apiblaze 0.19.28 → 0.19.30

package/dist/index.js

@@ -237,7 +237,7 @@ var init_api = __esm({
     "use strict";
     init_auth();
     init_types();
-    DASHBOARD_BASE = "https://dashboard.apiblaze.com";
+    DASHBOARD_BASE = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
     PUBLIC_API_BASE = "https://api.apiblaze.com";
   }
 });
@@ -272,14 +272,14 @@ async function resolveLinkedTeam(opts) {
     return { teamId: picked2.teamId, teamName: picked2.name };
   }
   if (opts.preferredId) {
-    console.log(import_chalk.default.yellow("\nYour previously linked team is no longer available."));
+    console.error(import_chalk.default.yellow("\nYour previously linked team is no longer available."));
   }
   if (teams.length === 1) {
-    console.log(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);
+    console.error(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);
     return { teamId: teams[0].teamId, teamName: teams[0].name };
   }
   if (!opts.interactive) {
-    console.log(import_chalk.default.yellow(`Linking to "${teams[0].name}" \u2014 pass --team to choose another.`));
+    console.error(import_chalk.default.yellow(`Linking to "${teams[0].name}" \u2014 pass --team to choose another.`));
     return { teamId: teams[0].teamId, teamName: teams[0].name };
   }
   const { default: inquirer3 } = await import("inquirer");
@@ -392,24 +392,24 @@ function maskBody(body) {
 }
 function renderTrace() {
   if (!verbose || entries.length === 0) return;
-  console.log(import_chalk6.default.dim("\n" + "\u2500".repeat(64)));
-  console.log(import_chalk6.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
-  console.log(
+  console.error(import_chalk6.default.dim("\n" + "\u2500".repeat(64)));
+  console.error(import_chalk6.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
+  console.error(
     import_chalk6.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
   );
   entries.forEach((e, i) => {
     const n = entries.length > 1 ? import_chalk6.default.bold(`${i + 1}. `) : "";
-    if (e.summary) console.log(`${n}${import_chalk6.default.cyan(e.summary)}${e.status ? import_chalk6.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    if (e.summary) console.error(`${n}${import_chalk6.default.cyan(e.summary)}${e.status ? import_chalk6.default.dim(`  (HTTP ${e.status})`) : ""}`);
     const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
     const masked = maskBody(e.body);
     const hasBody = e.method !== "GET" && masked !== void 0;
-    console.log(import_chalk6.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
-    console.log(import_chalk6.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
+    console.error(import_chalk6.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.error(import_chalk6.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
     if (hasBody) {
-      console.log(import_chalk6.default.green("    -H 'Content-Type: application/json' \\"));
-      console.log(import_chalk6.default.green(`    -d '${masked}'`));
+      console.error(import_chalk6.default.green("    -H 'Content-Type: application/json' \\"));
+      console.error(import_chalk6.default.green(`    -d '${masked}'`));
     }
-    if (i < entries.length - 1) console.log();
+    if (i < entries.length - 1) console.error();
   });
   entries.length = 0;
 }
@@ -458,7 +458,7 @@ function formatBilling(billing) {
 }
 function maybePrintBilling(data) {
   const line = formatBilling(data?.billing);
-  if (line) console.log(import_chalk7.default.magenta(`  ${line}`));
+  if (line) console.error(import_chalk7.default.magenta(`  ${line}`));
 }
 var import_chalk7, DASHBOARD_BASE3;
 var init_admin = __esm({
@@ -714,7 +714,7 @@ async function createTenantRow(teamId) {
     const { name } = await inquirer3.prompt([{
       type: "input",
       name: "name",
-      message: `Tenant name ${import_chalk27.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      message: `Tenant name ${import_chalk30.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
       validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
     }]);
     const slug = name.trim();
@@ -729,7 +729,7 @@ async function createTenantRow(teamId) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
-        console.log(import_chalk27.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
+        console.log(import_chalk30.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
         continue;
       }
       throw err;
@@ -746,11 +746,11 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     pageSize: 10,
     choices: [
       ...PROVIDERS.map((p) => ({ name: p.label, value: p.id })),
-      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk27.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
+      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk30.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
     ]
   }]);
   if (!provider) {
-    console.log(import_chalk27.default.dim("  No login method yet \u2014 add one later under Login methods."));
+    console.log(import_chalk30.default.dim("  No login method yet \u2014 add one later under Login methods."));
     return false;
   }
   const opt = PROVIDERS.find((p) => p.id === provider);
@@ -796,26 +796,26 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
 async function createTenantInteractive(teamId) {
   const { default: inquirer3 } = await import("inquirer");
   const tenant2 = await createTenantRow(teamId);
-  console.log(import_chalk27.default.green(`  Tenant ${import_chalk27.default.bold(tenant2)} created.`));
+  console.log(import_chalk30.default.green(`  Tenant ${import_chalk30.default.bold(tenant2)} created.`));
   const { users } = await inquirer3.prompt([{
     type: "confirm",
     name: "users",
     default: false,
-    message: `Enable Users & groups? ${import_chalk27.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
+    message: `Enable Users & groups? ${import_chalk30.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
   }]);
   if (users) {
     await admin({ method: "PATCH", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`, body: { enabled: true }, summary: "Enable Users & groups" }).catch(() => {
     });
-    console.log(import_chalk27.default.green("  Users & groups enabled."));
+    console.log(import_chalk30.default.green("  Users & groups enabled."));
   }
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk27, import_ora10, PROVIDERS, DEFAULT_SCOPES;
+var import_chalk30, import_ora10, PROVIDERS, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
-    import_chalk27 = __toESM(require("chalk"));
+    import_chalk30 = __toESM(require("chalk"));
     import_ora10 = __toESM(require("ora"));
     init_admin();
     PROVIDERS = [
@@ -841,7 +841,7 @@ var tenant_pick_exports = {};
 __export(tenant_pick_exports, {
   pickTenant: () => pickTenant
 });
-async function fetchPage(teamId, q) {
+async function fetchPage2(teamId, q) {
   const out = await admin({
     method: "GET",
     path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1&limit=${PAGE}${q ? `&q=${encodeURIComponent(q)}` : ""}`,
@@ -854,10 +854,10 @@ async function fetchPage(teamId, q) {
 }
 function label(t, defaultTenant, active) {
   const tags = [
-    t.tenant_name === active ? import_chalk28.default.cyan("active scope") : "",
-    t.tenant_name === defaultTenant ? import_chalk28.default.dim("team default") : ""
+    t.tenant_name === active ? import_chalk31.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk31.default.dim("team default") : ""
   ].filter(Boolean).join(", ");
-  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk28.default.dim(`  ${t.display_name}`) : "";
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk31.default.dim(`  ${t.display_name}`) : "";
   return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
 }
 async function pickTenant(teamId, opts = {}) {
@@ -866,13 +866,13 @@ async function pickTenant(teamId, opts = {}) {
   let q = opts.initialQuery ?? "";
   for (; ; ) {
     const spinner = (0, import_ora11.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
-    const page = await fetchPage(teamId, q).finally(() => spinner.stop());
+    const page = await fetchPage2(teamId, q).finally(() => spinner.stop());
     if (!page.total && !q) {
       if (opts.allowCreate) {
         const { make } = await inquirer3.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
         if (make) return await createTenantInline(teamId);
       }
-      console.error(import_chalk28.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk31.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       return null;
     }
     const truncated = page.total > page.rows.length;
@@ -881,7 +881,7 @@ async function pickTenant(teamId, opts = {}) {
       value: t.tenant_name
     }));
     if (truncated || q) {
-      choices.push(new inquirer3.Separator(import_chalk28.default.dim(
+      choices.push(new inquirer3.Separator(import_chalk31.default.dim(
         truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
       )));
       choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
@@ -915,11 +915,11 @@ async function createTenantInline(teamId) {
   const { createTenantInteractive: createTenantInteractive2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
   return createTenantInteractive2(teamId);
 }
-var import_chalk28, import_ora11, PAGE;
+var import_chalk31, import_ora11, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
     "use strict";
-    import_chalk28 = __toESM(require("chalk"));
+    import_chalk31 = __toESM(require("chalk"));
     import_ora11 = __toESM(require("ora"));
     init_admin();
     init_auth();
@@ -929,10 +929,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk45 = __toESM(require("chalk"));
+var import_chalk48 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.28";
+var version = "0.19.30";
 
 // src/index.ts
 init_types();
@@ -942,7 +942,7 @@ var import_chalk2 = __toESM(require("chalk"));
 var import_ora = __toESM(require("ora"));
 init_auth();
 init_team();
-var DASHBOARD_BASE2 = "https://dashboard.apiblaze.com";
+var DASHBOARD_BASE2 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 function openBrowser(url) {
   const { exec } = require("child_process");
   const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
@@ -3304,8 +3304,863 @@ async function runExport(projectArg, versionArg, opts) {
   if (target === "kong") console.log(import_chalk24.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
 }
 
-// src/commands/config.ts
+// src/commands/logs.ts
+var import_chalk26 = __toESM(require("chalk"));
+init_admin();
+init_auth();
+init_resolve();
+
+// src/lib/log-view.ts
 var import_chalk25 = __toESM(require("chalk"));
+var readline2 = __toESM(require("readline"));
+function statusColor(status) {
+  if (status < 300) return import_chalk25.default.green;
+  if (status < 400) return import_chalk25.default.blue;
+  if (status < 500) return import_chalk25.default.yellow;
+  return import_chalk25.default.red;
+}
+function methodColor(method) {
+  switch ((method || "").toUpperCase()) {
+    case "GET":
+      return import_chalk25.default.green;
