name is required."));
+    console.error(import_chalk24.default.red("--display-name is required."));
     process.exit(1);
   }
   await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
 }
 
 // src/commands/config-browse.ts
-var import_chalk32 = __toESM(require("chalk"));
-var import_ora15 = __toESM(require("ora"));
+var import_chalk33 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
 init_admin();
 init_auth();
+init_resolve();
 
 // src/commands/domain.ts
-var import_chalk24 = __toESM(require("chalk"));
-var import_ora8 = __toESM(require("ora"));
+var import_chalk25 = __toESM(require("chalk"));
+var import_ora9 = __toESM(require("ora"));
 init_admin();
+init_resolve();
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
-    console.error(import_chalk24.default.red("--domain is required."));
+    console.error(import_chalk25.default.red("--domain is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora8.default)(`Registering ${opts.domain}...`).start();
+  const spinner = (0, import_ora9.default)(`Registering ${opts.domain}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -2940,9 +3161,9 @@ async function runDomainAdd(project, opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    if (out?.cnameRecord) console.log(`  ${import_chalk24.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
-    if (out?.dcv) console.log(`  ${import_chalk24.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
-    if (out?.id) console.log(import_chalk24.default.dim(`  domain id: ${out.id}`));
+    if (out?.cnameRecord) console.log(`  ${import_chalk25.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
+    if (out?.dcv) console.log(`  ${import_chalk25.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (out?.id) console.log(import_chalk25.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
     spinner.fail("Domain registration failed.");
     throw err;
@@ -2962,14 +3183,14 @@ async function runDomainList(project, opts) {
     return;
   }
   if (!domains.length) {
-    console.log(import_chalk24.default.yellow("No custom domains."));
+    console.log(import_chalk25.default.yellow("No custom domains."));
     return;
   }
-  for (const d of domains) console.log(`  ${import_chalk24.default.bold(d.hostname)}  ${import_chalk24.default.dim(d.status ?? "")}  ${import_chalk24.default.dim(d.id ?? "")}`);
+  for (const d of domains) console.log(`  ${import_chalk25.default.bold(d.hostname)}  ${import_chalk25.default.dim(d.status ?? "")}  ${import_chalk25.default.dim(d.id ?? "")}`);
 }
 async function runDomainStatus(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk24.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk25.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -2979,16 +3200,16 @@ async function runDomainStatus(project, opts) {
     path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
-  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk24.default.bold(out?.hostname ?? opts.id)}: ${import_chalk24.default.cyan(out?.status ?? "unknown")}`);
+  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk25.default.bold(out?.hostname ?? opts.id)}: ${import_chalk25.default.cyan(out?.status ?? "unknown")}`);
 }
 async function runDomainRemove(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk24.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk25.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora8.default)("Removing domain...").start();
+  const spinner = (0, import_ora9.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
@@ -3005,7 +3226,7 @@ async function runDomainSetBase(project, opts) {
   const env = opts.env ?? "prod";
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora8.default)("Setting base domain...").start();
+  const spinner = (0, import_ora9.default)("Setting base domain...").start();
   try {
     await admin({
       method: "PUT",
@@ -3021,28 +3242,29 @@ async function runDomainSetBase(project, opts) {
 }
 
 // src/commands/tenant.ts
-var import_chalk27 = __toESM(require("chalk"));
-var import_ora11 = __toESM(require("ora"));
+var import_chalk28 = __toESM(require("chalk"));
+var import_ora12 = __toESM(require("ora"));
 init_admin();
+init_resolve();
 init_auth();
 init_tenant_pick();
 async function runTenantUse(query, opts) {
   const creds = loadCredentials();
   if (!creds) {
-    console.error(import_chalk27.default.red("Not logged in. Run `apiblaze login` first."));
+    console.error(import_chalk28.default.red("Not logged in. Run `apiblaze login` first."));
     process.exit(1);
   }
   if (opts.clear) {
     delete creds.activeTenant;
     saveCredentials(creds);
-    console.log(import_chalk27.default.green("Tenant scope cleared."));
+    console.log(import_chalk28.default.green("Tenant scope cleared."));
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
   const slug = await pickTenant(teamId, { message: "Scope future commands to which tenant?", initialQuery: query });
   if (!slug) process.exit(1);
   saveCredentials({ ...creds, activeTenant: slug });
-  console.log(import_chalk27.default.green(`Tenant scope set to ${import_chalk27.default.bold(slug)}.`) + import_chalk27.default.dim("  (clear with `apiblaze tenant use --clear`)"));
+  console.log(import_chalk28.default.green(`Tenant scope set to ${import_chalk28.default.bold(slug)}.`) + import_chalk28.default.dim("  (clear with `apiblaze tenant use --clear`)"));
 }
 async function runTenantList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -3059,26 +3281,26 @@ async function runTenantList(opts) {
     return;
   }
   if (!tenants.length) {
-    console.log(import_chalk27.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
+    console.log(import_chalk28.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
     return;
   }
   for (const t of tenants) {
     const name = typeof t === "string" ? t : t.tenant_name;
-    const display = typeof t === "string" ? "" : import_chalk27.default.dim(`  ${t.display_name ?? ""}`);
-    console.log(`  ${import_chalk27.default.bold(name)}${display}`);
+    const display = typeof t === "string" ? "" : import_chalk28.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk28.default.bold(name)}${display}`);
   }
   const total = out?.total ?? tenants.length;
   if (total > tenants.length) {
-    console.log(import_chalk27.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
+    console.log(import_chalk28.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
   }
 }
 async function runTenantCreate(opts) {
   if (!opts.name) {
-    console.error(import_chalk27.default.red("--name (display name) is required."));
+    console.error(import_chalk28.default.red("--name (display name) is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora11.default)("Creating tenant...").start();
+  const spinner = (0, import_ora12.default)("Creating tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -3086,7 +3308,7 @@ async function runTenantCreate(opts) {
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
       summary: `Create tenant "${opts.name}"`
     });
-    spinner.succeed(`Created tenant ${import_chalk27.default.bold(out?.tenant_name ?? opts.name)}.`);
+    spinner.succeed(`Created tenant ${import_chalk28.default.bold(out?.tenant_name ?? opts.name)}.`);
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Tenant create failed.");
@@ -3095,12 +3317,12 @@ async function runTenantCreate(opts) {
 }
 async function runTenantAttach(project, opts) {
   if (!opts.tenant) {
-    console.error(import_chalk27.default.red("--tenant <slug> is required."));
+    console.error(import_chalk28.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora11.default)("Attaching tenant...").start();
+  const spinner = (0, import_ora12.default)("Attaching tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -3123,11 +3345,11 @@ async function runTenantDelete(slug, opts) {
       { type: "confirm", name: "confirm", message: `Permanently delete tenant "${slug}" and everything under it? This cannot be undone.`, default: false }
     ]);
     if (!confirm) {
-      console.log(import_chalk27.default.dim("Aborted."));
+      console.log(import_chalk28.default.dim("Aborted."));
       return;
     }
   }
-  const spinner = (0, import_ora11.default)("Deleting tenant...").start();
+  const spinner = (0, import_ora12.default)("Deleting tenant...").start();
   try {
     await admin({
       method: "DELETE",
@@ -3142,13 +3364,13 @@ async function runTenantDelete(slug, opts) {
 }
 async function runTenantCors(opts) {
   if (!opts.tenant) {
-    console.error(import_chalk27.default.red("--tenant <slug> is required."));
+    console.error(import_chalk28.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   const cors = origins.length ? { allowed_origins: origins } : null;
-  const spinner = (0, import_ora11.default)("Updating CORS...").start();
+  const spinner = (0, import_ora12.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
@@ -3164,11 +3386,12 @@ async function runTenantCors(opts) {
 }
 
 // src/commands/tenant-drill.ts
-var import_chalk28 = __toESM(require("chalk"));
-var import_ora12 = __toESM(require("ora"));
+var import_chalk29 = __toESM(require("chalk"));
+var import_ora13 = __toESM(require("ora"));
 var import_crypto = require("crypto");
 init_admin();
 init_auth();
+init_resolve();
 init_tenant_pick();
 var trailingComma = /\s*,\s*/;
 var parseList = (s) => s.split(trailingComma).map((x) => x.trim()).filter(Boolean);
@@ -3194,17 +3417,17 @@ async function validScopedTenant(teamId, query) {
   const next = { ...creds };
   delete next.activeTenant;
   saveCredentials2(next);
-  console.log(import_chalk28.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
+  console.log(import_chalk29.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
   return void 0;
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer3 } = await import("inquirer");
   const base = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
-  console.log(import_chalk28.default.bold(`
+  console.log(import_chalk29.default.bold(`
 Tenant ${tenant2}`));
-  console.log(import_chalk28.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
+  console.log(import_chalk29.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
-    const spinner = (0, import_ora12.default)("Reading tenant state...").start();
+    const spinner = (0, import_ora13.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
       admin({ method: "GET", path: `${base}/iam`, summary: "Read IAM toggle" }).catch(() => null),
       admin({ method: "GET", path: `${base}/cors`, summary: "Read tenant CORS" }).catch(() => null),
@@ -3218,18 +3441,18 @@ Tenant ${tenant2}`));
     const nClients = Array.isArray(clients) ? clients.length : 0;
     const nOpaque = opaque?.opaque?.endpoint ? 1 : 0;
     const nLogin = nClients + nIssuers + nOpaque;
-    const onOff = (b) => b ? import_chalk28.default.green("on") : import_chalk28.default.dim("off");
+    const onOff = (b) => b ? import_chalk29.default.green("on") : import_chalk29.default.dim("off");
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
       message: `Tenant ${tenant2}:`,
       pageSize: 12,
       choices: [
-        { name: `Login methods (${nLogin})  ${import_chalk28.default.dim("how your consumers sign in")}`, value: "login" },
-        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk28.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
-        { name: `Portal admins (${nEmails})  ${import_chalk28.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
-        new inquirer3.Separator(import_chalk28.default.dim("  Settings")),
-        { name: `CORS: ${cors?.cors ? import_chalk28.default.cyan(JSON.stringify(cors.cors)) : import_chalk28.default.dim("(unset)")}  ${import_chalk28.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
+        { name: `Login methods (${nLogin})  ${import_chalk29.default.dim("how your consumers sign in")}`, value: "login" },
+        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk29.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
+        { name: `Portal admins (${nEmails})  ${import_chalk29.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
+        new inquirer3.Separator(import_chalk29.default.dim("  Settings")),
+        { name: `CORS: ${cors?.cors ? import_chalk29.default.cyan(JSON.stringify(cors.cors)) : import_chalk29.default.dim("(unset)")}  ${import_chalk29.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -3242,7 +3465,7 @@ Tenant ${tenant2}`));
       case "iam": {
         const { v } = await inquirer3.prompt([{ type: "confirm", name: "v", message: "Enable Users & groups?", default: !!iam?.iam_enabled }]);
         await admin({ method: "PATCH", path: `${base}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
-        console.log(import_chalk28.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
+        console.log(import_chalk29.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
         break;
       }
       case "cors": {
@@ -3255,11 +3478,11 @@ Tenant ${tenant2}`));
         if (v === "") break;
         const parsed = v === "null" ? null : safeJson(v);
         if (parsed === void 0) {
-          console.log(import_chalk28.default.yellow("  Not valid JSON \u2014 unchanged."));
+          console.log(import_chalk29.default.yellow("  Not valid JSON \u2014 unchanged."));
           break;
         }
         await admin({ method: "PUT", path: `${base}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
-        console.log(import_chalk28.default.green("  CORS updated."));
+        console.log(import_chalk29.default.green("  CORS updated."));
         break;
       }
       case "emails":
@@ -3271,7 +3494,7 @@ Tenant ${tenant2}`));
 async function loginMethodsMenu(teamId, tenant2, base) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora12.default)("Loading login methods...").start();
+    const spinner = (0, import_ora13.default)("Loading login methods...").start();
     const [rawClients, rawIssuers, rawOpaque] = await Promise.all([
       admin({ method: "GET", path: `${base}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
       admin({ method: "GET", path: `${base}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
@@ -3283,15 +3506,15 @@ async function loginMethodsMenu(teamId, tenant2, base) {
     const choices = [];
     for (const c of appClients) {
       const nP = (c.providers ?? []).length || c.providers_count || 0;
-      choices.push({ name: `${import_chalk28.default.cyan("APIblaze-hosted")}  ${import_chalk28.default.bold(c.name ?? c.clientId)}  ${import_chalk28.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk28.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
