apiblaze 0.19.0 → 0.19.2

package/dist/index.js

@@ -577,10 +577,10 @@ async function resolveProjectVia(caller, teamId, nameOrId, version2) {
     summary: `List projects for ${teamId}`
   });
   const rows = out?.projects ?? [];
-  const candidates = rows.filter((r) => r.project_id === nameOrId || r.project_name === nameOrId);
+  const candidates = rows.filter((r) => r.project_id === nameOrId || r.project_display_name === nameOrId || r.display_name === nameOrId);
   if (!candidates.length) {
     throw new Error(
-      `Project "${nameOrId}" not found in this team.` + (rows.length ? ` Known: ${rows.map((r) => r.project_name).join(", ")}` : "")
+      `Project "${nameOrId}" not found in this team.` + (rows.length ? ` Known: ${rows.map((r) => r.project_id).join(", ")}` : "")
     );
   }
   const chosen = version2 ? candidates.find((r) => r.api_version === version2) : candidates[0];
@@ -590,11 +590,12 @@ async function resolveProjectVia(caller, teamId, nameOrId, version2) {
     );
   }
   return {
+    // A proxy is addressed by its project_id (that IS its name); display_name is cosmetic.
     projectId: chosen.project_id,
-    projectName: chosen.project_name,
+    projectName: chosen.project_display_name ?? chosen.display_name ?? chosen.project_id,
     apiVersion: chosen.api_version,
     teamId,
-    tenant: chosen.tenant ?? chosen.config?.tenant
+    tenant: chosen.config?.tenant ?? chosen.config?.default_tenant
   };
 }
 var init_caller = __esm({
@@ -626,15 +627,16 @@ async function runIamToggle(project, state, opts) {
   if (!tenant2) {
     throw new Error("Could not resolve the tenant for this project. Pass --tenant <name>.");
   }
-  const spinner = (0, import_ora4.default)(`Turning IAM ${state} for tenant ${tenant2}...`).start();
+  const spinner = opts.quiet ? null : (0, import_ora4.default)(`Turning IAM ${state} for tenant ${tenant2}...`).start();
   try {
     const out = await producer(caller, {
       method: "PATCH",
       path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`,
-      body: { iam_enabled: enabled },
+      body: { enabled },
       summary: `IAM ${state} for tenant ${tenant2}`
     });
-    spinner.succeed(`IAM is ${import_chalk9.default.bold(state)} for tenant ${tenant2}.`);
+    if (opts.quiet) return;
+    spinner?.succeed(`IAM is ${import_chalk9.default.bold(state)} for tenant ${tenant2}.`);
     if (opts.json) console.log(JSON.stringify(out ?? { iam_enabled: enabled }));
     else if (enabled) {
       console.log(import_chalk9.default.dim("  Groups now apply to identified calls. Identify callers with"));
@@ -642,7 +644,7 @@ async function runIamToggle(project, state, opts) {
       console.log(import_chalk9.default.dim(`  \`apiblaze identified ${project} require\` to reject unattributed traffic.`));
     }
   } catch (err) {
-    spinner.fail(`IAM ${state} failed.`);
+    spinner?.fail(`IAM ${state} failed.`);
     throw err;
   }
 }
@@ -654,7 +656,7 @@ async function runIdentifiedToggle(project, mode, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const spinner = (0, import_ora4.default)(
+  const spinner = opts.quiet ? null : (0, import_ora4.default)(
     require2 ? "Requiring identified traffic..." : "Allowing unattributed traffic..."
   ).start();
   try {
@@ -681,12 +683,13 @@ async function runIdentifiedToggle(project, mode, opts) {
       body: { requests_policy: merged },
       summary: `Set identified-traffic policy (${mode}) on ${proj2.projectName}`
     });
-    spinner.succeed(
+    if (opts.quiet) return;
+    spinner?.succeed(
       require2 ? `${proj2.projectName} now rejects calls that don't identify an end user.` : `${proj2.projectName} accepts unattributed calls again (they pass with no groups).`
     );
     if (opts.json) console.log(JSON.stringify(out ?? { identified_traffic_only: require2 }));
   } catch (err) {
-    spinner.fail("Policy update failed.");
+    spinner?.fail("Policy update failed.");
     throw err;
   }
 }
@@ -736,7 +739,7 @@ async function createTenantRow(teamId) {
 }
 async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
   const { default: inquirer3 } = await import("inquirer");
-  const base = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
+  const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
   const { provider } = await inquirer3.prompt([{
     type: "list",
     name: "provider",
@@ -781,9 +784,9 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
   }
   const spinner = (0, import_ora10.default)("Setting up login...").start();
   try {
-    const client = await admin({ method: "POST", path: `${base}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
+    const client = await admin({ method: "POST", path: `${base2}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
     const clientId = client?.clientId ?? client?.client_id;
-    await admin({ method: "POST", path: `${base}/app-clients/${encodeURIComponent(clientId)}/providers`, body: providerBody, summary: `Add ${provider} provider` });
+    await admin({ method: "POST", path: `${base2}/app-clients/${encodeURIComponent(clientId)}/providers`, body: providerBody, summary: `Add ${provider} provider` });
     spinner.succeed(opt.own ? `${opt.label} login is ready.` : "APIblaze-hosted GitHub login is ready.");
     return true;
   } catch (err) {
@@ -927,10 +930,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk43 = __toESM(require("chalk"));
+var import_chalk44 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.0";
+var version = "0.19.2";
 
 // src/index.ts
 init_types();
@@ -1183,7 +1186,7 @@ function decodeJwt(token) {
 function maskPath(path8) {
   const q = path8.indexOf("?");
   if (q < 0) return path8;
-  const base = path8.slice(0, q);
+  const base2 = path8.slice(0, q);
   const query = path8.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
@@ -1195,7 +1198,7 @@ function maskPath(path8) {
     }
     return pair;
   }).join("&");
-  return `${base}?${masked}`;
+  return `${base2}?${masked}`;
 }
 function formatHeaderLines(name, value) {
   const lower = name.toLowerCase();
@@ -2010,6 +2013,7 @@ async function runCreate(opts = {}) {
   const adminKey = keys.dev ?? Object.values(keys)[0];
   const proxyUrl = `https://${name}.abz.run/${version2}/dev`;
   const devPortal = result.devPortal ? stripTenantFromPortal(result.devPortal) : void 0;
+  await applyCreateToggles(name, opts);
   if (opts.json) {
     process.stdout.write(JSON.stringify({
       project_id: result.project_id,
@@ -2037,17 +2041,13 @@ async function runCreate(opts = {}) {
   }
   printCurlExample(proxyUrl, auth, adminKey, devPortal);
   console.log();
-  await applyCreateToggles(name, opts);
 }
 async function applyCreateToggles(name, opts) {
   if (!opts.identified && !opts.iam) return;
   const { runIamToggle: runIamToggle2, runIdentifiedToggle: runIdentifiedToggle2 } = await Promise.resolve().then(() => (init_iam(), iam_exports));
-  if (opts.identified) {
-    await runIdentifiedToggle2(name, "require", { team: opts.team, json: opts.json });
-  }
-  if (opts.iam) {
-    await runIamToggle2(name, "on", { team: opts.team, json: opts.json });
-  }
+  const toggleOpts = { team: opts.team, json: opts.json, quiet: opts.json };
+  if (opts.identified) await runIdentifiedToggle2(name, "require", toggleOpts);
+  if (opts.iam) await runIamToggle2(name, "on", toggleOpts);
 }