+    case "POST":
+      return import_chalk25.default.blue;
+    case "PUT":
+    case "PATCH":
+      return import_chalk25.default.yellow;
+    case "DELETE":
+      return import_chalk25.default.red;
+    default:
+      return import_chalk25.default.white;
+  }
+}
+function clock(ts) {
+  return new Date(ts).toLocaleTimeString(void 0, { hour12: false });
+}
+var ROUTE_W = 34;
+function routeCell(route) {
+  const r = route || "\u2014";
+  return (r.length > ROUTE_W ? `\u2026${r.slice(-(ROUTE_W - 1))}` : r).padEnd(ROUTE_W);
+}
+function formatRow(r) {
+  const time = import_chalk25.default.dim(clock(r.ts));
+  const method = methodColor(r.method)(String(r.method || "\u2014").padEnd(6));
+  const route = routeCell(String(r.route || "\u2014"));
+  const status = statusColor(r.status)(String(r.status ?? "\u2014").padStart(3));
+  const ms = import_chalk25.default.dim(`${r.duration_ms}ms`.padStart(8));
+  const step = r.error_step ? import_chalk25.default.dim(` ${r.error_step}`) : "";
+  return `${time}  ${method} ${route} ${status} ${ms}${step}`;
+}
+function printRow(r, json) {
+  console.log(json ? JSON.stringify(r) : formatRow(r));
+}
+var WindowNotices = class {
+  constructor() {
+    this.saidUnavailable = false;
+    this.saidGap = false;
+    this.saidDropped = false;
+  }
+  note(res) {
+    if (res.history_unavailable && !this.saidUnavailable) {
+      this.saidUnavailable = true;
+      console.error(import_chalk25.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
+    }
+    if ((res.history_markers?.length ?? 0) > 0 && !this.saidGap) {
+      this.saidGap = true;
+      console.error(import_chalk25.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
+    }
+    if ((res.dropped_this_hour ?? 0) > 0 && !this.saidDropped) {
+      this.saidDropped = true;
+      console.error(import_chalk25.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
+    }
+  }
+};
+var MAX_RECONNECTS = 5;
+var PING_MS = Number(process.env.APIBLAZE_TAIL_PING_MS) || 3e4;
+var LIVENESS_MS = PING_MS * 2.5;
+var STABLE_MS = 3e4;
+var SEEN_CAP = 1e4;
+var TAIL_INSPECT_BUFFER = 500;
+var TAIL_INSPECT_CHOICES = 40;
+async function runTailSession(opts) {
+  const { default: WebSocket2 } = await import("ws");
+  guardStdoutPipe();
+  let closed = false;
+  let everConnected = false;
+  let reconnects = 0;
+  let openedAt = 0;
+  let lastFailure = "";
+  let pingTimer;
+  let activeSocket;
+  const seen = /* @__PURE__ */ new Set();
+  const seenOrder = [];
+  function remember(id) {
+    seen.add(id);
+    seenOrder.push(id);
+    if (seenOrder.length > SEEN_CAP) seen.delete(seenOrder.shift());
+  }
+  const interactive = !opts.json && !!process.stdin.isTTY && !!process.stdout.isTTY;
+  const recent = [];
+  const held = [];
+  let heldRowsDropped = 0;
+  let heldNotesDropped = 0;
+  let paused = false;
+  let keysBound = false;
+  function pushHeld(item) {
+    if (held.length >= TAIL_INSPECT_BUFFER) {
+      const victimIdx = held.findIndex((h) => h.kind === "row");
+      if (victimIdx >= 0) {
+        held.splice(victimIdx, 1);
+        heldRowsDropped++;
+      } else {
+        held.shift();
+        heldNotesDropped++;
+      }
+    }
+    held.push(item);
+  }
+  function diag(msg) {
+    if (paused) {
+      pushHeld({ kind: "note", msg });
+      return;
+    }
+    console.error(msg);
+  }
+  function flushHeld() {
+    if (!held.length && !heldRowsDropped && !heldNotesDropped) return;
+    const rows = held.filter((h) => h.kind === "row").length;
+    const total = rows + heldRowsDropped;
+    if (total) console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
+    for (const h of held) {
+      if (h.kind === "row") printRow(h.row, opts.json);
+      else console.error(h.msg);
+    }
+    if (heldRowsDropped || heldNotesDropped) {
+      console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
+    }
+    held.length = 0;
+    heldRowsDropped = 0;
+    heldNotesDropped = 0;
+  }
+  function shutdown() {
+    closed = true;
+    if (pingTimer) clearInterval(pingTimer);
+    unbindKeys();
+    try {
+      activeSocket?.close();
+    } catch {
+    }
+    if (!opts.json) console.log(import_chalk25.default.dim("\nStopped."));
+    process.exit(0);
+  }
+  function onKeypress(_s, key) {
+    if (key?.ctrl && key.name === "c") {
+      shutdown();
+      return;
+    }
+    if (key?.name === "return" || key?.name === "enter") void openInspector();
+  }
+  function bindKeys() {
+    if (!interactive || keysBound || paused) return;
+    keysBound = true;
+    readline2.emitKeypressEvents(process.stdin);
+    process.stdin.setRawMode(true);
+    process.stdin.on("keypress", onKeypress);
+    process.stdin.resume();
+  }
+  function unbindKeys() {
+    if (!keysBound) return;
+    keysBound = false;
+    process.stdin.off("keypress", onKeypress);
+    if (process.stdin.isTTY) process.stdin.setRawMode(false);
+    process.stdin.pause();
+  }
+  async function openInspector() {
+    if (paused) return;
+    if (recent.length === 0) {
+      console.log(import_chalk25.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
+      return;
+    }
+    paused = true;
+    unbindKeys();
+    try {
+      const { default: inquirer3 } = await import("inquirer");
+      console.log(import_chalk25.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
+      for (; ; ) {
+        const choices = recent.slice(-TAIL_INSPECT_CHOICES).reverse().map((r) => ({ name: formatRow(r), value: r.request_id }));
+        choices.push({ name: import_chalk25.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
+        const { picked } = await inquirer3.prompt([{
+          type: "list",
+          name: "picked",
+          message: "Inspect which request?",
+          choices,
+          pageSize: 15
+        }]);
+        if (picked === "__resume__") break;
+        const row = recent.find((r) => r.request_id === picked);
+        if (row) printDetail(row, opts.detail);
+        else console.log(import_chalk25.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
+      }
+    } finally {
+      paused = false;
+      flushHeld();
+      console.log(import_chalk25.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
+      bindKeys();
+    }
+  }
+  process.on("SIGINT", shutdown);
+  function scheduleReconnect() {
+    if (closed) return;
+    if (reconnects >= MAX_RECONNECTS) {
+      paused = false;
+      flushHeld();
+      console.error(import_chalk25.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
+      process.exit(1);
+    }
+    const delay = Math.min(1e3 * 2 ** reconnects, 15e3);
+    reconnects++;
+    diag(import_chalk25.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
+    setTimeout(() => {
+      if (!closed) void connect();
+    }, delay);
+  }
+  async function connect() {
+    let url;
+    try {
+      url = await opts.mintTicket();
+    } catch (err) {
+      if (!everConnected) {
+        console.error(import_chalk25.default.red(`Could not start tail: ${err.message}`));
+        process.exit(1);
+      }
+      lastFailure = `ticket mint failed: ${err.message}`;
+      scheduleReconnect();
+      return;
+    }
+    let socket;
+    try {
+      socket = new WebSocket2(url);
+    } catch (err) {
+      lastFailure = `bad tail URL: ${err.message}`;
+      if (!everConnected) {
+        console.error(import_chalk25.default.red(`Could not start tail: ${lastFailure}`));
+        process.exit(1);
+      }
+      scheduleReconnect();
+      return;
+    }
+    activeSocket = socket;
+    let lastInbound = Date.now();
+    socket.on("open", () => {
+      const isReconnect = everConnected;
+      everConnected = true;
+      openedAt = Date.now();
+      lastInbound = Date.now();
+      lastFailure = "";
+      if (isReconnect) {
+        diag(import_chalk25.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
+      } else {
+        diag(import_chalk25.default.dim(interactive ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
+      }
+      bindKeys();
+      pingTimer = setInterval(() => {
+        if (Date.now() - lastInbound > LIVENESS_MS) {
+          lastFailure = `no pong for ${Math.round(LIVENESS_MS / 1e3)}s \u2014 connection presumed dead`;
+          try {
+            socket.terminate();
+          } catch {
+          }
+          return;
+        }
+        try {
+          socket.send("ping");
+        } catch {
+        }
+      }, PING_MS);
+    });
+    socket.on("message", (data) => {
+      lastInbound = Date.now();
+      let frame;
+      try {
+        frame = JSON.parse(String(data));
+      } catch {
+        return;
+      }
+      if (frame?.type === "ceiling") {
+        diag(import_chalk25.default.yellow(
+          `\u26A0 volume ceiling \u2014 ${Number(frame.dropped_this_hour) || 0} rows dropped this hour; errors keep streaming.`
+        ));
+        return;
+      }
+      if (!frame?.request_id || seen.has(frame.request_id)) return;
+      remember(frame.request_id);
+      if (opts.errorsOnly && Number(frame.status) < 400) return;
+      recent.push(frame);
+      if (recent.length > TAIL_INSPECT_BUFFER) recent.shift();
+      if (paused) {
+        pushHeld({ kind: "row", row: frame });
+        return;
+      }
+      printRow(frame, opts.json);
+    });
+    socket.on("error", (err) => {
+      lastFailure = err?.message || String(err);
+    });
+    socket.on("close", (code, reason) => {
+      if (pingTimer) clearInterval(pingTimer);
+      if (openedAt && Date.now() - openedAt >= STABLE_MS) reconnects = 0;
+      openedAt = 0;
+      const why = String(reason ?? "").trim();
+      if (why) lastFailure = `socket closed: ${why} (${code})`;
+      scheduleReconnect();
+    });
+  }
+  await connect();
+}
+function localDayMs(ts) {
+  const d = new Date(ts);
+  return new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime();
+}
+function nextLocalDayMs(dayMs) {
+  const d = new Date(dayMs);
+  return new Date(d.getFullYear(), d.getMonth(), d.getDate() + 1).getTime();
+}
+function dayKey(ts) {
+  const d = new Date(ts);
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+}
+function dayLabel(dayMs, now) {
+  const today = localDayMs(now);
+  const n = new Date(now);
+  const yesterday = new Date(n.getFullYear(), n.getMonth(), n.getDate() - 1).getTime();
+  if (dayMs === today) return "Today";
+  if (dayMs === yesterday) return "Yesterday";
+  return new Date(dayMs).toLocaleDateString(void 0, { weekday: "short", month: "short", day: "numeric" });
+}
+function groupIntoDays(rows) {
+  const byKey = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const r of [...rows].sort((a, b) => b.ts - a.ts)) {
+    const k = dayKey(r.ts);
+    let b = byKey.get(k);
+    if (!b) {
+      b = { key: k, dayMs: localDayMs(r.ts), rows: [], errors: 0 };
+      byKey.set(k, b);
+      order.push(b);
+    }
+    b.rows.push(r);
+    if (r.status >= 400) b.errors++;
+  }
+  return order;
+}
+var SCAN_LIMIT = 200;
+var PAGE_LIMIT = 50;
+var JSON_PAGE_LIMIT = 500;
+var MAX_EMPTY_HOPS = 100;
+async function fetchPage(fetchWindow3, params, notices) {
+  let cursor = params.cursor;
+  for (let hop = 0; ; hop++) {