+      choices.push({ name: `${import_chalk29.default.cyan("APIblaze-hosted")}  ${import_chalk29.default.bold(c.name ?? c.clientId)}  ${import_chalk29.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk29.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
     }
     for (const i of issuers) {
-      choices.push({ name: `${import_chalk28.default.cyan("Your own \u2014 JWT ")}  ${import_chalk28.default.bold(i.iss)}  ${import_chalk28.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
+      choices.push({ name: `${import_chalk29.default.cyan("Your own \u2014 JWT ")}  ${import_chalk29.default.bold(i.iss)}  ${import_chalk29.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
     }
     if (opaque?.endpoint) {
-      choices.push({ name: `${import_chalk28.default.cyan("Your own \u2014 opaque")}  ${import_chalk28.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
+      choices.push({ name: `${import_chalk29.default.cyan("Your own \u2014 opaque")}  ${import_chalk29.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
     }
-    if (!choices.length) console.log(import_chalk28.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
+    if (!choices.length) console.log(import_chalk29.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
@@ -3331,9 +3554,9 @@ async function addLoginMethod(teamId, tenant2, base) {
     message: "How do people log in?",
     pageSize: 8,
     choices: [
-      { name: `APIblaze hosted login page  ${import_chalk28.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
-      { name: `Your own hosted login \u2014 JWT  ${import_chalk28.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
-      { name: `Your own login \u2014 opaque token  ${import_chalk28.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
+      { name: `APIblaze hosted login page  ${import_chalk29.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
+      { name: `Your own hosted login \u2014 JWT  ${import_chalk29.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
+      { name: `Your own login \u2014 opaque token  ${import_chalk29.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
       { name: "\u2190 Back", value: null }
     ]
   }]);
@@ -3357,8 +3580,8 @@ function safeJson(s) {
 async function emailsMenu(base, emails) {
   const { default: inquirer3 } = await import("inquirer");
   console.log();
-  if (!emails.length) console.log(import_chalk28.default.dim("  No consumer-admin emails."));
-  for (const e of emails) console.log(`  ${import_chalk28.default.bold(e.email ?? e)}  ${import_chalk28.default.dim(e.status ?? "")}`);
+  if (!emails.length) console.log(import_chalk29.default.dim("  No consumer-admin emails."));
+  for (const e of emails) console.log(`  ${import_chalk29.default.bold(e.email ?? e)}  ${import_chalk29.default.dim(e.status ?? "")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
@@ -3373,7 +3596,7 @@ async function emailsMenu(base, emails) {
   if (act === "add") {
     const { email } = await inquirer3.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
     await admin({ method: "POST", path: `${base}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
-    console.log(import_chalk28.default.green(`  ${email} added.`));
+    console.log(import_chalk29.default.green(`  ${email} added.`));
   } else {
     const { e } = await inquirer3.prompt([{
       type: "list",
@@ -3383,7 +3606,7 @@ async function emailsMenu(base, emails) {
     }]);
     if (!e) return;
     await admin({ method: "DELETE", path: `${base}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
-    console.log(import_chalk28.default.green(`  ${e} removed.`));
+    console.log(import_chalk29.default.green(`  ${e} removed.`));
   }
 }
 async function addIssuer(base) {
@@ -3404,19 +3627,19 @@ async function addIssuer(base) {
     body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
     summary: `Add external issuer ${a.iss.trim()}`
   });
-  console.log(import_chalk28.default.green("  JWT login method saved."));
+  console.log(import_chalk29.default.green("  JWT login method saved."));
 }
 async function issuerHome(base, issuer) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk28.default.bold(issuer.iss)}  ${import_chalk28.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
+  ${import_chalk29.default.bold(issuer.iss)}  ${import_chalk29.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This JWT login method:",
     choices: [
       { name: "Replace it (re-enter details)", value: "edit" },
-      { name: import_chalk28.default.red("Delete it"), value: "rm" },
+      { name: import_chalk29.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -3432,7 +3655,7 @@ async function issuerHome(base, issuer) {
     path: `${base}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
     summary: `Delete issuer ${issuer.iss}`
   });
-  console.log(import_chalk28.default.green("  Deleted."));
+  console.log(import_chalk29.default.green("  Deleted."));
 }
 async function setOpaque(base, cur) {
   const { default: inquirer3 } = await import("inquirer");
@@ -3441,19 +3664,19 @@ async function setOpaque(base, cur) {
     { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
   ]);
   await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
-  console.log(import_chalk28.default.green("  Opaque login method set."));
+  console.log(import_chalk29.default.green("  Opaque login method set."));
 }
 async function opaqueHome(base, cur) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk28.default.bold(cur.endpoint)}  ${import_chalk28.default.dim(cur.method ?? "GET")}`);
+  ${import_chalk29.default.bold(cur.endpoint)}  ${import_chalk29.default.dim(cur.method ?? "GET")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This opaque login method:",
     choices: [
       { name: "Replace it", value: "edit" },
-      { name: import_chalk28.default.red("Delete it"), value: "rm" },
+      { name: import_chalk29.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -3463,14 +3686,14 @@ async function opaqueHome(base, cur) {
     return;
   }
   await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
-  console.log(import_chalk28.default.green("  Deleted."));
+  console.log(import_chalk29.default.green("  Deleted."));
 }
 async function clientHome(base, summary) {
   const { default: inquirer3 } = await import("inquirer");
   const id = summary.clientId ?? summary.client_id;
   const cBase = `${base}/app-clients/${encodeURIComponent(id)}`;
   for (; ; ) {
-    const spinner = (0, import_ora12.default)("Reading app client...").start();
+    const spinner = (0, import_ora13.default)("Reading app client...").start();
     const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
     spinner.stop();
     const cb = c.authorizedCallbackUrls ?? c.authorized_callback_urls ?? [];
@@ -3482,13 +3705,13 @@ async function clientHome(base, summary) {
       message: `${c.name ?? id}:`,
       pageSize: 12,
       choices: [
-        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk28.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
-        { name: `Callback URLs: ${cb.length ? import_chalk28.default.cyan(cb.join(", ")) : import_chalk28.default.dim("(none)")}`, value: "callbacks" },
-        { name: `Scopes: ${scopes.length ? import_chalk28.default.cyan(scopes.join(" ")) : import_chalk28.default.dim("(defaults)")}`, value: "scopes" },
+        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk29.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
+        { name: `Callback URLs: ${cb.length ? import_chalk29.default.cyan(cb.join(", ")) : import_chalk29.default.dim("(none)")}`, value: "callbacks" },
+        { name: `Scopes: ${scopes.length ? import_chalk29.default.cyan(scopes.join(" ")) : import_chalk29.default.dim("(defaults)")}`, value: "scopes" },
         { name: `Token expiries: access ${c.accessTokenExpiry ?? 3600}s \xB7 id ${c.idTokenExpiry ?? 3600}s \xB7 refresh ${c.refreshTokenExpiry ?? 2592e3}s`, value: "expiries" },
         { name: "Reveal client secret", value: "secret" },
         { name: "Rotate client secret", value: "rotate" },
-        { name: import_chalk28.default.red("Delete this app client"), value: "delete" },
+        { name: import_chalk29.default.red("Delete this app client"), value: "delete" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -3501,13 +3724,13 @@ async function clientHome(base, summary) {
       case "callbacks": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Callback URLs (comma-separated):", default: cb.join(", ") }]);
         await admin({ method: "PATCH", path: cBase, body: { authorizedCallbackUrls: parseList(v) }, summary: "Update callback URLs" });
-        console.log(import_chalk28.default.green("  Callbacks updated."));
+        console.log(import_chalk29.default.green("  Callbacks updated."));
         break;
       }
       case "scopes": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Scopes (space/comma-separated):", default: scopes.join(" ") }]);
         await admin({ method: "PATCH", path: cBase, body: { scopes: v.split(/[\s,]+/).filter(Boolean) }, summary: "Update scopes" });
-        console.log(import_chalk28.default.green("  Scopes updated."));
+        console.log(import_chalk29.default.green("  Scopes updated."));
         break;
       }
       case "expiries": {
@@ -3522,14 +3745,14 @@ async function clientHome(base, summary) {
           body: { accessTokenExpiry: Number(a.access), idTokenExpiry: Number(a.id), refreshTokenExpiry: Number(a.refresh) },
           summary: "Update token expiries"
         });
-        console.log(import_chalk28.default.green("  Expiries updated."));
+        console.log(import_chalk29.default.green("  Expiries updated."));
         break;
       }
       case "secret": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: "Print the client secret to this terminal?", default: false }]);
         if (!sure) break;
         const s = await admin({ method: "GET", path: `${cBase}/secret`, summary: "Reveal client secret" });
-        console.log(`  ${import_chalk28.default.bold("client_secret")}: ${import_chalk28.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk29.default.bold("client_secret")}: ${import_chalk29.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
         break;
       }
       case "rotate": {
@@ -3537,14 +3760,14 @@ async function clientHome(base, summary) {
         if (!sure) break;
         const fresh = randomSecret();
         await admin({ method: "PATCH", path: cBase, body: { clientSecret: fresh }, summary: "Rotate client secret" });
-        console.log(`  New ${import_chalk28.default.bold("client_secret")}: ${import_chalk28.default.green(fresh)}  ${import_chalk28.default.dim("(store it now)")}`);
+        console.log(`  New ${import_chalk29.default.bold("client_secret")}: ${import_chalk29.default.green(fresh)}  ${import_chalk29.default.dim("(store it now)")}`);
         break;
       }
       case "delete": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Delete app client "${c.name ?? id}"? Consumers logged in through it will lose access.`, default: false }]);
         if (!sure) break;
         await admin({ method: "DELETE", path: cBase, summary: `Delete app client ${id}` });
-        console.log(import_chalk28.default.green("  App client deleted."));
+        console.log(import_chalk29.default.green("  App client deleted."));
         return;
       }
     }
@@ -3565,15 +3788,15 @@ var DEFAULT_SCOPES2 = {
 async function providersMenu(cBase, clientLabel) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora12.default)("Loading providers...").start();
+    const spinner = (0, import_ora13.default)("Loading providers...").start();
     const raw = await admin({ method: "GET", path: `${cBase}/providers`, summary: "List login providers" }).catch(() => []);
     spinner.stop();
     const providers = Array.isArray(raw) ? raw : [];
     console.log();
     for (const p of providers) {
-      console.log(`  ${import_chalk28.default.bold(p.type)}  ${import_chalk28.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
+      console.log(`  ${import_chalk29.default.bold(p.type)}  ${import_chalk29.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
     }
-    if (!providers.length) console.log(import_chalk28.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
+    if (!providers.length) console.log(import_chalk29.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
@@ -3631,23 +3854,23 @@ async function providersMenu(cBase, clientLabel) {
         body.targetServerToken = routing;
       }
       await admin({ method: "POST", path: `${cBase}/providers`, body, summary: `Add ${type} login provider` });
-      console.log(import_chalk28.default.green(`  ${type} provider added.`));
+      console.log(import_chalk29.default.green(`  ${type} provider added.`));
     } else {
       const { p } = await inquirer3.prompt([{
         type: "list",
         name: "p",
         message: act === "rm" ? "Remove which provider?" : "Reveal which secret?",
-        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk28.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
+        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk29.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
       }]);
       if (!p) continue;
       if (act === "rm") {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Remove the ${p.type} provider? Consumers using it can no longer sign in.`, default: false }]);
         if (!sure) continue;
         await admin({ method: "DELETE", path: `${cBase}/providers/${encodeURIComponent(p.id)}`, summary: `Remove ${p.type} provider` });
-        console.log(import_chalk28.default.green(`  ${p.type} removed.`));
+        console.log(import_chalk29.default.green(`  ${p.type} removed.`));
       } else {
         const s = await admin({ method: "GET", path: `${cBase}/providers/${encodeURIComponent(p.id)}/secret`, summary: `Reveal ${p.type} provider secret` });
-        console.log(`  ${import_chalk28.default.bold("client_secret")}: ${import_chalk28.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk29.default.bold("client_secret")}: ${import_chalk29.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
       }
     }
   }
@@ -3655,9 +3878,11 @@ async function providersMenu(cBase, clientLabel) {
 
 // src/commands/spec.ts
 var fs7 = __toESM(require("fs"));
-var import_chalk29 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_chalk30 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
 init_admin();