 async function runAnonymousCreate(opts) {
   const interactive = !!process.stdin.isTTY && !opts.json;
@@ -2149,6 +2149,7 @@ async function runAnonymousCreate(opts) {
   const keys = result.api_keys ?? {};
   const apiKey = result.apiKey ?? keys.prod ?? Object.values(keys)[0];
   const prodEndpoint = (result.endpoints || []).find((e) => e.endsWith("/prod")) || (result.endpoints || [])[0];
+  if (name) await applyCreateToggles(name, opts);
   if (opts.json) {
     process.stdout.write(JSON.stringify({
       project_id: result.project_id,
@@ -2182,7 +2183,6 @@ async function runAnonymousCreate(opts) {
     console.log(`    ${import_chalk10.default.bold(result.claim_url)}`);
   }
   console.log();
-  if (name) await applyCreateToggles(name, opts);
 }
 
 // src/commands/claim.ts
@@ -3422,19 +3422,19 @@ async function validScopedTenant(teamId, query) {
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer3 } = await import("inquirer");
-  const base = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
+  const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
   console.log(import_chalk29.default.bold(`
 Tenant ${tenant2}`));
   console.log(import_chalk29.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
     const spinner = (0, import_ora13.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
-      admin({ method: "GET", path: `${base}/iam`, summary: "Read IAM toggle" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/cors`, summary: "Read tenant CORS" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/admin-emails`, summary: "List consumer-admin emails" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/external-issuers`, summary: "List external issuers" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/opaque`, summary: "Read opaque validator" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/app-clients`, summary: "List app clients" }).catch(() => [])
+      admin({ method: "GET", path: `${base2}/iam`, summary: "Read IAM toggle" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/cors`, summary: "Read tenant CORS" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/admin-emails`, summary: "List consumer-admin emails" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/external-issuers`, summary: "List external issuers" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/opaque`, summary: "Read opaque validator" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/app-clients`, summary: "List app clients" }).catch(() => [])
     ]).finally(() => spinner.stop());
     const nEmails = (emails?.admin_emails ?? []).length;
     const nIssuers = (issuers?.external_issuers ?? []).length;
@@ -3460,11 +3460,11 @@ Tenant ${tenant2}`));
       case "back":
         return;
       case "login":
-        await loginMethodsMenu(teamId, tenant2, base);
+        await loginMethodsMenu(teamId, tenant2, base2);
         break;
       case "iam": {
         const { v } = await inquirer3.prompt([{ type: "confirm", name: "v", message: "Enable Users & groups?", default: !!iam?.iam_enabled }]);
-        await admin({ method: "PATCH", path: `${base}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
+        await admin({ method: "PATCH", path: `${base2}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
         console.log(import_chalk29.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
         break;
       }
@@ -3481,24 +3481,24 @@ Tenant ${tenant2}`));
           console.log(import_chalk29.default.yellow("  Not valid JSON \u2014 unchanged."));
           break;
         }
-        await admin({ method: "PUT", path: `${base}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
+        await admin({ method: "PUT", path: `${base2}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
         console.log(import_chalk29.default.green("  CORS updated."));
         break;
       }
       case "emails":
-        await emailsMenu(base, emails?.admin_emails ?? []);
+        await emailsMenu(base2, emails?.admin_emails ?? []);
         break;
     }
   }
 }
-async function loginMethodsMenu(teamId, tenant2, base) {
+async function loginMethodsMenu(teamId, tenant2, base2) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
     const spinner = (0, import_ora13.default)("Loading login methods...").start();
     const [rawClients, rawIssuers, rawOpaque] = await Promise.all([
-      admin({ method: "GET", path: `${base}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
-      admin({ method: "GET", path: `${base}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
-      admin({ method: "GET", path: `${base}/opaque`, summary: "Read opaque login" }).catch(() => null)
+      admin({ method: "GET", path: `${base2}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
+      admin({ method: "GET", path: `${base2}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
+      admin({ method: "GET", path: `${base2}/opaque`, summary: "Read opaque login" }).catch(() => null)
     ]).finally(() => spinner.stop());
     const appClients = Array.isArray(rawClients) ? rawClients : [];
     const issuers = rawIssuers?.external_issuers ?? [];
@@ -3529,24 +3529,24 @@ async function loginMethodsMenu(teamId, tenant2, base) {
     }]);
     if (pick2.kind === "back") return;
     if (pick2.kind === "add") {
-      await addLoginMethod(teamId, tenant2, base);
+      await addLoginMethod(teamId, tenant2, base2);
       continue;
     }
     if (pick2.kind === "client") {
-      await clientHome(base, pick2.item);
+      await clientHome(base2, pick2.item);
       continue;
     }
     if (pick2.kind === "issuer") {
-      await issuerHome(base, pick2.item);
+      await issuerHome(base2, pick2.item);
       continue;
     }
     if (pick2.kind === "opaque") {
-      await opaqueHome(base, pick2.item);
+      await opaqueHome(base2, pick2.item);
       continue;
     }
   }
 }
-async function addLoginMethod(teamId, tenant2, base) {
+async function addLoginMethod(teamId, tenant2, base2) {
   const { default: inquirer3 } = await import("inquirer");
   const { kind } = await inquirer3.prompt([{
     type: "list",
@@ -3565,9 +3565,9 @@ async function addLoginMethod(teamId, tenant2, base) {
     const { addApiblazeHostedLogin: addApiblazeHostedLogin2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
     await addApiblazeHostedLogin2(teamId, tenant2);
   } else if (kind === "jwt") {
-    await addIssuer(base);
+    await addIssuer(base2);
   } else {
-    await setOpaque(base, null);
+    await setOpaque(base2, null);
   }
 }
 function safeJson(s) {
@@ -3577,7 +3577,7 @@ function safeJson(s) {
     return void 0;
   }
 }
-async function emailsMenu(base, emails) {
+async function emailsMenu(base2, emails) {
   const { default: inquirer3 } = await import("inquirer");
   console.log();
   if (!emails.length) console.log(import_chalk29.default.dim("  No consumer-admin emails."));
@@ -3595,7 +3595,7 @@ async function emailsMenu(base, emails) {
   if (act === "back") return;
   if (act === "add") {
     const { email } = await inquirer3.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
-    await admin({ method: "POST", path: `${base}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
+    await admin({ method: "POST", path: `${base2}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
     console.log(import_chalk29.default.green(`  ${email} added.`));
   } else {