+    const res = await fetchWindow3({ ...params, cursor });
+    notices.note(res);
+    const rows = res.rows ?? [];
+    if (rows.length > 0 || !res.next_cursor) {
+      return { rows, nextCursor: res.next_cursor ?? void 0 };
+    }
+    if (hop >= MAX_EMPTY_HOPS) {
+      console.error(import_chalk25.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
+      return { rows: [], nextCursor: res.next_cursor, fuseTripped: true };
+    }
+    if (hop === 0) console.error(import_chalk25.default.dim("searching older history\u2026"));
+    cursor = res.next_cursor;
+  }
+}
+var epipeGuarded = false;
+function guardStdoutPipe() {
+  if (epipeGuarded) return;
+  epipeGuarded = true;
+  process.stdout.on("error", (err) => {
+    if (err?.code === "EPIPE") process.exit(0);
+    throw err;
+  });
+}
+var PLAIN_MAX_ROWS = 200;
+async function runPlainList(opts, notices) {
+  guardStdoutPipe();
+  const rows = [];
+  let cursor;
+  let more = false;
+  let fuseTripped = false;
+  while (rows.length < PLAIN_MAX_ROWS) {
+    const page = await fetchPage(opts.fetchWindow, {
+      limit: Math.min(PAGE_LIMIT, PLAIN_MAX_ROWS - rows.length),
+      errorsOnly: opts.errorsOnly,
+      cursor
+    }, notices);
+    rows.push(...page.rows);
+    if (page.fuseTripped) {
+      more = true;
+      fuseTripped = true;
+      break;
+    }
+    if (!page.nextCursor) break;
+    cursor = page.nextCursor;
+    if (rows.length >= PLAIN_MAX_ROWS) {
+      more = true;
+      break;
+    }
+  }
+  if (rows.length === 0) {
+    console.log(import_chalk25.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+    return;
+  }
+  const now = Date.now();
+  for (const d of groupIntoDays(rows)) {
+    console.log(import_chalk25.default.bold(dayLabel(d.dayMs, now)));
+    for (const r of d.rows) console.log(`  ${formatRow(r)}`);
+    console.log("");
+  }
+  const errs = rows.filter((r) => r.status >= 400).length;
+  const tail = fuseTripped ? " \xB7 stopped early (long empty span) \u2014 older requests may still exist" : more ? " \xB7 showing the most recent \u2014 `--json` streams the rest" : "";
+  console.log(import_chalk25.default.dim(
+    `${rows.length} request${rows.length === 1 ? "" : "s"} \xB7 ${errs} error${errs === 1 ? "" : "s"}${tail}`
+  ));
+}
+async function runHistoryBrowser(opts) {
+  const notices = new WindowNotices();
+  if (opts.json) {
+    guardStdoutPipe();
+    let cursor2;
+    let any = false;
+    for (; ; ) {
+      const page = await fetchPage(opts.fetchWindow, {
+        limit: JSON_PAGE_LIMIT,
+        errorsOnly: opts.errorsOnly,
+        cursor: cursor2
+      }, notices);
+      for (const r of page.rows) console.log(JSON.stringify(r));
+      any = any || page.rows.length > 0;
+      if (page.fuseTripped || !page.nextCursor) {
+        if (!any && !page.fuseTripped) console.error(import_chalk25.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+        return;
+      }
+      cursor2 = page.nextCursor;
+    }
+  }
+  if (opts.plain || !process.stdout.isTTY || !process.stdin.isTTY) {
+    await runPlainList(opts, notices);
+    return;
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  let scanRows = [];
+  let scanCursor;
+  {
+    const first = await fetchPage(opts.fetchWindow, {
+      limit: SCAN_LIMIT,
+      errorsOnly: opts.errorsOnly
+    }, notices);
+    scanRows = first.rows;
+    scanCursor = first.nextCursor;
+    if (scanRows.length === 0) {
+      console.log(import_chalk25.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+      return;
+    }
+  }
+  let day;
+  let scanFloorUnknown = false;
+  for (; ; ) {
+    const days = groupIntoDays(scanRows);
+    const now2 = Date.now();
+    const oldestKey = days[days.length - 1]?.key;
+    const choices = days.map((d) => ({
+      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk25.default.red(`  ${d.errors} errors`) : ""}`,
+      value: d.key
+    }));
+    if (scanCursor) choices.push({ name: import_chalk25.default.dim("\u2026 older days"), value: "__older__" });
+    const { chosenDay } = await inquirer3.prompt([{
+      type: "list",
+      name: "chosenDay",
+      message: "Which day?",
+      choices,
+      pageSize: 20
+    }]);
+    if (chosenDay === "__older__") {
+      const more = await fetchPage(opts.fetchWindow, {
+        limit: SCAN_LIMIT,
+        errorsOnly: opts.errorsOnly,
+        cursor: scanCursor
+      }, notices);
+      scanRows = scanRows.concat(more.rows);
+      if (more.fuseTripped) {
+        scanFloorUnknown = true;
+        scanCursor = void 0;
+      } else {
+        scanCursor = more.nextCursor;
+        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk25.default.dim("That was everything \u2014 no older requests."));
+      }
+      continue;
+    }
+    day = days.find((d) => d.key === chosenDay);
+    break;
+  }
+  const since = day.dayMs;
+  const until = nextLocalDayMs(day.dayMs) - 1;
+  const now = Date.now();
+  let cursor;
+  let pageRows = [];
+  let moreCursor;
+  for (; ; ) {
+    const page = await fetchPage(opts.fetchWindow, {
+      limit: PAGE_LIMIT,
+      since,
+      until,
+      errorsOnly: opts.errorsOnly,
+      cursor
+    }, notices);
+    if (page.rows.length === 0 && pageRows.length === 0) {
+      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
+      return;
+    }
+    if (page.rows.length === 0) {
+      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
+      moreCursor = void 0;
+    } else {
+      pageRows = page.rows;
+      moreCursor = page.fuseTripped ? void 0 : page.nextCursor;
+    }
+    console.log("");
+    const choices = pageRows.map((r) => ({
+      name: formatRow(r),
+      value: r.request_id
+    }));
+    if (moreCursor) choices.push({ name: import_chalk25.default.dim("\u2026 load more"), value: "__more__" });
+    choices.push({ name: import_chalk25.default.dim("quit"), value: "__quit__" });
+    for (; ; ) {
+      const { picked } = await inquirer3.prompt([{
+        type: "list",
+        name: "picked",
+        message: `${dayLabel(day.dayMs, now)} \u2014 select a request for detail`,
+        choices,
+        pageSize: 20
+      }]);
+      if (picked === "__quit__") return;
+      if (picked === "__more__") {
+        cursor = moreCursor;
+        break;
+      }
+      const row = pageRows.find((r) => r.request_id === picked);
+      if (row) printDetail(row, opts.detail);
+    }
+  }
+}
+var NOISE_HEADER = /^(cf-|sec-ch-|sec-fetch-|x-forwarded-|x-real-ip$)/i;
+var HEADER_PRIORITY = [
+  "authorization",
+  "x-api-key",
+  "content-type",
+  "accept",
+  "x-end-user-id",
+  "user-agent",
+  "host",
+  "origin",
+  "referer",
+  "content-length",
+  "cookie"
+];
+var PANE_INDENT = " ".repeat(13);
+function wrapCells(items, width) {
+  const cols = Math.max(40, width - PANE_INDENT.length);
+  const lines = [];
+  let line = "";
+  for (const it of items) {
+    if (line && line.length + 2 + it.length > cols) {
+      lines.push(line);
+      line = "";
+    }
+    line = line ? `${line}  ${it}` : it;
+  }
+  if (line) lines.push(line);
+  return lines.join(`
+${PANE_INDENT}`);
+}
+function renderHeaders(h) {
+  if (!h) return import_chalk25.default.dim("\u2014");
+  const width = process.stdout.columns || 100;
+  if (h.values) {
+    const e = Object.entries(h.values);
+    if (!e.length) return import_chalk25.default.dim("none");
+    const rank = (k) => {
+      const i = HEADER_PRIORITY.indexOf(k.toLowerCase());
+      return i === -1 ? NOISE_HEADER.test(k) ? 999 : 500 : i;
+    };
+    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk25.default.dim(k + ":")} ${v}`).join(`
+${PANE_INDENT}`);
+  }
+  if (!h.names?.length) return import_chalk25.default.dim("none");
+  const names = [...h.names];
+  const noise = names.filter((n) => NOISE_HEADER.test(n));
+  const shown = names.filter((n) => !NOISE_HEADER.test(n)).sort((a, b) => {
+    const ia = HEADER_PRIORITY.indexOf(a.toLowerCase());
+    const ib = HEADER_PRIORITY.indexOf(b.toLowerCase());
+    return (ia === -1 ? 500 : ia) - (ib === -1 ? 500 : ib) || a.localeCompare(b);
+  });
+  const body = shown.length ? wrapCells(shown, width) : import_chalk25.default.dim("(all forwarding headers)");
+  const tail = noise.length ? `
+${PANE_INDENT}${import_chalk25.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
+  return `${body}${tail}  ${import_chalk25.default.dim("(names only)")}`;
+}
+function renderBody(b) {
+  if (!b) return import_chalk25.default.dim("\u2014");
+  const meta = [b.content_type, b.size != null ? `${b.size}B` : null, b.truncated ? "truncated" : null].filter(Boolean).join(" \xB7 ");
+  if (b.not_captured) return import_chalk25.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
+  const isShape = b.value === void 0 && b.shape !== void 0;
+  const content = b.value !== void 0 ? b.value : b.shape;
+  if (content === null || content === void 0 || content === "" || content === "empty") {
+    return import_chalk25.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
+  }
+  const text = typeof content === "string" ? content : JSON.stringify(content, null, 2);
+  const head = isShape ? import_chalk25.default.dim("shape only (values not captured)\n      ") : "";
+  return head + text.split("\n").join("\n      ");
+}
+function pane(title, tone, view, empty) {
+  console.log(`  ${tone(title)}`);
+  if (empty !== void 0) {
+    console.log(`    ${import_chalk25.default.dim(empty)}`);
+    return;
+  }
+  const v = view ?? {};
+  if (v.url) console.log(`    ${import_chalk25.default.dim("target")}   ${v.url}`);
+  if (v.status != null) {
+    console.log(`    ${import_chalk25.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk25.default.dim(" " + v.status_text) : ""}`);
+  }
+  if (v.raw_path) console.log(`    ${import_chalk25.default.dim("path")}     ${v.raw_path}`);
+  if (v.query && Object.keys(v.query).length) {
+    console.log(`    ${import_chalk25.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
+  }
+  if (v.jwt !== void 0) console.log(`    ${import_chalk25.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
+  console.log(`    ${import_chalk25.default.dim("headers")}  ${renderHeaders(v.headers)}`);
+  console.log(`    ${import_chalk25.default.dim("body")}     ${renderBody(v.body)}`);
+}
+function printDetail(r, mode = "producer") {
+  const v = r.views;
+  console.log("");
+  console.log(import_chalk25.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk25.default.dim(`  ${r.duration_ms}ms`));
+  const cost = typeof r.cost_cents === "number" && r.cost_cents > 0 ? ` \xB7 ${r.cost_cents}\xA2` : "";
+  console.log(import_chalk25.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
+  console.log("");
+  if (!v) {
+    console.log(import_chalk25.default.dim("  No view detail captured for this request.\n"));
+    return;
+  }
+  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk25.default.cyan, v.request);
+  if (mode === "producer") {
+    pane(
+      "Request (after) \u2014 APIblaze \u2192 upstream",
+      import_chalk25.default.cyan,
+      v.forwarded_request,
+      v.forwarded_request ? void 0 : "Request did not reach an upstream."