+init_api();
+init_resolve();
 async function runSpecGet(project, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
@@ -3670,19 +3895,19 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk29.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk30.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs7.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk29.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk30.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora13.default)("Uploading spec...").start();
+  const spinner = (0, import_ora14.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -3690,24 +3915,91 @@ async function runSpecSet(project, opts) {
       body: { specContent },
       summary: `Set OpenAPI spec for ${proj2.projectName} v${proj2.apiVersion} from ${opts.file}`
     });
-    spinner.succeed(`Spec updated for ${proj2.projectName} v${proj2.apiVersion}.`);
+    const report = out?.report;
+    if (report?.reused || report && !report.changed) {
+      spinner.succeed(`Spec unchanged for ${proj2.projectName} v${proj2.apiVersion} (identical content).`);
+    } else {
+      spinner.succeed(`Spec updated for ${proj2.projectName} v${proj2.apiVersion}${report?.summary ? `: ${report.summary}` : "."}`);
+    }
+    if (report) printSpecChangeReport(report, proj2.projectName);
     if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
   } catch (err) {
     spinner.fail("Spec update failed.");
     throw err;
   }
 }
+function printSpecChangeReport(report, projectName) {
+  const r = report.routes;
+  if (r) {
+    for (const a of r.added) console.log(import_chalk30.default.green(`  + ${a}`));
+    for (const d of r.removed) console.log(import_chalk30.default.red(`  \u2212 ${d}`));
+    for (const rn of r.renamed ?? []) console.log(import_chalk30.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
+    for (const m of r.modified ?? []) console.log(import_chalk30.default.dim(`  \xB1 ${m} (params/schema changed)`));
+  }
+  if (report.applied?.mcp_regenerated) console.log(import_chalk30.default.dim("  MCP catalogue regenerated."));
+  if (report.applied?.candidates_cleared) console.log(import_chalk30.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
+  for (const item of report.attention ?? []) {
+    console.log(import_chalk30.default.yellow(`  \u26A0 ${item.detail}`));
+    if (item.suggestion?.carry_from && item.suggestion.carry_to) {
+      console.log(import_chalk30.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
+    }
+  }
+}
+async function runSpecCarry(project, opts) {
+  if (!opts.method || !opts.from || !opts.to) {
+    console.error(import_chalk30.default.red("--method, --from and --to are required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const spinner = (0, import_ora14.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
+  const res = await agentCall(`/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/carry`, "POST", {
+    method: opts.method.toUpperCase(),
+    from_resource: opts.from,
+    to_resource: opts.to,
+    ...opts.deleteSource ? { delete_source: true } : {}
+  });
+  if (res.status >= 200 && res.status < 300) {
+    spinner.succeed(`Rules carried to ${opts.method.toUpperCase()} ${opts.to}${opts.deleteSource ? " (old rules deleted)" : " \u2014 old rules kept until you delete them"}.`);
+    if (opts.json) console.log(JSON.stringify(res.data ?? { ok: true }));
+  } else {
+    spinner.fail(`Carry failed (${res.status}): ${res.data?.error ?? "unknown error"}`);
+    process.exit(1);
+  }
+}
+async function runSpecDeleteRule(project, opts) {
+  if (!opts.method || !opts.route) {
+    console.error(import_chalk30.default.red("--method and --route are required."));
+    process.exit(1);
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const encoded = opts.route.replace(/\{/g, "%7B").replace(/\}/g, "%7D");
+  const spinner = (0, import_ora14.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
+  const res = await agentCall(
+    `/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/${opts.method.toUpperCase()}${encoded.startsWith("/") ? encoded : `/${encoded}`}`,
+    "DELETE"
+  );
+  if (res.status >= 200 && res.status < 300 || res.status === 404) {
+    spinner.succeed(`Rules deleted for ${opts.method.toUpperCase()} ${opts.route}.`);
+  } else {
+    spinner.fail(`Delete failed (${res.status}): ${res.data?.error ?? "unknown error"}`);
+    process.exit(1);
+  }
+}
 
 // src/commands/agent.ts
-var import_chalk31 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_chalk32 = __toESM(require("chalk"));
+var import_ora15 = __toESM(require("ora"));
 init_auth();
 init_admin();
+init_resolve();
 
 // src/lib/tools.ts
-var import_chalk30 = __toESM(require("chalk"));
+var import_chalk31 = __toESM(require("chalk"));
 init_admin();
 init_api();
+init_resolve();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
 }
@@ -3724,15 +4016,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      const lines = [`  ${import_chalk30.default.dim("Proxy URL:")}  ${import_chalk30.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk30.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk31.default.dim("Proxy URL:")}  ${import_chalk31.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk31.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk30.default.bold("API keys")} ${import_chalk30.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk31.default.bold("API keys")} ${import_chalk31.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk30.default.cyan(env.padEnd(w))}  ${import_chalk30.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk31.default.cyan(env.padEnd(w))}  ${import_chalk31.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk30.default.dim("Try it:")}`, `    ${import_chalk30.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk31.default.dim("Try it:")}`, `    ${import_chalk31.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -3888,23 +4180,23 @@ function truncate(value, max = 1500) {
 }
 function printCost(resp) {
   const line = formatBilling(resp.billing);
-  if (line) console.log(import_chalk31.default.magenta(`  ${line}`) + import_chalk31.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
+  if (line) console.log(import_chalk32.default.magenta(`  ${line}`) + import_chalk32.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk31.default.bold("APIblaze agent") + import_chalk31.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk31.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk32.default.bold("APIblaze agent") + import_chalk32.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk32.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk31.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk32.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora14.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora15.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -3912,21 +4204,21 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk31.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk32.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp);
-      if (resp.reply) console.log(import_chalk31.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk32.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora14.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora15.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -3944,11 +4236,11 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk31.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk32.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk31.default.dim("\nBye."));
+  console.log(import_chalk32.default.dim("\nBye."));
 }
 
 // src/commands/config-browse.ts
@@ -4187,11 +4479,11 @@ function dig(blob, dotted) {
 }
 var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
 function show(v) {
-  if (v === void 0) return import_chalk32.default.dim("(unset)");
-  if (v === null) return import_chalk32.default.dim("null");
-  if (typeof v === "object") return import_chalk32.default.cyan(JSON.stringify(v));
-  if (typeof v === "boolean") return v ? import_chalk32.default.green("on") : import_chalk32.default.red("off");
-  return import_chalk32.default.cyan(String(v));
+  if (v === void 0) return import_chalk33.default.dim("(unset)");
+  if (v === null) return import_chalk33.default.dim("null");
+  if (typeof v === "object") return import_chalk33.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk33.default.green("on") : import_chalk33.default.red("off");
+  return import_chalk33.default.cyan(String(v));
 }
 function parseValue(raw) {
   if (raw === "true") return true;
@@ -4218,7 +4510,7 @@ async function fetchConfigBlob(proj2) {
 }
 async function patchSetting(proj2, s, value, cfg) {
   const body = s.toPatch(value, cfg);
-  const spinner = (0, import_ora15.default)(`Set ${s.key}...`).start();
+  const spinner = (0, import_ora16.default)(`Set ${s.key}...`).start();
   try {
     await admin({
       method: "PATCH",
@@ -4233,10 +4525,10 @@ async function patchSetting(proj2, s, value, cfg) {
   }
 }
 var loginFirst = (what) => {
-  console.log(import_chalk32.default.yellow(`
+  console.log(import_chalk33.default.yellow(`
   Log in first to ${what}.`));
-  console.log(import_chalk32.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
-  console.log(import_chalk32.default.dim("  anonymously and want to bring it into your account.\n"));
+  console.log(import_chalk33.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk33.default.dim("  anonymously and want to bring it into your account.\n"));
 };
 async function runConfig(project, key, value, opts) {
   const creds = loadCredentials();
@@ -4253,9 +4545,9 @@ async function runConfig(project, key, value, opts) {
   }
   const setting = SETTINGS.find((s) => s.key === key);
   if (!setting) {
-    console.error(import_chalk32.default.red(`Unknown setting "${key}".`));
-    console.error(import_chalk32.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
-    console.error(import_chalk32.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    console.error(import_chalk33.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk33.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk33.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
     process.exit(1);
   }
   if (value === void 0) {
@@ -4270,7 +4562,7 @@ async function pickProject(teamId) {
   const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const projects = await getProjects2(teamId).catch(() => []);
   if (!projects.length) {
-    console.error(import_chalk32.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    console.error(import_chalk33.default.red("No projects in this team. Create one: `npx apiblaze create`."));
     process.exit(1);
   }
   const { default: inquirer3 } = await import("inquirer");
@@ -4278,7 +4570,7 @@ async function pickProject(teamId) {
     type: "list",
     name: "picked",
     message: "Which project?",
-    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk32.default.dim("v" + p.apiVersion)}`, value: p }))
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk33.default.dim("v" + p.apiVersion)}`, value: p }))
   }]);
   return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
 }
@@ -4289,25 +4581,25 @@ function printAll(proj2, cfg, json) {
     console.log(JSON.stringify(out, null, 2));
     return;
   }
-  console.log(import_chalk32.default.bold(`
+  console.log(import_chalk33.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
   for (const group2 of SETTING_GROUPS) {
-    console.log(import_chalk32.default.bold(group2));
+    console.log(import_chalk33.default.bold(group2));
     for (const s of SETTINGS.filter((x) => x.group === group2)) {
-      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk32.default.dim(s.desc)}`);
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk33.default.dim(s.desc)}`);
     }
     console.log();
   }
-  console.log(import_chalk32.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+  console.log(import_chalk33.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
 }
 async function discoveryMenu(project) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk32.default.bold(`
+  console.log(import_chalk33.default.bold(`
 APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
 `));
-  console.log(import_chalk32.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
-  console.log(import_chalk32.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  console.log(import_chalk33.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk33.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
@@ -4315,13 +4607,13 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
       message: "Explore:",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk32.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk33.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({
-          name: `${g}  ${import_chalk32.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          name: `${g}  ${import_chalk33.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
           value: { kind: "settings", g }
         })),
-        new inquirer3.Separator(import_chalk32.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk32.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer3.Separator(import_chalk33.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk33.default.dim(f.desc)}`, value: { kind: "feature", f } })),
         new inquirer3.Separator(),
         { name: "Exit", value: { kind: "exit" } }
       ]
@@ -4330,24 +4622,24 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
     if (pick2.kind === "settings") {
       console.log();
       for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
-        console.log(`  ${import_chalk32.default.bold(s.label.padEnd(28))} ${import_chalk32.default.dim(s.desc)}`);
-        console.log(`  ${import_chalk32.default.dim("  key: " + s.key)}`);
+        console.log(`  ${import_chalk33.default.bold(s.label.padEnd(28))} ${import_chalk33.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk33.default.dim("  key: " + s.key)}`);
       }
       loginFirst("view or change these settings");
     } else {
       const f = pick2.f;
       console.log(`
-  ${import_chalk32.default.bold(f.label)} \u2014 ${f.desc}`);
+  ${import_chalk33.default.bold(f.label)} \u2014 ${f.desc}`);
       loginFirst(`use ${f.label.toLowerCase()}`);
     }
   }
 }
 async function navigator(proj2, cfg, opts) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk32.default.bold(`
+  console.log(import_chalk33.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
 `));