     const { e } = await inquirer3.prompt([{
@@ -3605,11 +3605,11 @@ async function emailsMenu(base, emails) {
       choices: [...emails.map((x) => ({ name: x.email ?? String(x), value: x.email ?? String(x) })), { name: "\u2190 Back", value: null }]
     }]);
     if (!e) return;
-    await admin({ method: "DELETE", path: `${base}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
+    await admin({ method: "DELETE", path: `${base2}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
     console.log(import_chalk29.default.green(`  ${e} removed.`));
   }
 }
-async function addIssuer(base) {
+async function addIssuer(base2) {
   const { default: inquirer3 } = await import("inquirer");
   const a = await inquirer3.prompt([
     { type: "input", name: "iss", message: "Issuer URL (iss):", validate: (s) => !!s.trim() || "required" },
@@ -3623,13 +3623,13 @@ async function addIssuer(base) {
   const claim = a.sem === "extract_from_claim" ? (await inquirer3.prompt([{ type: "input", name: "c", message: "Claim name:", validate: (s) => !!s.trim() || "required" }])).c : void 0;
   await admin({
     method: "POST",
-    path: `${base}/external-issuers`,
+    path: `${base2}/external-issuers`,
     body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
     summary: `Add external issuer ${a.iss.trim()}`
   });
   console.log(import_chalk29.default.green("  JWT login method saved."));
 }
-async function issuerHome(base, issuer) {
+async function issuerHome(base2, issuer) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
   ${import_chalk29.default.bold(issuer.iss)}  ${import_chalk29.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
@@ -3645,28 +3645,28 @@ async function issuerHome(base, issuer) {
   }]);
   if (act === "back") return;
   if (act === "edit") {
-    await addIssuer(base);
+    await addIssuer(base2);
     return;
   }
   const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Delete the JWT login method for ${issuer.iss}? Consumers using it can no longer sign in.`, default: false }]);
   if (!sure) return;
   await admin({
     method: "DELETE",
-    path: `${base}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
+    path: `${base2}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
     summary: `Delete issuer ${issuer.iss}`
   });
   console.log(import_chalk29.default.green("  Deleted."));
 }
-async function setOpaque(base, cur) {
+async function setOpaque(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
   const a = await inquirer3.prompt([
     { type: "input", name: "endpoint", message: "Introspection endpoint (https):", default: cur?.endpoint, validate: (s) => s.startsWith("https://") || "must be https" },
     { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
   ]);
-  await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
+  await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
   console.log(import_chalk29.default.green("  Opaque login method set."));
 }
-async function opaqueHome(base, cur) {
+async function opaqueHome(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
   ${import_chalk29.default.bold(cur.endpoint)}  ${import_chalk29.default.dim(cur.method ?? "GET")}`);
@@ -3682,16 +3682,16 @@ async function opaqueHome(base, cur) {
   }]);
   if (act === "back") return;
   if (act === "edit") {
-    await setOpaque(base, cur);
+    await setOpaque(base2, cur);
     return;
   }
-  await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
+  await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
   console.log(import_chalk29.default.green("  Deleted."));
 }
-async function clientHome(base, summary) {
+async function clientHome(base2, summary) {
   const { default: inquirer3 } = await import("inquirer");
   const id = summary.clientId ?? summary.client_id;
-  const cBase = `${base}/app-clients/${encodeURIComponent(id)}`;
+  const cBase = `${base2}/app-clients/${encodeURIComponent(id)}`;
   for (; ; ) {
     const spinner = (0, import_ora13.default)("Reading app client...").start();
     const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
@@ -4839,9 +4839,9 @@ function showCondition(cond) {
 }
 async function transformsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
-  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/transforms`;
+  const base2 = `/projects/${proj2.projectId}/${proj2.apiVersion}/transforms`;
   for (; ; ) {
-    const out = await admin({ method: "GET", path: base, summary: "List transform rules" });
+    const out = await admin({ method: "GET", path: base2, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
     if (!rules.length) console.log(import_chalk33.default.dim("  No transform rules yet."));
@@ -4877,7 +4877,7 @@ async function transformsMenu(proj2) {
         console.log(import_chalk33.default.yellow("  Not a JSON object \u2014 skipped."));
         continue;
       }
-      await admin({ method: "POST", path: base, body, summary: "Create transform rule (raw JSON)" });
+      await admin({ method: "POST", path: base2, body, summary: "Create transform rule (raw JSON)" });
       console.log(import_chalk33.default.green("  Rule created."));
       continue;
     }
@@ -4927,7 +4927,7 @@ async function transformsMenu(proj2) {
       try {
         await admin({
           method: "POST",
-          path: base,
+          path: base2,
           body: { name: ans.name, phase: ans.phase, enabled: true, action: action2, ...condition ? { condition } : {} },
           summary: `Create transform "${ans.name}"`
         });
@@ -4946,10 +4946,10 @@ async function transformsMenu(proj2) {
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
-        await admin({ method: "PUT", path: `${base}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
+        await admin({ method: "PUT", path: `${base2}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
         console.log(import_chalk33.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
-        await admin({ method: "DELETE", path: `${base}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
+        await admin({ method: "DELETE", path: `${base2}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
         console.log(import_chalk33.default.green(`  ${rule.name} deleted.`));
       }
     }
@@ -4957,9 +4957,9 @@ async function transformsMenu(proj2) {
 }
 async function mappingsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
-  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/mappings`;
+  const base2 = `/projects/${proj2.projectId}/${proj2.apiVersion}/mappings`;
   for (; ; ) {
-    const out = await admin({ method: "GET", path: base, summary: "List mapping tables" });
+    const out = await admin({ method: "GET", path: base2, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
     if (!tables.length) console.log(import_chalk33.default.dim("  No mapping tables yet."));
@@ -4987,7 +4987,7 @@ async function mappingsMenu(proj2) {
         console.log(import_chalk33.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
-      await admin({ method: "POST", path: base, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
+      await admin({ method: "POST", path: base2, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
       console.log(import_chalk33.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer3.prompt([{
@@ -4997,16 +4997,16 @@ async function mappingsMenu(proj2) {