+    );
+    pane(
+      "Response (before) \u2014 upstream \u2192 APIblaze",
+      import_chalk25.default.magenta,
+      v.upstream_response,
+      v.upstream_response ? void 0 : "No upstream response."
+    );
+  }
+  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk25.default.magenta, v.response);
+  console.log("");
+}
+
+// src/commands/logs.ts
+async function resolve(projectArg, versionArg, opts) {
+  try {
+    getAccessToken();
+  } catch (err) {
+    const consumerOnly = !loadCredentials() && !!loadConsumer();
+    throw new Error(
+      err.message + (consumerOnly ? "\nYou're signed in as an API Consumer. A proxy's full logs need a Producer login; for your own requests run `apiblaze consumer logs`." : "")
+    );
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const match = await resolveProject(teamId, projectArg, versionArg);
+  const projectId = match.projectId;
+  const version2 = versionArg || match.apiVersion;
+  let tenant2 = opts.tenant;
+  if (!tenant2) {
+    const res = await admin({
+      path: `/projects/${projectId}/${version2}/tenants`,
+      method: "GET",
+      summary: "list project tenants"
+    });
+    const tenants = res?.tenants ?? [];
+    if (tenants.length === 0) {
+      throw new Error(`No tenants attached to ${match.projectName}@${version2} \u2014 nothing to read logs for.`);
+    } else if (tenants.length === 1) {
+      tenant2 = tenants[0].tenant_name;
+    } else if (opts.json || !process.stdin.isTTY) {
+      throw new Error(`Project has ${tenants.length} tenants \u2014 pass --tenant <slug>. Attached: ${tenants.map((t) => t.tenant_name).join(", ")}`);
+    } else {
+      const { default: inquirer3 } = await import("inquirer");
+      const ans = await inquirer3.prompt([{
+        type: "list",
+        name: "tenant",
+        message: "Which tenant?",
+        choices: tenants.map((t) => ({
+          name: t.display_name ? `${t.display_name} (${t.tenant_name})` : t.tenant_name,
+          value: t.tenant_name
+        }))
+      }]);
+      tenant2 = ans.tenant;
+    }
+  }
+  return { projectId, projectName: match.projectName, version: version2, tenant: tenant2 };
+}
+function otherPlaneHint() {
+  if (loadConsumer()) console.log(import_chalk26.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
+}
+function fetchWindow(projectId, version2, tenant2) {
+  return (params) => {
+    const q = new URLSearchParams({ tenant: tenant2, limit: String(params.limit) });
+    if (params.since !== void 0) q.set("since", String(params.since));
+    if (params.until !== void 0) q.set("until", String(params.until));
+    if (params.errorsOnly) q.set("errors_only", "true");
+    if (params.cursor) q.set("cursor", params.cursor);
+    return admin({
+      path: `/projects/${projectId}/${version2}/logs/window?${q.toString()}`,
+      method: "GET",
+      summary: "read log window"
+    });
+  };
+}
+async function runLogsTail(projectArg, versionArg, opts) {
+  const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
+  if (!opts.json) {
+    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    otherPlaneHint();
+  }
+  await runTailSession({
+    mintTicket: async () => {
+      const res = await admin({
+        path: `/projects/${projectId}/${version2}/logs/tail-ticket?tenant=${encodeURIComponent(tenant2)}`,
+        method: "POST",
+        summary: "mint log tail ticket"
+      });
+      if (!res?.ws_url) throw new Error("No ws_url returned by tail-ticket");
+      return res.ws_url;
+    },
+    errorsOnly: opts.errorsOnly,
+    json: opts.json,
+    detail: "producer"
+  });
+}
+async function runLogsList(projectArg, versionArg, opts) {
+  const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
+  if (!opts.json) {
+    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    otherPlaneHint();
+    console.log("");
+  }
+  await runHistoryBrowser({
+    fetchWindow: fetchWindow(projectId, version2, tenant2),
+    errorsOnly: opts.errorsOnly,
+    json: opts.json,
+    plain: opts.plain,
+    detail: "producer"
+  });
+}
+
+// src/commands/consumer-logs.ts
+var import_chalk27 = __toESM(require("chalk"));
+init_auth();
+var CONSUMER_LOGS_BASE = process.env.APIBLAZE_CONSUMER_LOGS_BASE || "https://logs.apiblaze.com/consumer";
+function requireConsumer() {
+  const c = loadConsumer();
+  if (!c) {
+    console.error(import_chalk27.default.red("Not logged in as an API Consumer. Run `apiblaze consumer login` first."));
+    if (loadCredentials()) {
+      console.error(import_chalk27.default.dim("You're signed in as an API Producer \u2014 for a proxy's full logs run `apiblaze logs <project>`."));
+    }
+    process.exit(1);
+  }
+  return { creds: c };
+}
+async function consumerLogsFetch(session, suffix, init) {
+  const fresh = await validConsumerToken(session.creds) ?? session.creds;
+  session.creds = fresh;
+  const res = await fetch(`${CONSUMER_LOGS_BASE}${suffix}`, {
+    ...init,
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${fresh.accessToken}`, ...init?.headers ?? {} }
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  if (res.status === 404 || res.status === 405 || res.status === 501) {
+    throw new Error("Consumer log access is not available on this tenant yet.");
+  }
+  if (res.status === 401) {
+    throw new Error("Your consumer session was rejected \u2014 run `apiblaze consumer login` again.");
+  }
+  if (!res.ok) {
+    const msg = data?.error ?? res.statusText;
+    throw new Error(typeof msg === "string" ? msg : JSON.stringify(msg));
+  }
+  return data;
+}
+function otherPlaneHint2() {
+  if (loadCredentials()) console.log(import_chalk27.default.dim("  \u2039producer view: apiblaze logs <project>\u203A"));
+}
+function fetchWindow2(session, project) {
+  return (params) => {
+    const q = new URLSearchParams({ limit: String(params.limit) });
+    if (project) q.set("project", project);
+    if (params.since !== void 0) q.set("since", String(params.since));
+    if (params.until !== void 0) q.set("until", String(params.until));
+    if (params.errorsOnly) q.set("errors_only", "true");
+    if (params.cursor) q.set("cursor", params.cursor);
+    return consumerLogsFetch(session, `/logs/window?${q.toString()}`);
+  };
+}
+async function runConsumerLogsTail(opts) {
+  const session = requireConsumer();
+  if (!opts.json) {
+    console.log(import_chalk27.default.bold("API Consumer logs") + import_chalk27.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk27.default.dim("cost and upstream details are producer-only and are not sent"));
+    otherPlaneHint2();
+  }
+  await runTailSession({
+    mintTicket: async () => {
+      const q = opts.project ? `?project=${encodeURIComponent(opts.project)}` : "";
+      const res = await consumerLogsFetch(session, `/logs/tail-ticket${q}`, { method: "POST" });
+      if (!res?.ws_url) throw new Error("No ws_url returned by tail-ticket");
+      return res.ws_url;
+    },
+    errorsOnly: opts.errorsOnly,
+    json: opts.json,
+    detail: "consumer"
+  });
+}
+async function runConsumerLogsList(opts) {
+  const session = requireConsumer();
+  if (!opts.json) {
+    console.log(import_chalk27.default.bold("API Consumer logs") + import_chalk27.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk27.default.dim("cost and upstream details are producer-only and are not sent"));
+    otherPlaneHint2();
+    console.log("");
+  }
+  await runHistoryBrowser({
+    fetchWindow: fetchWindow2(session, opts.project),
+    errorsOnly: opts.errorsOnly,
+    json: opts.json,
+    plain: opts.plain,
+    detail: "consumer"
+  });
+}
+
+// src/commands/config.ts
+var import_chalk28 = __toESM(require("chalk"));
 var import_ora8 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -3329,7 +4184,7 @@ async function patchConfig(project, opts, body, summary) {
 }
 async function runTargetSet(project, opts) {
   if (!opts.url) {
-    console.error(import_chalk25.default.red("--url is required."));
+    console.error(import_chalk28.default.red("--url is required."));
     process.exit(1);
   }
   const body = opts.env ? { environments: { [opts.env]: { target: opts.url } } } : { target_url: opts.url };
@@ -3342,40 +4197,40 @@ async function runThrottleSet(project, opts) {
   if (opts.quota !== void 0) throttling.proxyQuota = Number(opts.quota);
   if (opts.period !== void 0) {
     if (!["daily", "weekly", "monthly"].includes(opts.period)) {
-      console.error(import_chalk25.default.red("--period must be daily, weekly, or monthly."));
+      console.error(import_chalk28.default.red("--period must be daily, weekly, or monthly."));
       process.exit(1);
     }
     throttling.quotaPeriod = opts.period;
   }
   if (Object.keys(throttling).length === 0) {
-    console.error(import_chalk25.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
+    console.error(import_chalk28.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
     process.exit(1);
   }
   await patchConfig(project, opts, { throttling }, `Update throttling ${JSON.stringify(throttling)}`);
 }
 async function runRename(project, opts) {
   if (!opts.displayName) {
-    console.error(import_chalk25.default.red("--display-name is required."));
+    console.error(import_chalk28.default.red("--display-name is required."));
     process.exit(1);
   }
   await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
 }
 
 // src/commands/config-browse.ts
-var import_chalk34 = __toESM(require("chalk"));
+var import_chalk37 = __toESM(require("chalk"));
 var import_ora16 = __toESM(require("ora"));
 init_admin();
 init_auth();
 init_resolve();
 
 // src/commands/domain.ts
-var import_chalk26 = __toESM(require("chalk"));
+var import_chalk29 = __toESM(require("chalk"));
 var import_ora9 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
-    console.error(import_chalk26.default.red("--domain is required."));
+    console.error(import_chalk29.default.red("--domain is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3394,9 +4249,9 @@ async function runDomainAdd(project, opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    if (out?.cnameRecord) console.log(`  ${import_chalk26.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
-    if (out?.dcv) console.log(`  ${import_chalk26.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
-    if (out?.id) console.log(import_chalk26.default.dim(`  domain id: ${out.id}`));
+    if (out?.cnameRecord) console.log(`  ${import_chalk29.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
+    if (out?.dcv) console.log(`  ${import_chalk29.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (out?.id) console.log(import_chalk29.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
     spinner.fail("Domain registration failed.");
     throw err;
@@ -3416,14 +4271,14 @@ async function runDomainList(project, opts) {
     return;
   }
   if (!domains.length) {
-    console.log(import_chalk26.default.yellow("No custom domains."));
+    console.log(import_chalk29.default.yellow("No custom domains."));
     return;
   }
-  for (const d of domains) console.log(`  ${import_chalk26.default.bold(d.hostname)}  ${import_chalk26.default.dim(d.status ?? "")}  ${import_chalk26.default.dim(d.id ?? "")}`);
+  for (const d of domains) console.log(`  ${import_chalk29.default.bold(d.hostname)}  ${import_chalk29.default.dim(d.status ?? "")}  ${import_chalk29.default.dim(d.id ?? "")}`);
 }
 async function runDomainStatus(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk26.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk29.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3433,11 +4288,11 @@ async function runDomainStatus(project, opts) {