-  console.log(import_chalk32.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  console.log(import_chalk33.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
   let blob = cfg;
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
@@ -4356,10 +4648,10 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
       message: "Where to?",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk32.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk33.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
-        new inquirer3.Separator(import_chalk32.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk32.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer3.Separator(import_chalk33.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk33.default.dim(f.desc)}`, value: { kind: f.go } })),
         new inquirer3.Separator(),
         { name: "Show all settings", value: { kind: "list" } },
         { name: "Exit", value: { kind: "exit" } }
@@ -4399,7 +4691,7 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
         }
       }
     } catch (err) {
-      console.error(import_chalk32.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_chalk33.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
 }
@@ -4413,7 +4705,7 @@ async function settingsGroup(proj2, cfg, group2) {
       message: group2 + ":",
       pageSize: 16,
       choices: [
-        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk32.default.dim(s2.desc)}`, value: s2 })),
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk33.default.dim(s2.desc)}`, value: s2 })),
         new inquirer3.Separator(),
         { name: "\u2190 Back", value: null }
       ]
@@ -4431,7 +4723,7 @@ async function settingsGroup(proj2, cfg, group2) {
     } else if (s.type === "number") {
       const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
       if (v === "" || Number.isNaN(Number(v))) {
-        console.log(import_chalk32.default.yellow("  Not a number \u2014 unchanged."));
+        console.log(import_chalk33.default.yellow("  Not a number \u2014 unchanged."));
         continue;
       }
       value = Number(v);
@@ -4512,7 +4804,7 @@ async function buildCondition(phase) {
   const items = [];
   for (; ; ) {
     const a = await inquirer3.prompt([
-      { type: "input", name: "source", message: `Condition field ${import_chalk32.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
+      { type: "input", name: "source", message: `Condition field ${import_chalk33.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
       { type: "list", name: "operator", message: "Operator:", choices: [
         "eq",
         "neq",
@@ -4543,7 +4835,7 @@ async function buildCondition(phase) {
 function showCondition(cond) {
   if (!Array.isArray(cond) || !cond.length) return "";
   const s = cond.map((c) => `${c.source} ${c.operator}${c.value !== void 0 ? ` "${c.value}"` : ""}${c.logicOp ? ` ${c.logicOp}` : ""}`).join(" ");
-  return import_chalk32.default.dim(`  when ${s}`);
+  return import_chalk33.default.dim(`  when ${s}`);
 }
 async function transformsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
@@ -4552,12 +4844,12 @@ async function transformsMenu(proj2) {
     const out = await admin({ method: "GET", path: base, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
-    if (!rules.length) console.log(import_chalk32.default.dim("  No transform rules yet."));
+    if (!rules.length) console.log(import_chalk33.default.dim("  No transform rules yet."));
     for (const r of rules) {
       const a = r.action ?? {};
       const fns = [...a.source_fns ?? [], ...a.dest_fns ?? []].map((f) => f.fn);
-      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk32.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
-      console.log(`  ${r.enabled ? import_chalk32.default.green("\u25CF") : import_chalk32.default.dim("\u25CB")} ${import_chalk32.default.bold(r.name)}  ${import_chalk32.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk33.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
+      console.log(`  ${r.enabled ? import_chalk33.default.green("\u25CF") : import_chalk33.default.dim("\u25CB")} ${import_chalk33.default.bold(r.name)}  ${import_chalk33.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -4569,7 +4861,7 @@ async function transformsMenu(proj2) {
           { name: "Enable/disable a rule", value: "toggle" },
           { name: "Delete a rule", value: "delete" }
         ] : [],
-        { name: import_chalk32.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
+        { name: import_chalk33.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -4582,11 +4874,11 @@ async function transformsMenu(proj2) {
       }]);
       const body = parseValue(raw);
       if (!body || typeof body !== "object" || Array.isArray(body)) {
-        console.log(import_chalk32.default.yellow("  Not a JSON object \u2014 skipped."));
+        console.log(import_chalk33.default.yellow("  Not a JSON object \u2014 skipped."));
         continue;
       }
       await admin({ method: "POST", path: base, body, summary: "Create transform rule (raw JSON)" });
-      console.log(import_chalk32.default.green("  Rule created."));
+      console.log(import_chalk33.default.green("  Rule created."));
       continue;
     }
     if (act === "add") {
@@ -4602,7 +4894,7 @@ async function transformsMenu(proj2) {
           { name: "Remove a field", value: "remove" }
         ] }
       ]);
-      const fieldHint = import_chalk32.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      const fieldHint = import_chalk33.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
       let action2;
       if (ans.kind === "hardcode") {
         const a = await inquirer3.prompt([
@@ -4631,7 +4923,7 @@ async function transformsMenu(proj2) {
         };
       }
       const condition = await buildCondition(ans.phase);
-      const spinner = (0, import_ora15.default)("Creating rule...").start();
+      const spinner = (0, import_ora16.default)("Creating rule...").start();
       try {
         await admin({
           method: "POST",
@@ -4649,16 +4941,16 @@ async function transformsMenu(proj2) {
         type: "list",
         name: "rule",
         message: act === "toggle" ? "Which rule?" : "Delete which rule?",
-        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk32.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk33.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
       }]);
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
         await admin({ method: "PUT", path: `${base}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
-        console.log(import_chalk32.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+        console.log(import_chalk33.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
         await admin({ method: "DELETE", path: `${base}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
-        console.log(import_chalk32.default.green(`  ${rule.name} deleted.`));
+        console.log(import_chalk33.default.green(`  ${rule.name} deleted.`));
       }
     }
   }
@@ -4670,9 +4962,9 @@ async function mappingsMenu(proj2) {
     const out = await admin({ method: "GET", path: base, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
-    if (!tables.length) console.log(import_chalk32.default.dim("  No mapping tables yet."));
+    if (!tables.length) console.log(import_chalk33.default.dim("  No mapping tables yet."));
     for (const t of tables) {
-      console.log(`  ${import_chalk32.default.bold(t.name)}  ${import_chalk32.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+      console.log(`  ${import_chalk33.default.bold(t.name)}  ${import_chalk33.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -4692,11 +4984,11 @@ async function mappingsMenu(proj2) {
       ]);
       const entries2 = parseValue(a.entries);
       if (!Array.isArray(entries2)) {
-        console.log(import_chalk32.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        console.log(import_chalk33.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
       await admin({ method: "POST", path: base, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
-      console.log(import_chalk32.default.green(`  Table "${a.name}" created.`));
+      console.log(import_chalk33.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer3.prompt([{
         type: "list",
@@ -4706,7 +4998,7 @@ async function mappingsMenu(proj2) {
       }]);
       if (!table) continue;
       await admin({ method: "DELETE", path: `${base}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
-      console.log(import_chalk32.default.green(`  ${table.name} deleted.`));
+      console.log(import_chalk33.default.green(`  ${table.name} deleted.`));
     }
   }
 }
@@ -4717,14 +5009,14 @@ async function tenantsMenu(proj2, opts) {
     const out = await admin({ method: "GET", path: base, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
-    if (!tenants.length) console.log(import_chalk32.default.dim("  No tenants attached (consumers use the default tenant)."));
-    for (const t of tenants) console.log(`  ${import_chalk32.default.bold(t.tenant_name ?? t.name)}  ${import_chalk32.default.dim(t.display_name ?? "")}`);
+    if (!tenants.length) console.log(import_chalk33.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk33.default.bold(t.tenant_name ?? t.name)}  ${import_chalk33.default.dim(t.display_name ?? "")}`);
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
       message: "Tenants:",
       choices: [
-        { name: `Manage a tenant\u2026  ${import_chalk32.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
+        { name: `Manage a tenant\u2026  ${import_chalk33.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
         { name: "Attach a tenant to this project", value: "attach" },
         ...tenants.length ? [{ name: "Detach a tenant from this project", value: "detach" }] : [],
         { name: "\u2190 Back", value: "back" }
@@ -4747,7 +5039,7 @@ async function tenantsMenu(proj2, opts) {
       }]);
       if (!t) continue;
       await admin({ method: "DELETE", path: `${base}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
-      console.log(import_chalk32.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+      console.log(import_chalk33.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
 }
@@ -4790,7 +5082,7 @@ async function specMenu(proj2, opts) {
     choices: [
       { name: "Print the stored spec", value: "get" },
       { name: "Refresh the spec from its source", value: "refresh" },
-      { name: import_chalk32.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: import_chalk33.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -4798,7 +5090,7 @@ async function specMenu(proj2, opts) {
   if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
   else if (act === "refresh") {
     await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
-    console.log(import_chalk32.default.green("  Spec refresh triggered."));
+    console.log(import_chalk33.default.green("  Spec refresh triggered."));
   } else await runOpenapi(proj2.projectName, proj2.apiVersion);
 }
 async function agentsMenu(proj2, opts) {
@@ -4823,16 +5115,17 @@ async function agentsMenu(proj2, opts) {
 }
 
 // src/commands/group.ts
-var import_chalk33 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_chalk34 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
 init_auth();
 init_admin();
+init_resolve();
 init_types();
 var DASHBOARD_BASE6 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 var IAM_BASE = process.env.APIBLAZE_IAM_BASE || "https://iam.apiblaze.com";
 async function resolveTransport(opts) {
-  const producer = loadCredentials();
-  if (producer) {
+  const producer2 = loadCredentials();
+  if (producer2) {
     const { teamId } = await resolveTeam(void 0);
     let tenant2 = (opts.tenant ?? "").trim().toLowerCase();
     if (!tenant2) {
@@ -4913,11 +5206,11 @@ async function runGroupList(opts) {
   const t = await resolveTransport(opts);
   const groups = await listGroups(t);
   if (opts.json) return void console.log(JSON.stringify(groups));
-  if (!groups.length) return void console.log(import_chalk33.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
-  console.log(import_chalk33.default.dim(`Tenant ${t.tenant}:`));
+  if (!groups.length) return void console.log(import_chalk34.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk34.default.dim(`Tenant ${t.tenant}:`));
   for (const g of groups) {
-    const sealed = g.name === "apiblaze_admins" ? import_chalk33.default.dim("  (admins \u2014 managed by allowlist)") : "";
-    console.log(`  ${import_chalk33.default.bold(g.name)}  ${import_chalk33.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+    const sealed = g.name === "apiblaze_admins" ? import_chalk34.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk34.default.bold(g.name)}  ${import_chalk34.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
   }
 }
 async function runGroupCreate(name, opts) {
@@ -4942,10 +5235,10 @@ async function runGroupCreate(name, opts) {
       }
     }
   }
-  const spinner = (0, import_ora16.default)(`Creating group ${name}...`).start();
+  const spinner = (0, import_ora17.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
-    spinner.succeed(`Group ${import_chalk33.default.bold(name)} created in ${t.tenant}.`);
+    spinner.succeed(`Group ${import_chalk34.default.bold(name)} created in ${t.tenant}.`);
   } catch (e) {
     spinner.fail("Create failed.");
     throw e;
@@ -4954,10 +5247,10 @@ async function runGroupCreate(name, opts) {
 async function runGroupDelete(name, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, name);
-  const spinner = (0, import_ora16.default)(`Deleting group ${name}...`).start();
+  const spinner = (0, import_ora17.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
-    spinner.succeed(`Group ${import_chalk33.default.bold(name)} deleted.`);
+    spinner.succeed(`Group ${import_chalk34.default.bold(name)} deleted.`);
   } catch (e) {
     spinner.fail("Delete failed.");
     throw e;
@@ -4970,20 +5263,20 @@ async function runGroupMembers(name, opts) {
   const subs = await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/subgroups`);
   if (opts.json) return void console.log(JSON.stringify({ ...detail, subgroups: subs?.subgroups ?? [] }));
   const members = detail?.members ?? [];
-  console.log(import_chalk33.default.bold(`${g.name}`) + import_chalk33.default.dim(`  (${t.tenant})`));
-  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk33.default.cyan("group-admin") : import_chalk33.default.dim("member")}`);