         choices: [...tables.map((t) => ({ name: t.name, value: t })), { name: "\u2190 Back", value: null }]
       }]);
       if (!table) continue;
-      await admin({ method: "DELETE", path: `${base}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
+      await admin({ method: "DELETE", path: `${base2}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
       console.log(import_chalk33.default.green(`  ${table.name} deleted.`));
     }
   }
 }
 async function tenantsMenu(proj2, opts) {
   const { default: inquirer3 } = await import("inquirer");
-  const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`;
+  const base2 = `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`;
   for (; ; ) {
-    const out = await admin({ method: "GET", path: base, summary: "List attached tenants" });
+    const out = await admin({ method: "GET", path: base2, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
     if (!tenants.length) console.log(import_chalk33.default.dim("  No tenants attached (consumers use the default tenant)."));
@@ -5038,7 +5038,7 @@ async function tenantsMenu(proj2, opts) {
         choices: [...tenants.map((x) => ({ name: x.tenant_name ?? x.name, value: x })), { name: "\u2190 Back", value: null }]
       }]);
       if (!t) continue;
-      await admin({ method: "DELETE", path: `${base}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
+      await admin({ method: "DELETE", path: `${base2}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
       console.log(import_chalk33.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
@@ -5372,7 +5372,6 @@ async function runKeyList(opts) {
   }
 }
 async function runKeyMint(opts) {
-  if (process.env.ABZ_DEBUG_OPTS) console.error("DEBUG opts:", JSON.stringify(opts));
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const body = { role: "consumer-admin" };
@@ -5419,9 +5418,85 @@ async function runKeyRevoke(keyId, opts) {
 // src/index.ts
 init_iam();
 
-// src/commands/preapprove.ts
+// src/commands/admins.ts
 var import_chalk36 = __toESM(require("chalk"));
 var import_ora19 = __toESM(require("ora"));
+init_caller();
+function requireTenant(opts) {
+  const t = (opts.tenant ?? "").trim();
+  if (!t) {
+    throw new Error("--tenant <slug> is required (e.g. --tenant nino).");
+  }
+  return t;
+}
+function base(teamId, tenant2) {
+  return `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin-emails`;
+}
+async function runAdminsList(opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const tenant2 = requireTenant(opts);
+  const out = await producer(caller, {
+    method: "GET",
+    path: base(teamId, tenant2),
+    summary: `List admins for tenant ${tenant2}`
+  });
+  const admins2 = out?.admin_emails ?? out?.admins ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify(admins2));
+    return;
+  }
+  if (!admins2.length) {
+    console.log(import_chalk36.default.yellow(`No admins for tenant ${tenant2} yet.`));
+    return;
+  }
+  for (const a of admins2) {
+    const email = typeof a === "string" ? a : a.email;
+    const flags = [a.active === false ? "pending" : null, a.pinned ? "pinned" : null].filter(Boolean).join(", ");
+    console.log(`  ${import_chalk36.default.bold(email)}${flags ? import_chalk36.default.dim(`  (${flags})`) : ""}`);
+  }
+}
+async function runAdminsAdd(email, opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const tenant2 = requireTenant(opts);
+  const spinner = opts.json ? null : (0, import_ora19.default)(`Adding ${email} as admin of ${tenant2}...`).start();
+  try {
+    const out = await producer(caller, {
+      method: "POST",
+      path: base(teamId, tenant2),
+      body: { email },
+      summary: `Add ${email} to tenant ${tenant2} admins`
+    });
+    spinner?.succeed(`${import_chalk36.default.bold(email)} is now an admin of ${import_chalk36.default.bold(tenant2)}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+    else console.log(import_chalk36.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
+  } catch (err) {
+    spinner?.fail("Add failed.");
+    throw err;
+  }
+}
+async function runAdminsRemove(email, opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const tenant2 = requireTenant(opts);
+  const spinner = opts.json ? null : (0, import_ora19.default)(`Removing ${email} from ${tenant2} admins...`).start();
+  try {
+    await producer(caller, {
+      method: "DELETE",
+      path: `${base(teamId, tenant2)}/${encodeURIComponent(email)}`,
+      summary: `Remove ${email} from tenant ${tenant2} admins`
+    });
+    spinner?.succeed(`Removed ${import_chalk36.default.bold(email)} from ${import_chalk36.default.bold(tenant2)} admins.`);
+  } catch (err) {
+    spinner?.fail("Remove failed.");
+    throw err;
+  }
+}
+
+// src/commands/preapprove.ts
+var import_chalk37 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 
 // src/lib/preapproval.ts
 init_auth();
@@ -5485,14 +5560,14 @@ async function runPreapprove(who, opts) {
     const rules = await listPreapprovalRules(tenant2);
     if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
     if (!rules.length) {
-      console.log(import_chalk36.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
-      console.log(import_chalk36.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      console.log(import_chalk37.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk37.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
       return;
     }
-    console.log(import_chalk36.default.dim(`Pre-approved for ${import_chalk36.default.bold(tenant2)}:`));
+    console.log(import_chalk37.default.dim(`Pre-approved for ${import_chalk37.default.bold(tenant2)}:`));
     for (const r of rules) {
-      const tag = r.kind === "domain" ? import_chalk36.default.cyan("@" + r.value + " (whole domain)") : r.value;
-      const grp = r.groups?.length ? import_chalk36.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      const tag = r.kind === "domain" ? import_chalk37.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk37.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
       console.log(`  ${tag}${grp}`);
     }
     return;
@@ -5501,19 +5576,19 @@ async function runPreapprove(who, opts) {
     throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
   }
   if (opts.remove) {
-    const spinner2 = (0, import_ora19.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const spinner2 = (0, import_ora20.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
-    if (removed) spinner2.succeed(`${import_chalk36.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
-    else spinner2.warn(`No pre-approval rule for ${import_chalk36.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    if (removed) spinner2.succeed(`${import_chalk37.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk37.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
-  const spinner = (0, import_ora19.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  const spinner = (0, import_ora20.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
-    spinner.succeed(`${import_chalk36.default.bold(what)} can now sign in to ${import_chalk36.default.bold(tenant2)}.`);
-    if (opts.group?.length) console.log(import_chalk36.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
-    console.log(import_chalk36.default.dim(`  See the full list:  apiblaze preapprove --list`));