     path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
-  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk26.default.bold(out?.hostname ?? opts.id)}: ${import_chalk26.default.cyan(out?.status ?? "unknown")}`);
+  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk29.default.bold(out?.hostname ?? opts.id)}: ${import_chalk29.default.cyan(out?.status ?? "unknown")}`);
 }
 async function runDomainRemove(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk26.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk29.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3475,7 +4330,7 @@ async function runDomainSetBase(project, opts) {
 }
 
 // src/commands/tenant.ts
-var import_chalk29 = __toESM(require("chalk"));
+var import_chalk32 = __toESM(require("chalk"));
 var import_ora12 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -3484,20 +4339,20 @@ init_tenant_pick();
 async function runTenantUse(query, opts) {
   const creds = loadCredentials();
   if (!creds) {
-    console.error(import_chalk29.default.red("Not logged in. Run `apiblaze login` first."));
+    console.error(import_chalk32.default.red("Not logged in. Run `apiblaze login` first."));
     process.exit(1);
   }
   if (opts.clear) {
     delete creds.activeTenant;
     saveCredentials(creds);
-    console.log(import_chalk29.default.green("Tenant scope cleared."));
+    console.log(import_chalk32.default.green("Tenant scope cleared."));
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
   const slug = await pickTenant(teamId, { message: "Scope future commands to which tenant?", initialQuery: query });
   if (!slug) process.exit(1);
   saveCredentials({ ...creds, activeTenant: slug });
-  console.log(import_chalk29.default.green(`Tenant scope set to ${import_chalk29.default.bold(slug)}.`) + import_chalk29.default.dim("  (clear with `apiblaze tenant use --clear`)"));
+  console.log(import_chalk32.default.green(`Tenant scope set to ${import_chalk32.default.bold(slug)}.`) + import_chalk32.default.dim("  (clear with `apiblaze tenant use --clear`)"));
 }
 async function runTenantList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -3514,22 +4369,22 @@ async function runTenantList(opts) {
     return;
   }
   if (!tenants.length) {
-    console.log(import_chalk29.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
+    console.log(import_chalk32.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
     return;
   }
   for (const t of tenants) {
     const name = typeof t === "string" ? t : t.tenant_name;
-    const display = typeof t === "string" ? "" : import_chalk29.default.dim(`  ${t.display_name ?? ""}`);
-    console.log(`  ${import_chalk29.default.bold(name)}${display}`);
+    const display = typeof t === "string" ? "" : import_chalk32.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk32.default.bold(name)}${display}`);
   }
   const total = out?.total ?? tenants.length;
   if (total > tenants.length) {
-    console.log(import_chalk29.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
+    console.log(import_chalk32.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
   }
 }
 async function runTenantCreate(opts) {
   if (!opts.name) {
-    console.error(import_chalk29.default.red("--name (display name) is required."));
+    console.error(import_chalk32.default.red("--name (display name) is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3541,7 +4396,7 @@ async function runTenantCreate(opts) {
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
       summary: `Create tenant "${opts.name}"`
     });
-    spinner.succeed(`Created tenant ${import_chalk29.default.bold(out?.tenant_name ?? opts.name)}.`);
+    spinner.succeed(`Created tenant ${import_chalk32.default.bold(out?.tenant_name ?? opts.name)}.`);
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Tenant create failed.");
@@ -3550,7 +4405,7 @@ async function runTenantCreate(opts) {
 }
 async function runTenantAttach(project, opts) {
   if (!opts.tenant) {
-    console.error(import_chalk29.default.red("--tenant <slug> is required."));
+    console.error(import_chalk32.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3578,7 +4433,7 @@ async function runTenantDelete(slug, opts) {
       { type: "confirm", name: "confirm", message: `Permanently delete tenant "${slug}" and everything under it? This cannot be undone.`, default: false }
     ]);
     if (!confirm) {
-      console.log(import_chalk29.default.dim("Aborted."));
+      console.log(import_chalk32.default.dim("Aborted."));
       return;
     }
   }
@@ -3597,7 +4452,7 @@ async function runTenantDelete(slug, opts) {
 }
 async function runTenantCors(opts) {
   if (!opts.tenant) {
-    console.error(import_chalk29.default.red("--tenant <slug> is required."));
+    console.error(import_chalk32.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -3619,7 +4474,7 @@ async function runTenantCors(opts) {
 }
 
 // src/commands/tenant-drill.ts
-var import_chalk30 = __toESM(require("chalk"));
+var import_chalk33 = __toESM(require("chalk"));
 var import_ora13 = __toESM(require("ora"));
 var import_crypto = require("crypto");
 init_admin();
@@ -3650,15 +4505,15 @@ async function validScopedTenant(teamId, query) {
   const next = { ...creds };
   delete next.activeTenant;
   saveCredentials2(next);
-  console.log(import_chalk30.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
+  console.log(import_chalk33.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
   return void 0;
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer3 } = await import("inquirer");
   const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
-  console.log(import_chalk30.default.bold(`
+  console.log(import_chalk33.default.bold(`
 Tenant ${tenant2}`));
-  console.log(import_chalk30.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
+  console.log(import_chalk33.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
     const spinner = (0, import_ora13.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
@@ -3674,18 +4529,18 @@ Tenant ${tenant2}`));
     const nClients = Array.isArray(clients) ? clients.length : 0;
     const nOpaque = opaque?.opaque?.endpoint ? 1 : 0;
     const nLogin = nClients + nIssuers + nOpaque;
-    const onOff = (b) => b ? import_chalk30.default.green("on") : import_chalk30.default.dim("off");
+    const onOff = (b) => b ? import_chalk33.default.green("on") : import_chalk33.default.dim("off");
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
       message: `Tenant ${tenant2}:`,
       pageSize: 12,
       choices: [
-        { name: `Login methods (${nLogin})  ${import_chalk30.default.dim("how your consumers sign in")}`, value: "login" },
-        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk30.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
-        { name: `Portal admins (${nEmails})  ${import_chalk30.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
-        new inquirer3.Separator(import_chalk30.default.dim("  Settings")),
-        { name: `CORS: ${cors?.cors ? import_chalk30.default.cyan(JSON.stringify(cors.cors)) : import_chalk30.default.dim("(unset)")}  ${import_chalk30.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
+        { name: `Login methods (${nLogin})  ${import_chalk33.default.dim("how your consumers sign in")}`, value: "login" },
+        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk33.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
+        { name: `Portal admins (${nEmails})  ${import_chalk33.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
+        new inquirer3.Separator(import_chalk33.default.dim("  Settings")),
+        { name: `CORS: ${cors?.cors ? import_chalk33.default.cyan(JSON.stringify(cors.cors)) : import_chalk33.default.dim("(unset)")}  ${import_chalk33.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -3698,7 +4553,7 @@ Tenant ${tenant2}`));
       case "iam": {
         const { v } = await inquirer3.prompt([{ type: "confirm", name: "v", message: "Enable Users & groups?", default: !!iam?.iam_enabled }]);
         await admin({ method: "PATCH", path: `${base2}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
-        console.log(import_chalk30.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
+        console.log(import_chalk33.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
         break;
       }
       case "cors": {
@@ -3711,11 +4566,11 @@ Tenant ${tenant2}`));
         if (v === "") break;
         const parsed = v === "null" ? null : safeJson(v);
         if (parsed === void 0) {
-          console.log(import_chalk30.default.yellow("  Not valid JSON \u2014 unchanged."));
+          console.log(import_chalk33.default.yellow("  Not valid JSON \u2014 unchanged."));
           break;
         }
         await admin({ method: "PUT", path: `${base2}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
-        console.log(import_chalk30.default.green("  CORS updated."));
+        console.log(import_chalk33.default.green("  CORS updated."));
         break;
       }
       case "emails":
@@ -3739,15 +4594,15 @@ async function loginMethodsMenu(teamId, tenant2, base2) {
     const choices = [];
     for (const c of appClients) {
       const nP = (c.providers ?? []).length || c.providers_count || 0;
-      choices.push({ name: `${import_chalk30.default.cyan("APIblaze-hosted")}  ${import_chalk30.default.bold(c.name ?? c.clientId)}  ${import_chalk30.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk30.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
+      choices.push({ name: `${import_chalk33.default.cyan("APIblaze-hosted")}  ${import_chalk33.default.bold(c.name ?? c.clientId)}  ${import_chalk33.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk33.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
     }
     for (const i of issuers) {
-      choices.push({ name: `${import_chalk30.default.cyan("Your own \u2014 JWT ")}  ${import_chalk30.default.bold(i.iss)}  ${import_chalk30.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
+      choices.push({ name: `${import_chalk33.default.cyan("Your own \u2014 JWT ")}  ${import_chalk33.default.bold(i.iss)}  ${import_chalk33.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
     }
     if (opaque?.endpoint) {
-      choices.push({ name: `${import_chalk30.default.cyan("Your own \u2014 opaque")}  ${import_chalk30.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
+      choices.push({ name: `${import_chalk33.default.cyan("Your own \u2014 opaque")}  ${import_chalk33.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
     }
-    if (!choices.length) console.log(import_chalk30.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
+    if (!choices.length) console.log(import_chalk33.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
@@ -3787,9 +4642,9 @@ async function addLoginMethod(teamId, tenant2, base2) {
     message: "How do people log in?",
     pageSize: 8,
     choices: [
-      { name: `APIblaze hosted login page  ${import_chalk30.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
-      { name: `Your own hosted login \u2014 JWT  ${import_chalk30.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
-      { name: `Your own login \u2014 opaque token  ${import_chalk30.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
+      { name: `APIblaze hosted login page  ${import_chalk33.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
+      { name: `Your own hosted login \u2014 JWT  ${import_chalk33.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
+      { name: `Your own login \u2014 opaque token  ${import_chalk33.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
       { name: "\u2190 Back", value: null }