-  if (!members.length) console.log(import_chalk33.default.dim("  no members"));
+  console.log(import_chalk34.default.bold(`${g.name}`) + import_chalk34.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk34.default.cyan("group-admin") : import_chalk34.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk34.default.dim("  no members"));
   const sg = subs?.subgroups ?? [];
-  if (sg.length) console.log(import_chalk33.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+  if (sg.length) console.log(import_chalk34.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
 }
 async function runGroupAddUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
   const role = opts.role === "admin" ? "admin" : "member";
-  const spinner = (0, import_ora16.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  const spinner = (0, import_ora17.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
-    spinner.succeed(`${import_chalk33.default.bold(label2(u))} added to ${import_chalk33.default.bold(g.name)} as ${role}.`);
+    spinner.succeed(`${import_chalk34.default.bold(label2(u))} added to ${import_chalk34.default.bold(g.name)} as ${role}.`);
   } catch (e) {
     spinner.fail("Add failed.");
     throw e;
@@ -4992,10 +5285,10 @@ async function runGroupAddUser(userRef, groupName, opts) {
 async function runGroupRemoveUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
-  const spinner = (0, import_ora16.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  const spinner = (0, import_ora17.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
-    spinner.succeed(`${import_chalk33.default.bold(label2(u))} removed from ${import_chalk33.default.bold(g.name)}.`);
+    spinner.succeed(`${import_chalk34.default.bold(label2(u))} removed from ${import_chalk34.default.bold(g.name)}.`);
   } catch (e) {
     spinner.fail("Remove failed.");
     throw e;
@@ -5004,10 +5297,10 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
 async function runGroupAddGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora16.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  const spinner = (0, import_ora17.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
-    spinner.succeed(`${import_chalk33.default.bold(child.name)} is now a subgroup of ${import_chalk33.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk34.default.bold(child.name)} is now a subgroup of ${import_chalk34.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Nest failed.");
     throw e;
@@ -5016,10 +5309,10 @@ async function runGroupAddGroup(childName, parentName, opts) {
 async function runGroupRemoveGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora16.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  const spinner = (0, import_ora17.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
-    spinner.succeed(`${import_chalk33.default.bold(child.name)} un-nested from ${import_chalk33.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk34.default.bold(child.name)} un-nested from ${import_chalk34.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Un-nest failed.");
     throw e;
@@ -5030,20 +5323,20 @@ async function runGroupUsers(opts) {
   const users = await listUsers(t);
   const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
   if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
-  console.log(import_chalk33.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
-  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk33.default.dim(u.abz_sub)}`);
-  if (!users.length) console.log(import_chalk33.default.dim("  no users yet"));
+  console.log(import_chalk34.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk34.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk34.default.dim("  no users yet"));
   const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
   if (fresh.length) {
-    console.log(import_chalk33.default.dim("Seen in traffic (not yet users):"));
-    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk33.default.dim(o.source_label ?? "")}`);
+    console.log(import_chalk34.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk34.default.dim(o.source_label ?? "")}`);
   }
 }
 
 // src/commands/key.ts
-var import_chalk34 = __toESM(require("chalk"));
-var import_ora17 = __toESM(require("ora"));
-init_admin();
+var import_chalk35 = __toESM(require("chalk"));
+var import_ora18 = __toESM(require("ora"));
+init_caller();
 async function runApikeysMenu(opts) {
   await runKeyList(opts);
   if (opts.json) return;
@@ -5058,8 +5351,9 @@ async function runApikeysMenu(opts) {
   await runKeyMint({ ...opts, desc: desc || void 0 });
 }
 async function runKeyList(opts) {
-  const { teamId, teamName } = await resolveTeam(opts.team);
-  const out = await admin({
+  const caller = requireCaller();
+  const { teamId, teamName } = await resolveActingTeam(caller, opts.team);
+  const out = await producer(caller, {
     method: "GET",
     path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
     summary: `List developer keys for team ${teamName ?? teamId}`
@@ -5070,21 +5364,23 @@ async function runKeyList(opts) {
     return;
   }
   if (!keys.length) {
-    console.log(import_chalk34.default.yellow("No developer keys."));
+    console.log(import_chalk35.default.yellow("No developer keys."));
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk34.default.bold(k.key_id ?? k.id)}  ${import_chalk34.default.dim(k.description ?? "")}  ${import_chalk34.default.dim(k.expires_at ?? "no expiry")}`);
+    console.log(`  ${import_chalk35.default.bold(k.key_id ?? k.id)}  ${import_chalk35.default.dim(k.description ?? "")}  ${import_chalk35.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
-  const { teamId } = await resolveTeam(opts.team);
+  if (process.env.ABZ_DEBUG_OPTS) console.error("DEBUG opts:", JSON.stringify(opts));
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
   const body = { role: "consumer-admin" };
   if (opts.desc) body.description = opts.desc;
   if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
-  const spinner = (0, import_ora17.default)("Minting key...").start();
+  const spinner = (0, import_ora18.default)("Minting key...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "POST",
       path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
       body,
@@ -5095,19 +5391,20 @@ async function runKeyMint(opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    console.log(`  ${import_chalk34.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk34.default.bold("key")}:     ${import_chalk34.default.green(out?.key)}  ${import_chalk34.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk34.default.dim("expires:")} ${out.expires_at}`);
+    console.log(`  ${import_chalk35.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk35.default.bold("key")}:     ${import_chalk35.default.green(out?.key)}  ${import_chalk35.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk35.default.dim("expires:")} ${out.expires_at}`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
   }
 }
 async function runKeyRevoke(keyId, opts) {
-  const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora17.default)("Revoking key...").start();
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const spinner = (0, import_ora18.default)("Revoking key...").start();
   try {
-    await admin({
+    await producer(caller, {
       method: "DELETE",
       path: `/teams/${encodeURIComponent(teamId)}/developer-keys/${encodeURIComponent(keyId)}`,
       summary: `Revoke developer key ${keyId}`
@@ -5119,12 +5416,116 @@ async function runKeyRevoke(keyId, opts) {
   }
 }
 
+// src/index.ts
+init_iam();
+
+// src/commands/preapprove.ts
+var import_chalk36 = __toESM(require("chalk"));
+var import_ora19 = __toESM(require("ora"));
+
+// src/lib/preapproval.ts
+init_auth();
+init_admin();
+init_resolve();
+init_types();
+var DASHBOARD_BASE7 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+async function iamCall(tenant2, path8, method = "GET", body) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE7}/api/cli/iam`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
+  return data;
+}
+async function resolveProducerTenant(tenantOpt) {
+  if (!loadCredentials()) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const tenant2 = (tenantOpt ?? "").trim().toLowerCase();
+  if (tenant2) return tenant2;
+  const { teamId } = await resolveTeam(void 0);
+  const out = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants`, summary: "List tenants" });
+  const tenants = (out?.tenants ?? []).map((t) => String(t.tenant_name ?? t.name ?? t)).filter((t) => !t.startsWith("op"));
+  if (tenants.length === 0) throw new Error("No tenants in your team yet. Create a proxy first, or pass --tenant.");
+  if (tenants.length === 1) return tenants[0];
+  const { default: inquirer3 } = await import("inquirer");
+  const ans = await inquirer3.prompt([{ type: "list", name: "tenant", message: "Which tenant?", choices: tenants }]);
+  return String(ans.tenant);
+}
+function classify(input) {
+  const value = input.trim().replace(/^@/, "").toLowerCase();
+  return { kind: value.includes("@") ? "email" : "domain", value };
+}
+async function addPreapprovalRule(tenant2, input, groups) {
+  const { kind, value } = classify(input);
+  return iamCall(tenant2, "/v1/admin/preapproval/rules", "POST", {
+    kind,
+    value,
+    ...groups && groups.length ? { groups } : {}
+  });
+}
+async function listPreapprovalRules(tenant2) {
+  const out = await iamCall(tenant2, "/v1/admin/preapproval/rules", "GET");
+  return out?.rules ?? [];
+}
+async function removePreapprovalRule(tenant2, input) {
+  const { value } = classify(input);
+  const rules = await listPreapprovalRules(tenant2);
+  const hit = rules.find((r) => r.value.toLowerCase() === value);
+  if (!hit) return { removed: false, value };
+  await iamCall(tenant2, `/v1/admin/preapproval/rules/${encodeURIComponent(hit.id)}`, "DELETE");
+  return { removed: true, value };
+}
+
+// src/commands/preapprove.ts
+async function runPreapprove(who, opts) {
+  const tenant2 = await resolveProducerTenant(opts.tenant);
+  if (opts.list) {
+    const rules = await listPreapprovalRules(tenant2);
+    if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
+    if (!rules.length) {
+      console.log(import_chalk36.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk36.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      return;
+    }
+    console.log(import_chalk36.default.dim(`Pre-approved for ${import_chalk36.default.bold(tenant2)}:`));
+    for (const r of rules) {
+      const tag = r.kind === "domain" ? import_chalk36.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk36.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      console.log(`  ${tag}${grp}`);
+    }
+    return;
+  }
+  if (!who) {
+    throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
+  }
+  if (opts.remove) {
+    const spinner2 = (0, import_ora19.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const { removed, value } = await removePreapprovalRule(tenant2, who);
+    if (removed) spinner2.succeed(`${import_chalk36.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk36.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    return;
+  }
+  const spinner = (0, import_ora19.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  try {
+    const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
+    const what = kind === "domain" ? `Anyone @${value}` : value;
+    spinner.succeed(`${import_chalk36.default.bold(what)} can now sign in to ${import_chalk36.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk36.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk36.default.dim(`  See the full list:  apiblaze preapprove --list`));
+  } catch (err) {
+    spinner.fail("Could not add the rule.");
+    throw err;
+  }
+}
+
 // src/commands/apichat.ts
 var fs9 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk36 = __toESM(require("chalk"));
-var import_ora18 = __toESM(require("ora"));
+var import_chalk38 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 var import_yaml = require("yaml");
 init_auth();
 init_anon_cred();
@@ -5134,7 +5535,7 @@ init_admin();
 // src/commands/llm.ts
 var fs8 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
-var import_chalk35 = __toESM(require("chalk"));
+var import_chalk37 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_auth();
 var LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
@@ -5178,27 +5579,27 @@ async function runLlmSetKey(keyArg, opts) {
   }
   const existing = loadLlmConfig();
   saveLlmConfig({ key, provider, model: opts.model ?? existing?.model });
-  console.log(`${import_chalk35.default.green("\u2713")} Saved ${import_chalk35.default.bold(provider)} key ${maskSecret(key)}`);
-  console.log(import_chalk35.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
-  if (opts.model) console.log(import_chalk35.default.gray(`  Model: ${opts.model}`));
+  console.log(`${import_chalk37.default.green("\u2713")} Saved ${import_chalk37.default.bold(provider)} key ${maskSecret(key)}`);
+  console.log(import_chalk37.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
+  if (opts.model) console.log(import_chalk37.default.gray(`  Model: ${opts.model}`));
 }
 async function runLlmShow() {
   const cfg = loadLlmConfig();
   if (!cfg) {
-    console.log(import_chalk35.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
+    console.log(import_chalk37.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
     return;
   }
-  console.log(`Provider: ${import_chalk35.default.bold(cfg.provider)}`);
+  console.log(`Provider: ${import_chalk37.default.bold(cfg.provider)}`);
   console.log(`Key:      ${maskSecret(cfg.key)}`);
   if (cfg.model) console.log(`Model:    ${cfg.model}`);
-  console.log(import_chalk35.default.gray(`Stored at ${LLM_PATH}`));
+  console.log(import_chalk37.default.gray(`Stored at ${LLM_PATH}`));
 }
 async function runLlmClearKey() {
   try {
     fs8.unlinkSync(LLM_PATH);
-    console.log(`${import_chalk35.default.green("\u2713")} Removed local LLM key.`);
+    console.log(`${import_chalk37.default.green("\u2713")} Removed local LLM key.`);
   } catch {
-    console.log(import_chalk35.default.gray("No LLM key was set."));
+    console.log(import_chalk37.default.gray("No LLM key was set."));
   }
 }
 
@@ -5206,9 +5607,9 @@ async function runLlmClearKey() {
 init_trace();
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk36.default.red(`
+  console.error(import_chalk38.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk36.default.dim(hint));
+  if (hint) console.error(import_chalk38.default.dim(hint));