+    spinner.succeed(`${import_chalk37.default.bold(what)} can now sign in to ${import_chalk37.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk37.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk37.default.dim(`  See the full list:  apiblaze preapprove --list`));
   } catch (err) {
     spinner.fail("Could not add the rule.");
     throw err;
@@ -5524,8 +5599,8 @@ async function runPreapprove(who, opts) {
 var fs9 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk38 = __toESM(require("chalk"));
-var import_ora20 = __toESM(require("ora"));
+var import_chalk39 = __toESM(require("chalk"));
+var import_ora21 = __toESM(require("ora"));
 var import_yaml = require("yaml");
 init_auth();
 init_anon_cred();
@@ -5535,7 +5610,7 @@ init_admin();
 // src/commands/llm.ts
 var fs8 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
-var import_chalk37 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_auth();
 var LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
@@ -5579,27 +5654,27 @@ async function runLlmSetKey(keyArg, opts) {
   }
   const existing = loadLlmConfig();
   saveLlmConfig({ key, provider, model: opts.model ?? existing?.model });
-  console.log(`${import_chalk37.default.green("\u2713")} Saved ${import_chalk37.default.bold(provider)} key ${maskSecret(key)}`);
-  console.log(import_chalk37.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
-  if (opts.model) console.log(import_chalk37.default.gray(`  Model: ${opts.model}`));
+  console.log(`${import_chalk38.default.green("\u2713")} Saved ${import_chalk38.default.bold(provider)} key ${maskSecret(key)}`);
+  console.log(import_chalk38.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
+  if (opts.model) console.log(import_chalk38.default.gray(`  Model: ${opts.model}`));
 }
 async function runLlmShow() {
   const cfg = loadLlmConfig();
   if (!cfg) {
-    console.log(import_chalk37.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
+    console.log(import_chalk38.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
     return;
   }
-  console.log(`Provider: ${import_chalk37.default.bold(cfg.provider)}`);
+  console.log(`Provider: ${import_chalk38.default.bold(cfg.provider)}`);
   console.log(`Key:      ${maskSecret(cfg.key)}`);
   if (cfg.model) console.log(`Model:    ${cfg.model}`);
-  console.log(import_chalk37.default.gray(`Stored at ${LLM_PATH}`));
+  console.log(import_chalk38.default.gray(`Stored at ${LLM_PATH}`));
 }
 async function runLlmClearKey() {
   try {
     fs8.unlinkSync(LLM_PATH);
-    console.log(`${import_chalk37.default.green("\u2713")} Removed local LLM key.`);
+    console.log(`${import_chalk38.default.green("\u2713")} Removed local LLM key.`);
   } catch {
-    console.log(import_chalk37.default.gray("No LLM key was set."));
+    console.log(import_chalk38.default.gray("No LLM key was set."));
   }
 }
 
@@ -5607,9 +5682,9 @@ async function runLlmClearKey() {
 init_trace();
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk38.default.red(`
+  console.error(import_chalk39.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk38.default.dim(hint));
+  if (hint) console.error(import_chalk39.default.dim(hint));
   process.exit(1);
 }
 function normalizeName2(raw) {
@@ -5651,9 +5726,9 @@ async function fetchText(url) {
   }
 }
 async function discoverSpec(target) {
-  const base = target.replace(/\/+$/, "");
+  const base2 = target.replace(/\/+$/, "");
   for (const suffix of ["/openapi.json", "/openapi.yaml", "/swagger.json"]) {
-    const url = base + suffix;
+    const url = base2 + suffix;
     const text = await fetchText(url);
     if (text) {
       try {
@@ -5757,7 +5832,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk38.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk39.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -5822,28 +5897,28 @@ async function provision(spec2, target, opts) {
   const loggedIn = !!loadCredentials();
   const anon = !loggedIn;
   const salt = () => Math.random().toString(36).slice(2, 6);
-  let base = opts.name ? normalizeName2(opts.name) : "";
-  if (!base) {
+  let base2 = opts.name ? normalizeName2(opts.name) : "";
+  if (!base2) {
     try {
       const host = new URL(target).hostname;
-      base = normalizeName2(host.split(".")[0]);
-      if (base.length < 3) base = normalizeName2(host);
+      base2 = normalizeName2(host.split(".")[0]);
+      if (base2.length < 3) base2 = normalizeName2(host);
     } catch {
     }
   }
-  if (!base && spec2.info && typeof spec2.info.title === "string") base = normalizeName2(spec2.info.title);
-  if (!base || base.length < 3) base = "apichat";
-  let name = opts.name ? base : `${base}${salt()}`;
+  if (!base2 && spec2.info && typeof spec2.info.title === "string") base2 = normalizeName2(spec2.info.title);
+  if (!base2 || base2.length < 3) base2 = "apichat";
+  let name = opts.name ? base2 : `${base2}${salt()}`;
   const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
   if (anon && opts.access === "invite") {
-    console.log(import_chalk38.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+    console.log(import_chalk39.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
   }
   const DUAL_AUTH = {
     mode: "authenticate",
     methods: ["api_key", "jwt"],
     ...access === "invite" ? { preapproved_users_only: true } : {}
   };
-  const spinner = (0, import_ora20.default)("Provisioning an api_key proxy...").start();
+  const spinner = (0, import_ora21.default)("Provisioning an api_key proxy...").start();
   let result;
   for (let attempt = 0; attempt < 4; attempt++) {
     try {
@@ -5875,13 +5950,13 @@ async function provision(spec2, target, opts) {
           if (result.cp_key && result.team_id) saveAnonCred(result.cp_key, result.team_id, result.claim_code);
         }
       }
-      spinner.succeed(`Proxy provisioned${name !== base ? ` as "${name}"` : ""}.`);
+      spinner.succeed(`Proxy provisioned${name !== base2 ? ` as "${name}"` : ""}.`);
       break;
     } catch (err) {
       const status = err instanceof ApiError ? err.status : void 0;
       const collision = err instanceof ApiError && (err.status === 409 || /exist|taken|available/i.test(err.message));
       if (collision && attempt < 3) {
-        name = `${base}${salt()}`;
+        name = `${base2}${salt()}`;
         continue;
       }
       if (status === 401) {
@@ -5929,14 +6004,14 @@ async function provision(spec2, target, opts) {
       try {
         await addPreapprovalRule(tenant2, email);
       } catch {
-        console.log(import_chalk38.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+        console.log(import_chalk39.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
       }
     }
   }
   return { projectId, version: version2, environment, dpKey, mcpHost, proxyUrl, anon, access, tenant: tenant2 };
 }
 async function writeTargetAuth(p, auth, secret) {
-  const spinner = (0, import_ora20.default)("Storing target credentials (encrypted)...").start();
+  const spinner = (0, import_ora21.default)("Storing target credentials (encrypted)...").start();
   try {
     await cpPost(
       p.anon,
@@ -5958,7 +6033,7 @@ async function writeTargetAuth(p, auth, secret) {
   }
 }
 async function uploadSpec(p, specText, opts) {
-  const spinner = (0, import_ora20.default)("Uploading the spec...").start();
+  const spinner = (0, import_ora21.default)("Uploading the spec...").start();
   let out;