     ]
   }]);
@@ -3813,8 +4668,8 @@ function safeJson(s) {
 async function emailsMenu(base2, emails) {
   const { default: inquirer3 } = await import("inquirer");
   console.log();
-  if (!emails.length) console.log(import_chalk30.default.dim("  No consumer-admin emails."));
-  for (const e of emails) console.log(`  ${import_chalk30.default.bold(e.email ?? e)}  ${import_chalk30.default.dim(e.status ?? "")}`);
+  if (!emails.length) console.log(import_chalk33.default.dim("  No consumer-admin emails."));
+  for (const e of emails) console.log(`  ${import_chalk33.default.bold(e.email ?? e)}  ${import_chalk33.default.dim(e.status ?? "")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
@@ -3829,7 +4684,7 @@ async function emailsMenu(base2, emails) {
   if (act === "add") {
     const { email } = await inquirer3.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
     await admin({ method: "POST", path: `${base2}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
-    console.log(import_chalk30.default.green(`  ${email} added.`));
+    console.log(import_chalk33.default.green(`  ${email} added.`));
   } else {
     const { e } = await inquirer3.prompt([{
       type: "list",
@@ -3839,7 +4694,7 @@ async function emailsMenu(base2, emails) {
     }]);
     if (!e) return;
     await admin({ method: "DELETE", path: `${base2}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
-    console.log(import_chalk30.default.green(`  ${e} removed.`));
+    console.log(import_chalk33.default.green(`  ${e} removed.`));
   }
 }
 async function addIssuer(base2) {
@@ -3860,19 +4715,19 @@ async function addIssuer(base2) {
     body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
     summary: `Add external issuer ${a.iss.trim()}`
   });
-  console.log(import_chalk30.default.green("  JWT login method saved."));
+  console.log(import_chalk33.default.green("  JWT login method saved."));
 }
 async function issuerHome(base2, issuer) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk30.default.bold(issuer.iss)}  ${import_chalk30.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
+  ${import_chalk33.default.bold(issuer.iss)}  ${import_chalk33.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This JWT login method:",
     choices: [
       { name: "Replace it (re-enter details)", value: "edit" },
-      { name: import_chalk30.default.red("Delete it"), value: "rm" },
+      { name: import_chalk33.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -3888,7 +4743,7 @@ async function issuerHome(base2, issuer) {
     path: `${base2}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
     summary: `Delete issuer ${issuer.iss}`
   });
-  console.log(import_chalk30.default.green("  Deleted."));
+  console.log(import_chalk33.default.green("  Deleted."));
 }
 async function setOpaque(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
@@ -3897,19 +4752,19 @@ async function setOpaque(base2, cur) {
     { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
   ]);
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
-  console.log(import_chalk30.default.green("  Opaque login method set."));
+  console.log(import_chalk33.default.green("  Opaque login method set."));
 }
 async function opaqueHome(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk30.default.bold(cur.endpoint)}  ${import_chalk30.default.dim(cur.method ?? "GET")}`);
+  ${import_chalk33.default.bold(cur.endpoint)}  ${import_chalk33.default.dim(cur.method ?? "GET")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This opaque login method:",
     choices: [
       { name: "Replace it", value: "edit" },
-      { name: import_chalk30.default.red("Delete it"), value: "rm" },
+      { name: import_chalk33.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -3919,7 +4774,7 @@ async function opaqueHome(base2, cur) {
     return;
   }
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
-  console.log(import_chalk30.default.green("  Deleted."));
+  console.log(import_chalk33.default.green("  Deleted."));
 }
 async function clientHome(base2, summary) {
   const { default: inquirer3 } = await import("inquirer");
@@ -3938,13 +4793,13 @@ async function clientHome(base2, summary) {
       message: `${c.name ?? id}:`,
       pageSize: 12,
       choices: [
-        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk30.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
-        { name: `Callback URLs: ${cb.length ? import_chalk30.default.cyan(cb.join(", ")) : import_chalk30.default.dim("(none)")}`, value: "callbacks" },
-        { name: `Scopes: ${scopes.length ? import_chalk30.default.cyan(scopes.join(" ")) : import_chalk30.default.dim("(defaults)")}`, value: "scopes" },
+        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk33.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
+        { name: `Callback URLs: ${cb.length ? import_chalk33.default.cyan(cb.join(", ")) : import_chalk33.default.dim("(none)")}`, value: "callbacks" },
+        { name: `Scopes: ${scopes.length ? import_chalk33.default.cyan(scopes.join(" ")) : import_chalk33.default.dim("(defaults)")}`, value: "scopes" },
         { name: `Token expiries: access ${c.accessTokenExpiry ?? 3600}s \xB7 id ${c.idTokenExpiry ?? 3600}s \xB7 refresh ${c.refreshTokenExpiry ?? 2592e3}s`, value: "expiries" },
         { name: "Reveal client secret", value: "secret" },
         { name: "Rotate client secret", value: "rotate" },
-        { name: import_chalk30.default.red("Delete this app client"), value: "delete" },
+        { name: import_chalk33.default.red("Delete this app client"), value: "delete" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -3957,13 +4812,13 @@ async function clientHome(base2, summary) {
       case "callbacks": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Callback URLs (comma-separated):", default: cb.join(", ") }]);
         await admin({ method: "PATCH", path: cBase, body: { authorizedCallbackUrls: parseList(v) }, summary: "Update callback URLs" });
-        console.log(import_chalk30.default.green("  Callbacks updated."));
+        console.log(import_chalk33.default.green("  Callbacks updated."));
         break;
       }
       case "scopes": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Scopes (space/comma-separated):", default: scopes.join(" ") }]);
         await admin({ method: "PATCH", path: cBase, body: { scopes: v.split(/[\s,]+/).filter(Boolean) }, summary: "Update scopes" });
-        console.log(import_chalk30.default.green("  Scopes updated."));
+        console.log(import_chalk33.default.green("  Scopes updated."));
         break;
       }
       case "expiries": {
@@ -3978,14 +4833,14 @@ async function clientHome(base2, summary) {
           body: { accessTokenExpiry: Number(a.access), idTokenExpiry: Number(a.id), refreshTokenExpiry: Number(a.refresh) },
           summary: "Update token expiries"
         });
-        console.log(import_chalk30.default.green("  Expiries updated."));
+        console.log(import_chalk33.default.green("  Expiries updated."));
         break;
       }
       case "secret": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: "Print the client secret to this terminal?", default: false }]);
         if (!sure) break;
         const s = await admin({ method: "GET", path: `${cBase}/secret`, summary: "Reveal client secret" });
-        console.log(`  ${import_chalk30.default.bold("client_secret")}: ${import_chalk30.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
         break;
       }
       case "rotate": {
@@ -3993,14 +4848,14 @@ async function clientHome(base2, summary) {
         if (!sure) break;
         const fresh = randomSecret();
         await admin({ method: "PATCH", path: cBase, body: { clientSecret: fresh }, summary: "Rotate client secret" });
-        console.log(`  New ${import_chalk30.default.bold("client_secret")}: ${import_chalk30.default.green(fresh)}  ${import_chalk30.default.dim("(store it now)")}`);
+        console.log(`  New ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(fresh)}  ${import_chalk33.default.dim("(store it now)")}`);
         break;
       }
       case "delete": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Delete app client "${c.name ?? id}"? Consumers logged in through it will lose access.`, default: false }]);
         if (!sure) break;
         await admin({ method: "DELETE", path: cBase, summary: `Delete app client ${id}` });
-        console.log(import_chalk30.default.green("  App client deleted."));
+        console.log(import_chalk33.default.green("  App client deleted."));
         return;
       }
     }
@@ -4027,9 +4882,9 @@ async function providersMenu(cBase, clientLabel) {
     const providers = Array.isArray(raw) ? raw : [];
     console.log();
     for (const p of providers) {
-      console.log(`  ${import_chalk30.default.bold(p.type)}  ${import_chalk30.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
+      console.log(`  ${import_chalk33.default.bold(p.type)}  ${import_chalk33.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
     }
-    if (!providers.length) console.log(import_chalk30.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
+    if (!providers.length) console.log(import_chalk33.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
@@ -4087,23 +4942,23 @@ async function providersMenu(cBase, clientLabel) {
         body.targetServerToken = routing;
       }
       await admin({ method: "POST", path: `${cBase}/providers`, body, summary: `Add ${type} login provider` });
-      console.log(import_chalk30.default.green(`  ${type} provider added.`));
+      console.log(import_chalk33.default.green(`  ${type} provider added.`));
     } else {
       const { p } = await inquirer3.prompt([{
         type: "list",
         name: "p",
         message: act === "rm" ? "Remove which provider?" : "Reveal which secret?",
-        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk30.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
+        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk33.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
       }]);
       if (!p) continue;
       if (act === "rm") {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Remove the ${p.type} provider? Consumers using it can no longer sign in.`, default: false }]);
         if (!sure) continue;
         await admin({ method: "DELETE", path: `${cBase}/providers/${encodeURIComponent(p.id)}`, summary: `Remove ${p.type} provider` });
-        console.log(import_chalk30.default.green(`  ${p.type} removed.`));
+        console.log(import_chalk33.default.green(`  ${p.type} removed.`));
       } else {
         const s = await admin({ method: "GET", path: `${cBase}/providers/${encodeURIComponent(p.id)}/secret`, summary: `Reveal ${p.type} provider secret` });
-        console.log(`  ${import_chalk30.default.bold("client_secret")}: ${import_chalk30.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
       }
     }
   }
@@ -4111,7 +4966,7 @@ async function providersMenu(cBase, clientLabel) {
 
 // src/commands/spec.ts
 var fs7 = __toESM(require("fs"));
-var import_chalk31 = __toESM(require("chalk"));
+var import_chalk34 = __toESM(require("chalk"));
 var import_ora14 = __toESM(require("ora"));
 init_admin();
 init_api();
@@ -4128,14 +4983,14 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk31.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk34.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs7.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk31.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk34.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -4164,23 +5019,23 @@ async function runSpecSet(project, opts) {