   process.exit(1);
 }
 function normalizeName2(raw) {
@@ -5356,7 +5757,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk36.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk38.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -5433,7 +5834,16 @@ async function provision(spec2, target, opts) {
   if (!base && spec2.info && typeof spec2.info.title === "string") base = normalizeName2(spec2.info.title);
   if (!base || base.length < 3) base = "apichat";
   let name = opts.name ? base : `${base}${salt()}`;
-  const spinner = (0, import_ora18.default)("Provisioning an api_key proxy...").start();
+  const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
+  if (anon && opts.access === "invite") {
+    console.log(import_chalk38.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+  }
+  const DUAL_AUTH = {
+    mode: "authenticate",
+    methods: ["api_key", "jwt"],
+    ...access === "invite" ? { preapproved_users_only: true } : {}
+  };
+  const spinner = (0, import_ora20.default)("Provisioning an api_key proxy...").start();
   let result;
   for (let attempt = 0; attempt < 4; attempt++) {
     try {
@@ -5443,6 +5853,7 @@ async function provision(spec2, target, opts) {
           name,
           target_url: target,
           auth_type: "api_key",
+          requests_auth: DUAL_AUTH,
           team_id: creds.teamId,
           ...opts.apiversion ? { api_version: opts.apiversion } : {}
         });
@@ -5454,6 +5865,7 @@ async function provision(spec2, target, opts) {
           target,
           target_url: target,
           auth_type: "api_key",
+          requests_auth: DUAL_AUTH,
           ...opts.apiversion ? { api_version: opts.apiversion } : {}
         };
         if (cred) {
@@ -5510,10 +5922,21 @@ async function provision(spec2, target, opts) {
   if (!dpKey) fail4("The proxy was created but no api_key was returned \u2014 cannot authenticate the chat.");
   const mcpHost = result.mcpHost || `${projectId}.mcp.${anon ? "tryabz.run" : "abz.run"}`;
   const proxyUrl = Array.isArray(result.endpoints) && (result.endpoints.find((e) => e.includes(`/${environment}`)) || result.endpoints[0]) || (anon ? `https://${projectId}.tryabz.run/${version2}/${environment}` : `https://${projectId}.abz.run/${version2}/${environment}`);
-  return { projectId, version: version2, environment, dpKey, mcpHost, proxyUrl, anon };
+  const tenant2 = typeof result.tenant === "string" ? result.tenant : void 0;
+  if (access === "invite" && tenant2) {
+    const email = loadCredentials()?.email;
+    if (email) {
+      try {
+        await addPreapprovalRule(tenant2, email);
+      } catch {
+        console.log(import_chalk38.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+      }
+    }
+  }
+  return { projectId, version: version2, environment, dpKey, mcpHost, proxyUrl, anon, access, tenant: tenant2 };
 }
 async function writeTargetAuth(p, auth, secret) {
-  const spinner = (0, import_ora18.default)("Storing target credentials (encrypted)...").start();
+  const spinner = (0, import_ora20.default)("Storing target credentials (encrypted)...").start();
   try {
     await cpPost(
       p.anon,
@@ -5535,7 +5958,7 @@ async function writeTargetAuth(p, auth, secret) {
   }
 }
 async function uploadSpec(p, specText, opts) {
-  const spinner = (0, import_ora18.default)("Uploading the spec...").start();
+  const spinner = (0, import_ora20.default)("Uploading the spec...").start();
   let out;
   try {
     out = await cpPost(
@@ -5550,7 +5973,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk36.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk38.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -5558,12 +5981,12 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk36.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk38.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
 async function publishMcp(p, spec2) {
-  const spinner = (0, import_ora18.default)("Publishing the MCP catalogue...").start();
+  const spinner = (0, import_ora20.default)("Publishing the MCP catalogue...").start();
   try {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
@@ -5599,14 +6022,14 @@ var revealAuth = false;
 function renderToolEvents(events, dpKey) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk36.default.green("\u2713") : import_chalk36.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk36.default.cyan(e.name)} ${import_chalk36.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
+    const mark = ok ? import_chalk38.default.green("\u2713") : import_chalk38.default.red("\u2717");
+    console.log(`  ${mark} ${import_chalk38.default.cyan(e.name)} ${import_chalk38.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk36.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
+      console.log(import_chalk38.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
       if (dpKey) {
         const keyLine = `        -H 'X-API-Key: ${revealAuth ? dpKey : maskKey(dpKey)}'`;
-        const hint = revealAuth ? "" : import_chalk36.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk36.default.dim(keyLine) + hint);
+        const hint = revealAuth ? "" : import_chalk38.default.yellow("  \u2190 /showauth will reveal this");
+        console.log(import_chalk38.default.dim(keyLine) + hint);
       }
     }
   }
@@ -5615,9 +6038,9 @@ function billingLine(billing) {
   if (!billing || typeof billing.cents !== "number") return null;
   if (typeof billing.free_turns_remaining === "number") return null;
   const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk36.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk36.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
+  let line = import_chalk38.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk38.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
   if (typeof billing.credits_remaining === "number") {
-    line += import_chalk36.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk38.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -5625,21 +6048,21 @@ function freeBudgetWarning(billing, anon) {
   if (!anon || !billing) return null;
   if (typeof billing.free_turns_remaining === "number") {
     const left2 = billing.free_turns_remaining;
-    if (left2 <= 0) return import_chalk36.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk36.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left`);
+    if (left2 <= 0) return import_chalk38.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk38.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof billing.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(billing.cents || 0, 0.02);
   const left = Math.floor(billing.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk36.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk36.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk38.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk38.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 function printAssistant(delta) {
   for (let i = delta.length - 1; i >= 0; i--) {
     const m = delta[i];
     if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk36.default.green("assistant \u203A ") + m.content + "\n");
+      console.log("\n" + import_chalk38.default.green("assistant \u203A ") + m.content + "\n");
       return;
     }
   }
@@ -5649,7 +6072,7 @@ async function replTurn(p, messages, userText) {
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
   for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora18.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
+    const spinner = (0, import_ora20.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
     const body = {
       turn_id: turnId,
       messages,
@@ -5665,7 +6088,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk36.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk38.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     let data = null;
@@ -5683,12 +6106,12 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (res.status === 401) {
-      console.log(import_chalk36.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
+      console.log(import_chalk38.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
       return;
     }
     if (!res.ok || !data) {
       const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk36.default.red(`  Chat error: ${err}`));
+      console.log(import_chalk38.default.red(`  Chat error: ${err}`));
       return;
     }
     if (Array.isArray(data.delta)) {
@@ -5702,25 +6125,25 @@ async function replTurn(p, messages, userText) {
     if (warn) console.log(warn);
     if (!data.continue) return;
   }
-  console.log(import_chalk36.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
+  console.log(import_chalk38.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
 }
 function renderUpsell(p, upsell) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk36.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk36.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk38.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk38.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
-  console.log("\n" + import_chalk36.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  console.log("\n" + import_chalk38.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "PAUSED") {
     if (!loggedIn) {
-      console.log(import_chalk36.default.dim("  Options: `/login` for free login credit and higher limits, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk38.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk36.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk38.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk36.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk38.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
@@ -5789,9 +6212,9 @@ async function openServerProxy(project) {
   const prior = loadApichats().find((a) => a.projectId === project.projectId && a.dpKey);
   let dpKey = prior?.dpKey;
   if (!dpKey) {
-    console.log(import_chalk36.default.dim(`  Minting an API key for tenant ${import_chalk36.default.bold(tenant2)} to query project ${import_chalk36.default.bold(project.projectName)}\u2026`));
+    console.log(import_chalk38.default.dim(`  Minting an API key for tenant ${import_chalk38.default.bold(tenant2)} to query project ${import_chalk38.default.bold(project.projectName)}\u2026`));
     dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-    console.log(`  ${import_chalk36.default.green("\u2714")} API key: ${import_chalk36.default.dim(maskKey(dpKey))}`);
+    console.log(`  ${import_chalk38.default.green("\u2714")} API key: ${import_chalk38.default.dim(maskKey(dpKey))}`);
   }
   const p = {
     projectId: project.projectId,
@@ -5800,9 +6223,11 @@ async function openServerProxy(project) {
     dpKey,
     mcpHost,
     proxyUrl: `https://${project.projectId}.abz.run/${version2}/${environment}`,
-    anon: false
+    anon: false,
+    // Reusing an owned proxy: logged-in apichat doors default to invite-only.
+    access: "invite"
   };
-  const spinner = (0, import_ora18.default)("Preparing the chat\u2026").start();
+  const spinner = (0, import_ora20.default)("Preparing the chat\u2026").start();
   try {
     const raw = await admin({
       method: "GET",
@@ -5814,7 +6239,7 @@ async function openServerProxy(project) {
     if (spec2 && (spec2.paths || spec2.openapi)) {
       await publishMcp(p, spec2);
     } else {
-      console.log(import_chalk36.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk38.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -5867,7 +6292,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk36.default.bold(a.name)} ${import_chalk36.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk38.default.bold(a.name)} ${import_chalk38.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -5877,14 +6302,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk36.default.bold(pr.projectName)} ${import_chalk36.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk38.default.bold(pr.projectName)} ${import_chalk38.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk36.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk38.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -5912,7 +6337,9 @@ async function noArgsMenu(opts) {
       dpKey: a.dpKey,
       mcpHost: a.mcpHost,
       proxyUrl: void 0,
-      anon: a.anon
+      anon: a.anon,
+      // Saved sessions predate the access field: mirror the provisioning default.
+      access: a.anon ? "open" : "invite"
     };
     return { p, messages };
   }
@@ -5956,63 +6383,70 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk36.default.cyan.bold("Chat with your API") + import_chalk36.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk36.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk38.default.cyan.bold("Chat with your API") + import_chalk38.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk38.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk36.default.dim(
-      llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for credit \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
+    import_chalk38.default.dim(
+      llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk36.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk38.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk36.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk38.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk36.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk38.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
-      if (!loadCredentials()) {
-        console.log(import_chalk36.default.yellow("  Log in first: `/login`, then `/claim`."));
-        continue;
+      const justLoggedIn = !loadCredentials();
+      if (justLoggedIn) {
+        console.log(import_chalk38.default.dim("  Logging in to claim your workspace\u2026"));
+        try {
+          await runLogin();
+        } catch (err) {
+          console.log(import_chalk38.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          continue;
+        }
+        if (!loadCredentials()) continue;
       }
       try {
-        await runClaim(void 0, {});
+        if (!justLoggedIn) await runClaim(void 0, { team: loadCredentials()?.teamId });
         if (p.mcpHost.endsWith(".mcp.tryabz.run")) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk36.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk38.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk36.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk38.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk36.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk38.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk36.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk38.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk36.default.dim("\nBye."));