   try {
     out = await cpPost(
@@ -5973,7 +6048,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk38.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk39.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -5981,12 +6056,12 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk38.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk39.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
 async function publishMcp(p, spec2) {
-  const spinner = (0, import_ora20.default)("Publishing the MCP catalogue...").start();
+  const spinner = (0, import_ora21.default)("Publishing the MCP catalogue...").start();
   try {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
@@ -6022,14 +6097,14 @@ var revealAuth = false;
 function renderToolEvents(events, dpKey) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk38.default.green("\u2713") : import_chalk38.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk38.default.cyan(e.name)} ${import_chalk38.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
+    const mark = ok ? import_chalk39.default.green("\u2713") : import_chalk39.default.red("\u2717");
+    console.log(`  ${mark} ${import_chalk39.default.cyan(e.name)} ${import_chalk39.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk38.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
+      console.log(import_chalk39.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
       if (dpKey) {
         const keyLine = `        -H 'X-API-Key: ${revealAuth ? dpKey : maskKey(dpKey)}'`;
-        const hint = revealAuth ? "" : import_chalk38.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk38.default.dim(keyLine) + hint);
+        const hint = revealAuth ? "" : import_chalk39.default.yellow("  \u2190 /showauth will reveal this");
+        console.log(import_chalk39.default.dim(keyLine) + hint);
       }
     }
   }
@@ -6038,9 +6113,9 @@ function billingLine(billing) {
   if (!billing || typeof billing.cents !== "number") return null;
   if (typeof billing.free_turns_remaining === "number") return null;
   const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk38.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk38.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
+  let line = import_chalk39.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk39.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
   if (typeof billing.credits_remaining === "number") {
-    line += import_chalk38.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk39.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -6048,21 +6123,21 @@ function freeBudgetWarning(billing, anon) {
   if (!anon || !billing) return null;
   if (typeof billing.free_turns_remaining === "number") {
     const left2 = billing.free_turns_remaining;
-    if (left2 <= 0) return import_chalk38.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk38.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
+    if (left2 <= 0) return import_chalk39.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk39.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof billing.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(billing.cents || 0, 0.02);
   const left = Math.floor(billing.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk38.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk38.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk39.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk39.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 function printAssistant(delta) {
   for (let i = delta.length - 1; i >= 0; i--) {
     const m = delta[i];
     if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk38.default.green("assistant \u203A ") + m.content + "\n");
+      console.log("\n" + import_chalk39.default.green("assistant \u203A ") + m.content + "\n");
       return;
     }
   }
@@ -6072,7 +6147,7 @@ async function replTurn(p, messages, userText) {
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
   for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora20.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
+    const spinner = (0, import_ora21.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
     const body = {
       turn_id: turnId,
       messages,
@@ -6088,7 +6163,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk38.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk39.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     let data = null;
@@ -6106,12 +6181,12 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (res.status === 401) {
-      console.log(import_chalk38.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
+      console.log(import_chalk39.default.red("  The proxy rejected the API key (401). The key may have been revoked; re-run `apiblaze apichat` to re-provision."));
       return;
     }
     if (!res.ok || !data) {
       const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk38.default.red(`  Chat error: ${err}`));
+      console.log(import_chalk39.default.red(`  Chat error: ${err}`));
       return;
     }
     if (Array.isArray(data.delta)) {
@@ -6125,25 +6200,25 @@ async function replTurn(p, messages, userText) {
     if (warn) console.log(warn);
     if (!data.continue) return;
   }
-  console.log(import_chalk38.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
+  console.log(import_chalk39.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
 }
 function renderUpsell(p, upsell) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk38.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk38.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk39.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk39.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
-  console.log("\n" + import_chalk38.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  console.log("\n" + import_chalk39.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "PAUSED") {
     if (!loggedIn) {
-      console.log(import_chalk38.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk39.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk38.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk39.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk38.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk39.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
@@ -6212,9 +6287,9 @@ async function openServerProxy(project) {
   const prior = loadApichats().find((a) => a.projectId === project.projectId && a.dpKey);
   let dpKey = prior?.dpKey;
   if (!dpKey) {
-    console.log(import_chalk38.default.dim(`  Minting an API key for tenant ${import_chalk38.default.bold(tenant2)} to query project ${import_chalk38.default.bold(project.projectName)}\u2026`));
+    console.log(import_chalk39.default.dim(`  Minting an API key for tenant ${import_chalk39.default.bold(tenant2)} to query project ${import_chalk39.default.bold(project.projectName)}\u2026`));
     dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-    console.log(`  ${import_chalk38.default.green("\u2714")} API key: ${import_chalk38.default.dim(maskKey(dpKey))}`);
+    console.log(`  ${import_chalk39.default.green("\u2714")} API key: ${import_chalk39.default.dim(maskKey(dpKey))}`);
   }
   const p = {
     projectId: project.projectId,
@@ -6227,7 +6302,7 @@ async function openServerProxy(project) {
     // Reusing an owned proxy: logged-in apichat doors default to invite-only.