 function printSpecChangeReport(report, projectName) {
   const r = report.routes;
   if (r) {
-    for (const a of r.added) console.log(import_chalk31.default.green(`  + ${a}`));
-    for (const d of r.removed) console.log(import_chalk31.default.red(`  \u2212 ${d}`));
-    for (const rn of r.renamed ?? []) console.log(import_chalk31.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
-    for (const m of r.modified ?? []) console.log(import_chalk31.default.dim(`  \xB1 ${m} (params/schema changed)`));
+    for (const a of r.added) console.log(import_chalk34.default.green(`  + ${a}`));
+    for (const d of r.removed) console.log(import_chalk34.default.red(`  \u2212 ${d}`));
+    for (const rn of r.renamed ?? []) console.log(import_chalk34.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
+    for (const m of r.modified ?? []) console.log(import_chalk34.default.dim(`  \xB1 ${m} (params/schema changed)`));
   }
-  if (report.applied?.mcp_regenerated) console.log(import_chalk31.default.dim("  MCP catalogue regenerated."));
-  if (report.applied?.candidates_cleared) console.log(import_chalk31.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
+  if (report.applied?.mcp_regenerated) console.log(import_chalk34.default.dim("  MCP catalogue regenerated."));
+  if (report.applied?.candidates_cleared) console.log(import_chalk34.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
   for (const item of report.attention ?? []) {
-    console.log(import_chalk31.default.yellow(`  \u26A0 ${item.detail}`));
+    console.log(import_chalk34.default.yellow(`  \u26A0 ${item.detail}`));
     if (item.suggestion?.carry_from && item.suggestion.carry_to) {
-      console.log(import_chalk31.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
+      console.log(import_chalk34.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
     }
   }
 }
 async function runSpecCarry(project, opts) {
   if (!opts.method || !opts.from || !opts.to) {
-    console.error(import_chalk31.default.red("--method, --from and --to are required."));
+    console.error(import_chalk34.default.red("--method, --from and --to are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -4202,7 +5057,7 @@ async function runSpecCarry(project, opts) {
 }
 async function runSpecDeleteRule(project, opts) {
   if (!opts.method || !opts.route) {
-    console.error(import_chalk31.default.red("--method and --route are required."));
+    console.error(import_chalk34.default.red("--method and --route are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -4222,14 +5077,14 @@ async function runSpecDeleteRule(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk33 = __toESM(require("chalk"));
+var import_chalk36 = __toESM(require("chalk"));
 var import_ora15 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
 
 // src/lib/tools.ts
-var import_chalk32 = __toESM(require("chalk"));
+var import_chalk35 = __toESM(require("chalk"));
 init_admin();
 init_api();
 init_resolve();
@@ -4249,15 +5104,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      const lines = [`  ${import_chalk32.default.dim("Proxy URL:")}  ${import_chalk32.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk32.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk35.default.dim("Proxy URL:")}  ${import_chalk35.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk35.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk32.default.bold("API keys")} ${import_chalk32.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk35.default.bold("API keys")} ${import_chalk35.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk32.default.cyan(env.padEnd(w))}  ${import_chalk32.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk35.default.cyan(env.padEnd(w))}  ${import_chalk35.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk32.default.dim("Try it:")}`, `    ${import_chalk32.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk35.default.dim("Try it:")}`, `    ${import_chalk35.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -4413,17 +5268,17 @@ function truncate(value, max = 1500) {
 }
 function printCost(resp) {
   const line = formatBilling(resp.billing);
-  if (line) console.log(import_chalk33.default.magenta(`  ${line}`) + import_chalk33.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
+  if (line) console.log(import_chalk36.default.magenta(`  ${line}`) + import_chalk36.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk33.default.bold("APIblaze agent") + import_chalk33.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk33.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk36.default.bold("APIblaze agent") + import_chalk36.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk36.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk33.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk36.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
@@ -4437,14 +5292,14 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk33.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk36.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp);
-      if (resp.reply) console.log(import_chalk33.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk36.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
@@ -4469,11 +5324,11 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk33.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk36.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk33.default.dim("\nBye."));
+  console.log(import_chalk36.default.dim("\nBye."));
 }
 
 // src/commands/config-browse.ts
@@ -4615,6 +5470,53 @@ var SETTINGS = [
     desc: "Team-scoped tag grouping projects in the consumer portal",
     toPatch: (v) => ({ product_slug: v })
   },
+  // Who funds AI chat here (specs/chat_funding.MD). A partial PATCH merges, so
+  // setting one key never resurrects a switch the producer turned off.
+  {
+    key: "chat_sponsorship.enabled",
+    label: "Pay for your users' AI chats",
+    group: "Portal & MCP",
+    type: "boolean",
+    desc: "Every chat message costs money and your users can't pay for it here yet, so you cover it \u2014 for people who sign in, and for API keys you gave the use-premium permission. Off = everyone brings their own AI key, your own tools included",
+    read: (cfg) => cfg.chat_sponsorship?.enabled !== false,
+    toPatch: (v) => ({ chat_sponsorship: { enabled: v } })
+  },
+  {
+    key: "chat_sponsorship.quota_enabled",
+    label: "Limit AI chat per person per day",
+    group: "Portal & MCP",
+    type: "boolean",
+    desc: "Give each person their own daily allowance, reset at midnight UTC. Off = your wallet running out is the only thing that stops it",
+    read: (cfg) => cfg.chat_sponsorship?.quota_enabled !== false,
+    toPatch: (v) => ({ chat_sponsorship: { quota_enabled: v } })
+  },
+  {
+    key: "chat_sponsorship.cap_cents_per_day",
+    label: "AI chat: cents per person per day",
+    group: "Portal & MCP",
+    type: "number",
+    desc: "Most you'll spend on one person per day, in cents you're actually charged (not raw model price). 25 is roughly 25 short chats. Max 5000; 0 blocks everyone",
+    read: (cfg) => cfg.chat_sponsorship?.cap_cents_per_day ?? 25,
+    toPatch: (v) => ({ chat_sponsorship: { cap_cents_per_day: v } })
+  },
+  {
+    key: "chat_sponsorship.max_chats_per_day",
+    label: "AI chat: chats per person per day",
+    group: "Portal & MCP",
+    type: "number",
+    desc: "Chats one person can have per day \u2014 counted even when a chat is cheap, so nobody runs thousands of tiny ones. Max 1000; 0 blocks everyone",
+    read: (cfg) => cfg.chat_sponsorship?.max_chats_per_day ?? 25,
+    toPatch: (v) => ({ chat_sponsorship: { max_chats_per_day: v } })
+  },
+  {
+    key: "chat_sponsorship.max_chars_per_message",
+    label: "AI chat: longest single message",
+    group: "Portal & MCP",
+    type: "number",
+    desc: "2000 characters is about 300 words. Has its own limit because one very long message can cost more than a whole day of short ones. Max 64000",
+    read: (cfg) => cfg.chat_sponsorship?.max_chars_per_message ?? 2e3,
+    toPatch: (v) => ({ chat_sponsorship: { max_chars_per_message: v } })
+  },
   // ── Advanced (specs/missing.md): all optional, default-off; null clears ────
   {
     key: "ip_access.mode",
@@ -4712,11 +5614,11 @@ function dig(blob, dotted) {
 }
 var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
 function show(v) {
-  if (v === void 0) return import_chalk34.default.dim("(unset)");
-  if (v === null) return import_chalk34.default.dim("null");
-  if (typeof v === "object") return import_chalk34.default.cyan(JSON.stringify(v));
-  if (typeof v === "boolean") return v ? import_chalk34.default.green("on") : import_chalk34.default.red("off");
-  return import_chalk34.default.cyan(String(v));
+  if (v === void 0) return import_chalk37.default.dim("(unset)");
+  if (v === null) return import_chalk37.default.dim("null");
+  if (typeof v === "object") return import_chalk37.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk37.default.green("on") : import_chalk37.default.red("off");
+  return import_chalk37.default.cyan(String(v));
 }
 function parseValue(raw) {
   if (raw === "true") return true;
@@ -4758,10 +5660,10 @@ async function patchSetting(proj2, s, value, cfg) {
   }
 }
 var loginFirst = (what) => {
-  console.log(import_chalk34.default.yellow(`
+  console.log(import_chalk37.default.yellow(`
   Log in first to ${what}.`));
-  console.log(import_chalk34.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
-  console.log(import_chalk34.default.dim("  anonymously and want to bring it into your account.\n"));
+  console.log(import_chalk37.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk37.default.dim("  anonymously and want to bring it into your account.\n"));
 };
 async function runConfig(project, key, value, opts) {
   const creds = loadCredentials();
@@ -4778,9 +5680,9 @@ async function runConfig(project, key, value, opts) {
   }
   const setting = SETTINGS.find((s) => s.key === key);
   if (!setting) {
-    console.error(import_chalk34.default.red(`Unknown setting "${key}".`));
-    console.error(import_chalk34.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
-    console.error(import_chalk34.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    console.error(import_chalk37.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk37.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk37.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
     process.exit(1);
   }
   if (value === void 0) {
@@ -4795,7 +5697,7 @@ async function pickProject(teamId) {
   const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const projects = await getProjects2(teamId).catch(() => []);
   if (!projects.length) {
-    console.error(import_chalk34.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    console.error(import_chalk37.default.red("No projects in this team. Create one: `npx apiblaze create`."));
     process.exit(1);
   }
   const { default: inquirer3 } = await import("inquirer");
@@ -4803,7 +5705,7 @@ async function pickProject(teamId) {
     type: "list",
     name: "picked",
     message: "Which project?",
-    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk34.default.dim("v" + p.apiVersion)}`, value: p }))
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk37.default.dim("v" + p.apiVersion)}`, value: p }))
   }]);
   return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
 }
@@ -4814,25 +5716,25 @@ function printAll(proj2, cfg, json) {
     console.log(JSON.stringify(out, null, 2));
     return;
   }
-  console.log(import_chalk34.default.bold(`