+  console.log(import_chalk38.default.dim("\nBye."));
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk36.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk38.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -6025,7 +6459,7 @@ async function runApichat(opts) {
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk36.default.dim("Target:")} ${import_chalk36.default.bold(target)}`);
+  console.log(`  ${import_chalk38.default.dim("Target:")} ${import_chalk38.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -6034,7 +6468,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk36.default.dim("Proxy: ")} ${import_chalk36.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk38.default.dim("Proxy: ")} ${import_chalk38.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -6053,24 +6487,33 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk36.default.dim("  Target auth: none required."));
+    console.log(import_chalk38.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk36.default.green("\u2713")} proxy  ${import_chalk36.default.bold(p.proxyUrl)}`);
-  if (mcpUrl) console.log(`  ${import_chalk36.default.green("\u2713")} mcp    ${import_chalk36.default.bold(mcpUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk38.default.green("\u2713")} proxy  ${import_chalk38.default.bold(p.proxyUrl)}`);
+  if (mcpUrl) {
+    console.log(`  ${import_chalk38.default.green("\u2713")} mcp    ${import_chalk38.default.bold(mcpUrl)}`);
+    if (p.access === "invite") {
+      console.log(import_chalk38.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk38.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+    } else {
+      console.log(import_chalk38.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+    }
+  }
   if (p.anon) {
-    console.log(import_chalk36.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat (after /login) to keep it beyond 30 days."));
+    console.log(import_chalk38.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk37 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_chalk39 = __toESM(require("chalk"));
+var import_ora21 = __toESM(require("ora"));
 init_admin();
+init_resolve();
 var DEFAULT_SCOPE = "openid email profile offline_access";
 var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
@@ -6089,7 +6532,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk37.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk39.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -6100,7 +6543,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk37.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk39.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -6112,25 +6555,25 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora19.default)("Finding the login app...").start();
+    const s2 = (0, import_ora21.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk37.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk39.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk37.default.cyan("\u2192")} Logging in to ${import_chalk37.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk39.default.cyan("\u2192")} Logging in to ${import_chalk39.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk37.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk37.default.bold(userCode)}
+  Open: ${import_chalk39.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk39.default.bold(userCode)}
 `);
-    console.log(import_chalk37.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk39.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -6145,7 +6588,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk37.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk39.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -6158,29 +6601,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk37.default.cyan("Consumer")} ${import_chalk37.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk37.default.bold(fresh.tenant)}
+  console.log(`${import_chalk39.default.cyan("Consumer")} ${import_chalk39.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk39.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk37.default.bold("access_token")}  ${import_chalk37.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk39.default.bold("access_token")}  ${import_chalk39.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk37.default.bold("id_token")}      ${import_chalk37.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk39.default.bold("id_token")}      ${import_chalk39.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk37.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk39.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk37.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk39.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora19.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora21.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk37.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk37.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk39.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk39.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -6188,16 +6631,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk37.default.yellow("No API keys yet."));
+    console.log(import_chalk39.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk37.default.green(clear) : import_chalk37.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk37.default.dim(`exp ${k.expires_at}`) : import_chalk37.default.dim("no expiry");
-      console.log(`  ${import_chalk37.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk37.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk39.default.green(clear) : import_chalk39.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk39.default.dim(`exp ${k.expires_at}`) : import_chalk39.default.dim("no expiry");
+      console.log(`  ${import_chalk39.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk39.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk37.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk39.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -6211,7 +6654,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora19.default)("Creating key...").start();
+  const s2 = (0, import_ora21.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -6219,16 +6662,17 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk37.default.green(key)}  ${import_chalk37.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk37.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk39.default.green(key)}  ${import_chalk39.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk39.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk38 = __toESM(require("chalk"));
-var import_ora20 = __toESM(require("ora"));
+var import_chalk40 = __toESM(require("chalk"));
+var import_ora22 = __toESM(require("ora"));
 var fs10 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_admin();
+init_resolve();
 init_auth();
 function detectNextProject(root) {
   const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs10.existsSync(path7.join(root, f)));
@@ -6266,18 +6710,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk38.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk40.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs10.existsSync(path7.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora20.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora22.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk38.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk38.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk40.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk40.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -6416,7 +6860,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora20.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora22.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -6428,29 +6872,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk38.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk38.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk40.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk38.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk40.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk38.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk38.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk40.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk40.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk38.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk40.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk38.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk38.default.cyan("apiblaze login")}  then  ${import_chalk38.default.cyan("apiblaze claim")}   ${import_chalk38.default.dim("(no code needed here)")}`);
-  console.log(import_chalk38.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk40.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk40.default.cyan("apiblaze login")}  then  ${import_chalk40.default.cyan("apiblaze claim")}   ${import_chalk40.default.dim("(no code needed here)")}`);
+  console.log(import_chalk40.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path7.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk38.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk40.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -6461,10 +6905,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk38.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk38.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk40.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk38.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk40.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -6473,7 +6917,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora20.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora22.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -6487,40 +6931,41 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk38.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk40.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk38.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk40.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk38.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk38.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk40.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk38.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk38.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk38.default.bold("candidates")} \u2014 list them:  ${import_chalk38.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk38.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk40.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk40.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk40.default.bold("candidates")} \u2014 list them:  ${import_chalk40.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk40.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk38.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk38.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk40.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk40.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk38.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk38.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk38.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk40.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk40.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk40.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk38.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk38.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk40.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk40.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk39 = __toESM(require("chalk"));
-var import_ora21 = __toESM(require("ora"));
+var import_chalk41 = __toESM(require("chalk"));
+var import_ora23 = __toESM(require("ora"));
 init_admin();
+init_resolve();
 init_auth();
 init_anon_cred();
 async function runOriginsList(opts) {
@@ -6528,7 +6973,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk39.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk41.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -6546,30 +6991,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk39.default.bold(`
+  console.log(import_chalk41.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk39.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk39.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk39.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk39.default.bold(`
+  if (!routed.length) console.log(import_chalk41.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk41.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk41.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk41.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk39.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk41.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk39.default.yellow("\u25CB")} ${c.origin}  ${import_chalk39.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk41.default.yellow("\u25CB")} ${c.origin}  ${import_chalk41.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk39.default.dim(`
+    console.log(import_chalk41.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk39.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk41.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk39.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk41.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora21.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora23.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -6580,7 +7025,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora21.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora23.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -6597,7 +7042,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora21.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora23.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -6608,7 +7053,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora21.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora23.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -6619,19 +7064,19 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk40 = __toESM(require("chalk"));
+var import_chalk42 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
 var OPERATOR_EMAILS = /* @__PURE__ */ new Set(["julienpmjacquet@gmail.com", "chkev@umich.edu"]);