     access: "invite"
   };
-  const spinner = (0, import_ora20.default)("Preparing the chat\u2026").start();
+  const spinner = (0, import_ora21.default)("Preparing the chat\u2026").start();
   try {
     const raw = await admin({
       method: "GET",
@@ -6239,7 +6314,7 @@ async function openServerProxy(project) {
     if (spec2 && (spec2.paths || spec2.openapi)) {
       await publishMcp(p, spec2);
     } else {
-      console.log(import_chalk38.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk39.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -6292,7 +6367,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk38.default.bold(a.name)} ${import_chalk38.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk39.default.bold(a.name)} ${import_chalk39.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -6302,14 +6377,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk38.default.bold(pr.projectName)} ${import_chalk38.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk39.default.bold(pr.projectName)} ${import_chalk39.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk38.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk39.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -6383,36 +6458,36 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk38.default.cyan.bold("Chat with your API") + import_chalk38.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk38.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk39.default.cyan.bold("Chat with your API") + import_chalk39.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk39.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk38.default.dim(
+    import_chalk39.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk38.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk39.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk38.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk39.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk38.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk39.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       const justLoggedIn = !loadCredentials();
       if (justLoggedIn) {
-        console.log(import_chalk38.default.dim("  Logging in to claim your workspace\u2026"));
+        console.log(import_chalk39.default.dim("  Logging in to claim your workspace\u2026"));
         try {
           await runLogin();
         } catch (err) {
-          console.log(import_chalk38.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk39.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           continue;
         }
         if (!loadCredentials()) continue;
@@ -6423,30 +6498,30 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk38.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk39.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk38.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk39.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk38.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk39.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk38.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk39.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk38.default.dim("\nBye."));
+  console.log(import_chalk39.default.dim("\nBye."));
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk38.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk39.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -6459,7 +6534,7 @@ async function runApichat(opts) {
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk38.default.dim("Target:")} ${import_chalk38.default.bold(target)}`);
+  console.log(`  ${import_chalk39.default.dim("Target:")} ${import_chalk39.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -6468,7 +6543,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk38.default.dim("Proxy: ")} ${import_chalk38.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk39.default.dim("Proxy: ")} ${import_chalk39.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -6487,31 +6562,31 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk38.default.dim("  Target auth: none required."));
+    console.log(import_chalk39.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk38.default.green("\u2713")} proxy  ${import_chalk38.default.bold(p.proxyUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk39.default.green("\u2713")} proxy  ${import_chalk39.default.bold(p.proxyUrl)}`);
   if (mcpUrl) {
-    console.log(`  ${import_chalk38.default.green("\u2713")} mcp    ${import_chalk38.default.bold(mcpUrl)}`);
+    console.log(`  ${import_chalk39.default.green("\u2713")} mcp    ${import_chalk39.default.bold(mcpUrl)}`);
     if (p.access === "invite") {
-      console.log(import_chalk38.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
-      console.log(import_chalk38.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+      console.log(import_chalk39.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk39.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
     } else {
-      console.log(import_chalk38.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+      console.log(import_chalk39.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
     }
   }
   if (p.anon) {
-    console.log(import_chalk38.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
+    console.log(import_chalk39.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk39 = __toESM(require("chalk"));
-var import_ora21 = __toESM(require("ora"));
+var import_chalk40 = __toESM(require("chalk"));
+var import_ora22 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 var DEFAULT_SCOPE = "openid email profile offline_access";
@@ -6532,7 +6607,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk39.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk40.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -6543,7 +6618,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk39.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk40.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -6555,25 +6630,25 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora21.default)("Finding the login app...").start();
+    const s2 = (0, import_ora22.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk39.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk40.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk39.default.cyan("\u2192")} Logging in to ${import_chalk39.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk40.default.cyan("\u2192")} Logging in to ${import_chalk40.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk39.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk39.default.bold(userCode)}
+  Open: ${import_chalk40.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk40.default.bold(userCode)}
 `);
-    console.log(import_chalk39.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk40.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -6588,7 +6663,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk39.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk40.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -6601,29 +6676,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk39.default.cyan("Consumer")} ${import_chalk39.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk39.default.bold(fresh.tenant)}
+  console.log(`${import_chalk40.default.cyan("Consumer")} ${import_chalk40.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk40.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk39.default.bold("access_token")}  ${import_chalk39.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk40.default.bold("access_token")}  ${import_chalk40.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk39.default.bold("id_token")}      ${import_chalk39.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk40.default.bold("id_token")}      ${import_chalk40.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk39.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk40.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk39.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk40.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora21.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora22.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk39.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk39.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk40.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk40.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -6631,16 +6706,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk39.default.yellow("No API keys yet."));
+    console.log(import_chalk40.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk39.default.green(clear) : import_chalk39.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk39.default.dim(`exp ${k.expires_at}`) : import_chalk39.default.dim("no expiry");
-      console.log(`  ${import_chalk39.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk39.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk40.default.green(clear) : import_chalk40.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk40.default.dim(`exp ${k.expires_at}`) : import_chalk40.default.dim("no expiry");
+      console.log(`  ${import_chalk40.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk40.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk39.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk40.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -6654,7 +6729,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora21.default)("Creating key...").start();
+  const s2 = (0, import_ora22.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -6662,13 +6737,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk39.default.green(key)}  ${import_chalk39.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk39.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk40.default.green(key)}  ${import_chalk40.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk40.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk40 = __toESM(require("chalk"));
-var import_ora22 = __toESM(require("ora"));
+var import_chalk41 = __toESM(require("chalk"));
+var import_ora23 = __toESM(require("ora"));
 var fs10 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_admin();
@@ -6710,18 +6785,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk40.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk41.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs10.existsSync(path7.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora22.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora23.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk40.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk40.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk41.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk41.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -6846,8 +6921,8 @@ function generateInspector(root, router) {
       fs10.writeFileSync(f2, INSPECTOR_PAGE);
       return path7.relative(root, f2);
     }
-    const base = fs10.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
-    const dir = path7.join(base, "abz-inspector");
+    const base2 = fs10.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
+    const dir = path7.join(base2, "abz-inspector");
     fs10.mkdirSync(dir, { recursive: true });
     const f = path7.join(dir, "page.tsx");
     fs10.writeFileSync(f, INSPECTOR_PAGE);
@@ -6860,7 +6935,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora22.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora23.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -6872,29 +6947,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk40.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk41.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk41.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk40.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk41.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk40.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk40.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk41.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk41.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk40.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk41.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk40.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk40.default.cyan("apiblaze login")}  then  ${import_chalk40.default.cyan("apiblaze claim")}   ${import_chalk40.default.dim("(no code needed here)")}`);
-  console.log(import_chalk40.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk41.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk41.default.cyan("apiblaze login")}  then  ${import_chalk41.default.cyan("apiblaze claim")}   ${import_chalk41.default.dim("(no code needed here)")}`);
+  console.log(import_chalk41.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path7.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk40.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk41.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -6905,10 +6980,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk40.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk41.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk41.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk40.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk41.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -6917,7 +6992,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora22.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora23.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -6931,39 +7006,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk40.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk41.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk40.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk41.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk40.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk41.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk40.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk41.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk40.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk40.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk40.default.bold("candidates")} \u2014 list them:  ${import_chalk40.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk40.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk41.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk41.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk41.default.bold("candidates")} \u2014 list them:  ${import_chalk41.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk41.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk40.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk40.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk41.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk41.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk40.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk40.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk40.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk41.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk41.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk41.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk40.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk40.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk41.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk41.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk41 = __toESM(require("chalk"));