-var DASHBOARD_BASE7 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+var DASHBOARD_BASE8 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 function isOperatorLogin() {
   const email = loadCredentials()?.email?.toLowerCase();
   return !!email && OPERATOR_EMAILS.has(email);
 }
 async function opCall(call) {
   const token = getAccessToken();
-  const res = await fetch(`${DASHBOARD_BASE7}/api/cli/op`, {
+  const res = await fetch(`${DASHBOARD_BASE8}/api/cli/op`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
     body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
@@ -6652,82 +7097,82 @@ function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk40.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk40.default.bold("\n  Upstash"));
+  console.log(import_chalk42.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk42.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk40.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk40.default.yellow(o.key)} ${import_chalk40.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk40.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk42.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk42.default.yellow(o.key)} ${import_chalk42.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk42.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk40.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk42.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk40.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk42.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk40.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk40.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk40.default.red(`    error: ${e}`));
-  console.log(import_chalk40.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk42.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk42.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
+  console.log(import_chalk42.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk40.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk42.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk40.default.yellow(s.store_id)} ${import_chalk40.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk42.default.yellow(s.store_id)} ${import_chalk42.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk40.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk42.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk40.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk42.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk40.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk42.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk40.default.yellow(s.store_id)} ${import_chalk40.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk42.default.yellow(s.store_id)} ${import_chalk42.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk40.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk42.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk40.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk42.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk40.default.red(`    error: ${e}`));
-  console.log(import_chalk40.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
+  console.log(import_chalk42.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk40.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk40.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk40.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk42.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk42.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk42.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk40.default.green(`    no ghost tuples ${import_chalk40.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk42.default.green(`    no ghost tuples ${import_chalk42.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk40.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk42.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk40.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk42.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk40.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk42.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk40.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk40.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk42.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk40.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk42.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk40.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk40.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk40.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk40.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk40.default.cyan("apiblaze op credits")}        list credit wallets`);
-      console.log(import_chalk40.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+      console.log(import_chalk42.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk42.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk42.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk42.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk42.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk42.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
 `));
       return;
     }
@@ -6746,17 +7191,17 @@ async function runOp(sub, opts = {}) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk40.default.green("Nothing to sweep."));
+        console.log(import_chalk42.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline2 = await import("readline/promises");
         const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk40.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk42.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk40.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk42.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -6767,15 +7212,15 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk40.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk42.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk40.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk40.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk40.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk42.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk42.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk42.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk40.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk42.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -6808,7 +7253,7 @@ program.command("login").description("Authenticate with APIblaze").action(async
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate(opts);
   } catch (err) {
@@ -6821,7 +7266,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Author an object-level access rule in plain English, in one shot (billed per turn)").argument("<rule>", 'The rule in plain English, e.g. "users see only their own rows"').argument("<project>", "Project name or id").option("--enforce", "Turn enforcement on immediately (default: shadow-publish only)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((rule, project, opts) => runRule(rule, project, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("apichat").description("Turn any API into a chat: point at an OpenAPI spec and start asking questions (no login needed)").option("--openapispec <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapispec is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((opts) => runApichat(opts)));
+program.command("apichat").description("Turn any API into a chat: point at an OpenAPI spec and start asking questions (no login needed)").option("--openapi <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--openapispec <file|url>", "Alias for --openapi").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapi is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((opts) => runApichat({ ...opts, openapispec: opts.openapispec ?? opts.openapi })));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
 llm.command("show").description("Show the locally stored LLM key (masked)").action(action(() => runLlmShow()));
@@ -6838,7 +7283,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk41.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk43.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -6907,6 +7352,7 @@ group.command("remove-user").description("Remove a user from a group").argument(
 group.command("add-group").description("Nest a group inside another (e.g. `group add-group reservationists admin`)").argument("<child>", "Child group name").argument("<parent>", "Parent group name").option("--tenant <slug>", "Tenant").action(action((child, parent, opts) => runGroupAddGroup(child, parent, opts)));
 group.command("remove-group").description("Un-nest a subgroup from its parent").argument("<child>", "Child group name").argument("<parent>", "Parent group name").option("--tenant <slug>", "Tenant").action(action((child, parent, opts) => runGroupRemoveGroup(child, parent, opts)));
 group.command("users").description("List the tenant user directory + identities seen in traffic").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((opts) => runGroupUsers(opts)));
+program.command("preapprove").description("Allow an email or company domain to sign in to an access-restricted API (--list, --remove)").argument("[email-or-domain]", "Email (someone@acme.com) or whole company domain (acme.com)").option("--tenant <slug>", "Tenant (defaults to your team's only tenant, or prompts)").option("--list", "List the current pre-approval allow-list").option("--remove", "Remove the given email/domain from the allow-list").option("--group <names...>", "Group(s) to auto-assign the user to on first sign-in").option("--json", "Machine-readable output (with --list)").action(action((who, opts) => runPreapprove(who, opts)));
 var tenant = program.command("tenant").description("Manage tenants \u2014 bare command opens the interactive picker (settings, app clients, providers)").action(action(() => runTenantManage(void 0, {})));
 tenant.command("manage").description("Browse & edit one tenant: settings, login app clients, providers, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
@@ -6915,6 +7361,8 @@ tenant.command("create").description("Create a tenant in your team (tenant names
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
+program.command("iam").description("Turn users & groups on/off for a proxy's tenant (identified calls get their user's groups applied)").argument("<project>", "Project name or id").argument("<state>", "on | off").option("--tenant <name>", "Tenant to toggle (defaults to the project's tenant)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, state, opts) => runIamToggle(project, state, opts)));
+program.command("identified").description("Require calls to identify their end user (X-End-User-Id or a login token) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
 var apikeys = new import_commander.Command("apikeys").description("Producer control-plane API keys (list, then offer to create one)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
 apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyList(opts)));
 apikeys.command("mint").description("Create a control-plane API key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
@@ -6925,10 +7373,12 @@ program.addCommand(op, { hidden: true });
 var spec = program.command("spec").description("View or update a proxy's OpenAPI spec (or build one by chatting: apiblaze agent openapi)");
 spec.command("get").description("Print the current OpenAPI document").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Compact JSON output").action(action((project, opts) => runSpecGet(project, opts)));
 spec.command("set").description("Replace the stored OpenAPI spec from a local file").argument("<project>", "Project name or id").requiredOption("--file <path>", "OpenAPI JSON or YAML file to upload").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecSet(project, opts)));
+spec.command("carry").description("Copy a route's saved rules to the path a spec rename moved traffic to").argument("<project>", "Project name or id").requiredOption("--method <method>", "HTTP method of the route (GET, POST, ...)").requiredOption("--from <path>", "Old route path, e.g. /owners/{ownerId}").requiredOption("--to <path>", "New route path, e.g. /customers/{customerId}").option("--delete-source", "Also delete the old rules after carrying").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecCarry(project, opts)));
+spec.command("delete-rule").description("Delete the saved rules for a route (e.g. an orphan left by a spec change)").argument("<project>", "Project name or id").requiredOption("--method <method>", "HTTP method of the route").requiredOption("--route <path>", "Route path, e.g. /owners/{ownerId}").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runSpecDeleteRule(project, opts)));
 var HELP_GROUPS = [
   { title: "Chat", commands: ["apichat", "agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
-  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" }
@@ -6947,7 +7397,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk41.default.bold(g.title)}
+    return `${import_chalk43.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -6967,7 +7417,7 @@ Tips:
   \u2022 Run \`apiblaze <command> --help\` (e.g. \`apiblaze consumer --help\`) for sub-commands.
 
 Examples:
-  $ npx apiblaze apichat --openapispec https://pokeapi.co/openapi.yaml  # chat with any API
+  $ npx apiblaze apichat --openapi https://pokeapi.co/openapi.yaml  # chat with any API
   $ npx apiblaze agent                                   # just chat
   $ npx apiblaze create --target https://api.example.com # one-line API
   $ npx apiblaze dev 3000                                # localhost \u2192 public URL
@@ -6981,14 +7431,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk41.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk43.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk41.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk41.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk43.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk43.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -6996,16 +7446,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk41.default.red(`
+    console.error(import_chalk43.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk41.default.red(`
+    console.error(import_chalk43.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk41.default.red("\nUnknown error"));
+    console.error(import_chalk43.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);