-var import_ora23 = __toESM(require("ora"));
+var import_chalk42 = __toESM(require("chalk"));
+var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -6973,7 +7048,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk41.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk42.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -6991,30 +7066,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk41.default.bold(`
+  console.log(import_chalk42.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk41.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk41.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk41.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk41.default.bold(`
+  if (!routed.length) console.log(import_chalk42.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk42.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk42.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk42.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk41.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk42.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk41.default.yellow("\u25CB")} ${c.origin}  ${import_chalk41.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk42.default.yellow("\u25CB")} ${c.origin}  ${import_chalk42.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk41.default.dim(`
+    console.log(import_chalk42.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk41.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk42.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk41.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk42.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora23.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora24.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -7025,7 +7100,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora23.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora24.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -7042,7 +7117,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora23.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora24.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -7053,7 +7128,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora23.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora24.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -7064,7 +7139,7 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk42 = __toESM(require("chalk"));
+var import_chalk43 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
@@ -7097,82 +7172,82 @@ function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk42.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk42.default.bold("\n  Upstash"));
+  console.log(import_chalk43.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk43.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk42.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk42.default.yellow(o.key)} ${import_chalk42.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk42.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk43.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk43.default.yellow(o.key)} ${import_chalk43.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk43.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk42.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk43.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk42.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk43.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk42.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk42.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
-  console.log(import_chalk42.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk43.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk43.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk43.default.red(`    error: ${e}`));
+  console.log(import_chalk43.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk42.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk43.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk42.default.yellow(s.store_id)} ${import_chalk42.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk43.default.yellow(s.store_id)} ${import_chalk43.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk42.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk43.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk42.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk43.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk42.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk43.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk42.default.yellow(s.store_id)} ${import_chalk42.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk43.default.yellow(s.store_id)} ${import_chalk43.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk42.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk43.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk42.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk43.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
-  console.log(import_chalk42.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk43.default.red(`    error: ${e}`));
+  console.log(import_chalk43.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk42.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk42.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk42.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk43.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk43.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk43.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk42.default.green(`    no ghost tuples ${import_chalk42.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk43.default.green(`    no ghost tuples ${import_chalk43.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk42.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk43.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk42.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk43.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk42.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk43.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk42.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk43.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk42.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk43.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk42.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk43.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk42.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk42.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk42.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk42.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk42.default.cyan("apiblaze op credits")}        list credit wallets`);
-      console.log(import_chalk42.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+      console.log(import_chalk43.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk43.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk43.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk43.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk43.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk43.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
 `));
       return;
     }
@@ -7191,17 +7266,17 @@ async function runOp(sub, opts = {}) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk42.default.green("Nothing to sweep."));
+        console.log(import_chalk43.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline2 = await import("readline/promises");
         const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk42.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk43.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk42.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk43.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -7212,15 +7287,15 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk42.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk43.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk42.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk42.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk42.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk43.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk43.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk43.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk42.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk43.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -7283,7 +7358,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk43.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk44.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -7361,12 +7436,17 @@ tenant.command("create").description("Create a tenant in your team (tenant names
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Delete a tenant (full cascade)").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
+var admins = new import_commander.Command("admins").description("Manage who can administer a tenant's users & groups (the first-admin bootstrap the widget needs)").option("--tenant <slug>", "Tenant slug (e.g. nino)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--json", "Output machine-readable JSON").action(action((opts) => runAdminsList(opts)));
+admins.command("list").description("List a tenant's admins").option("--tenant <slug>", "Tenant slug").option("--team <id|name>", "Team").option("--json", "JSON").action(action((opts, cmd) => runAdminsList({ ...cmd.parent?.opts(), ...opts })));
+admins.command("add").description("Add an email as a tenant admin (e.g. yourself, to start)").argument("<email>", "Email to grant admin").option("--tenant <slug>", "Tenant slug").option("--team <id|name>", "Team").option("--json", "JSON").action(action((email, opts, cmd) => runAdminsAdd(email, { ...cmd.parent?.opts(), ...opts })));
+admins.command("remove").description("Remove a tenant admin").argument("<email>", "Email to remove").option("--tenant <slug>", "Tenant slug").option("--team <id|name>", "Team").option("--json", "JSON").action(action((email, opts, cmd) => runAdminsRemove(email, { ...cmd.parent?.opts(), ...opts })));
+program.addCommand(admins);
 program.command("iam").description("Turn users & groups on/off for a proxy's tenant (identified calls get their user's groups applied)").argument("<project>", "Project name or id").argument("<state>", "on | off").option("--tenant <name>", "Tenant to toggle (defaults to the project's tenant)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, state, opts) => runIamToggle(project, state, opts)));
 program.command("identified").description("Require calls to identify their end user (X-End-User-Id or a login token) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
 var apikeys = new import_commander.Command("apikeys").description("Producer control-plane API keys (list, then offer to create one)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
-apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyList(opts)));
-apikeys.command("mint").description("Create a control-plane API key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runKeyMint(opts)));
-apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts) => runKeyRevoke(keyId, opts)));
+apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyList({ ...cmd.parent?.opts(), ...opts })));
+apikeys.command("mint").description("Create a control-plane API key (secret shown once)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
+apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts, cmd) => runKeyRevoke(keyId, { ...cmd.parent?.opts(), ...opts })));
 program.addCommand(apikeys, { hidden: true });
 var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "residue | sweep | credits (omit for the menu)").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").action(action((sub, opts) => runOp(sub, opts)));
 program.addCommand(op, { hidden: true });
@@ -7378,7 +7458,7 @@ spec.command("delete-rule").description("Delete the saved rules for a route (e.g
 var HELP_GROUPS = [
   { title: "Chat", commands: ["apichat", "agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
-  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "admins", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" }
@@ -7397,7 +7477,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk43.default.bold(g.title)}
+    return `${import_chalk44.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -7431,14 +7511,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk43.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk44.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk43.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk43.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk44.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk44.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -7446,16 +7526,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk43.default.red(`
+    console.error(import_chalk44.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk43.default.red(`
+    console.error(import_chalk44.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk43.default.red("\nUnknown error"));
+    console.error(import_chalk44.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);