+  console.log(import_chalk37.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
   for (const group2 of SETTING_GROUPS) {
-    console.log(import_chalk34.default.bold(group2));
+    console.log(import_chalk37.default.bold(group2));
     for (const s of SETTINGS.filter((x) => x.group === group2)) {
-      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk34.default.dim(s.desc)}`);
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk37.default.dim(s.desc)}`);
     }
     console.log();
   }
-  console.log(import_chalk34.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+  console.log(import_chalk37.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
 }
 async function discoveryMenu(project) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk34.default.bold(`
+  console.log(import_chalk37.default.bold(`
 APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
 `));
-  console.log(import_chalk34.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
-  console.log(import_chalk34.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  console.log(import_chalk37.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk37.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
@@ -4840,13 +5742,13 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
       message: "Explore:",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk34.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({
-          name: `${g}  ${import_chalk34.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          name: `${g}  ${import_chalk37.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
           value: { kind: "settings", g }
         })),
-        new inquirer3.Separator(import_chalk34.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk34.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk37.default.dim(f.desc)}`, value: { kind: "feature", f } })),
         new inquirer3.Separator(),
         { name: "Exit", value: { kind: "exit" } }
       ]
@@ -4855,24 +5757,24 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
     if (pick2.kind === "settings") {
       console.log();
       for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
-        console.log(`  ${import_chalk34.default.bold(s.label.padEnd(28))} ${import_chalk34.default.dim(s.desc)}`);
-        console.log(`  ${import_chalk34.default.dim("  key: " + s.key)}`);
+        console.log(`  ${import_chalk37.default.bold(s.label.padEnd(28))} ${import_chalk37.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk37.default.dim("  key: " + s.key)}`);
       }
       loginFirst("view or change these settings");
     } else {
       const f = pick2.f;
       console.log(`
-  ${import_chalk34.default.bold(f.label)} \u2014 ${f.desc}`);
+  ${import_chalk37.default.bold(f.label)} \u2014 ${f.desc}`);
       loginFirst(`use ${f.label.toLowerCase()}`);
     }
   }
 }
 async function navigator(proj2, cfg, opts) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk34.default.bold(`
+  console.log(import_chalk37.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
 `));
-  console.log(import_chalk34.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  console.log(import_chalk37.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
   let blob = cfg;
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
@@ -4881,10 +5783,10 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
       message: "Where to?",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk34.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
-        new inquirer3.Separator(import_chalk34.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk34.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk37.default.dim(f.desc)}`, value: { kind: f.go } })),
         new inquirer3.Separator(),
         { name: "Show all settings", value: { kind: "list" } },
         { name: "Exit", value: { kind: "exit" } }
@@ -4924,7 +5826,7 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
         }
       }
     } catch (err) {
-      console.error(import_chalk34.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_chalk37.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
 }
@@ -4938,7 +5840,7 @@ async function settingsGroup(proj2, cfg, group2) {
       message: group2 + ":",
       pageSize: 16,
       choices: [
-        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk34.default.dim(s2.desc)}`, value: s2 })),
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk37.default.dim(s2.desc)}`, value: s2 })),
         new inquirer3.Separator(),
         { name: "\u2190 Back", value: null }
       ]
@@ -4956,7 +5858,7 @@ async function settingsGroup(proj2, cfg, group2) {
     } else if (s.type === "number") {
       const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
       if (v === "" || Number.isNaN(Number(v))) {
-        console.log(import_chalk34.default.yellow("  Not a number \u2014 unchanged."));
+        console.log(import_chalk37.default.yellow("  Not a number \u2014 unchanged."));
         continue;
       }
       value = Number(v);
@@ -5037,7 +5939,7 @@ async function buildCondition(phase) {
   const items = [];
   for (; ; ) {
     const a = await inquirer3.prompt([
-      { type: "input", name: "source", message: `Condition field ${import_chalk34.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
+      { type: "input", name: "source", message: `Condition field ${import_chalk37.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
       { type: "list", name: "operator", message: "Operator:", choices: [
         "eq",
         "neq",
@@ -5068,7 +5970,7 @@ async function buildCondition(phase) {
 function showCondition(cond) {
   if (!Array.isArray(cond) || !cond.length) return "";
   const s = cond.map((c) => `${c.source} ${c.operator}${c.value !== void 0 ? ` "${c.value}"` : ""}${c.logicOp ? ` ${c.logicOp}` : ""}`).join(" ");
-  return import_chalk34.default.dim(`  when ${s}`);
+  return import_chalk37.default.dim(`  when ${s}`);
 }
 async function transformsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
@@ -5077,12 +5979,12 @@ async function transformsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
-    if (!rules.length) console.log(import_chalk34.default.dim("  No transform rules yet."));
+    if (!rules.length) console.log(import_chalk37.default.dim("  No transform rules yet."));
     for (const r of rules) {
       const a = r.action ?? {};
       const fns = [...a.source_fns ?? [], ...a.dest_fns ?? []].map((f) => f.fn);
-      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk34.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
-      console.log(`  ${r.enabled ? import_chalk34.default.green("\u25CF") : import_chalk34.default.dim("\u25CB")} ${import_chalk34.default.bold(r.name)}  ${import_chalk34.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk37.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
+      console.log(`  ${r.enabled ? import_chalk37.default.green("\u25CF") : import_chalk37.default.dim("\u25CB")} ${import_chalk37.default.bold(r.name)}  ${import_chalk37.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -5094,7 +5996,7 @@ async function transformsMenu(proj2) {
           { name: "Enable/disable a rule", value: "toggle" },
           { name: "Delete a rule", value: "delete" }
         ] : [],
-        { name: import_chalk34.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
+        { name: import_chalk37.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -5107,11 +6009,11 @@ async function transformsMenu(proj2) {
       }]);
       const body = parseValue(raw);
       if (!body || typeof body !== "object" || Array.isArray(body)) {
-        console.log(import_chalk34.default.yellow("  Not a JSON object \u2014 skipped."));
+        console.log(import_chalk37.default.yellow("  Not a JSON object \u2014 skipped."));
         continue;
       }
       await admin({ method: "POST", path: base2, body, summary: "Create transform rule (raw JSON)" });
-      console.log(import_chalk34.default.green("  Rule created."));
+      console.log(import_chalk37.default.green("  Rule created."));
       continue;
     }
     if (act === "add") {
@@ -5127,7 +6029,7 @@ async function transformsMenu(proj2) {
           { name: "Remove a field", value: "remove" }
         ] }
       ]);
-      const fieldHint = import_chalk34.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      const fieldHint = import_chalk37.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
       let action2;
       if (ans.kind === "hardcode") {
         const a = await inquirer3.prompt([
@@ -5174,16 +6076,16 @@ async function transformsMenu(proj2) {
         type: "list",
         name: "rule",
         message: act === "toggle" ? "Which rule?" : "Delete which rule?",
-        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk34.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk37.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
       }]);
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
         await admin({ method: "PUT", path: `${base2}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
-        console.log(import_chalk34.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+        console.log(import_chalk37.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
         await admin({ method: "DELETE", path: `${base2}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
-        console.log(import_chalk34.default.green(`  ${rule.name} deleted.`));
+        console.log(import_chalk37.default.green(`  ${rule.name} deleted.`));
       }
     }
   }
@@ -5195,9 +6097,9 @@ async function mappingsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
-    if (!tables.length) console.log(import_chalk34.default.dim("  No mapping tables yet."));
+    if (!tables.length) console.log(import_chalk37.default.dim("  No mapping tables yet."));
     for (const t of tables) {
-      console.log(`  ${import_chalk34.default.bold(t.name)}  ${import_chalk34.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+      console.log(`  ${import_chalk37.default.bold(t.name)}  ${import_chalk37.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -5217,11 +6119,11 @@ async function mappingsMenu(proj2) {
       ]);
       const entries2 = parseValue(a.entries);
       if (!Array.isArray(entries2)) {
-        console.log(import_chalk34.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        console.log(import_chalk37.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
       await admin({ method: "POST", path: base2, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
-      console.log(import_chalk34.default.green(`  Table "${a.name}" created.`));
+      console.log(import_chalk37.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer3.prompt([{
         type: "list",
@@ -5231,7 +6133,7 @@ async function mappingsMenu(proj2) {
       }]);
       if (!table) continue;
       await admin({ method: "DELETE", path: `${base2}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
-      console.log(import_chalk34.default.green(`  ${table.name} deleted.`));
+      console.log(import_chalk37.default.green(`  ${table.name} deleted.`));
     }
   }
 }
@@ -5242,14 +6144,14 @@ async function tenantsMenu(proj2, opts) {
     const out = await admin({ method: "GET", path: base2, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
-    if (!tenants.length) console.log(import_chalk34.default.dim("  No tenants attached (consumers use the default tenant)."));
-    for (const t of tenants) console.log(`  ${import_chalk34.default.bold(t.tenant_name ?? t.name)}  ${import_chalk34.default.dim(t.display_name ?? "")}`);
+    if (!tenants.length) console.log(import_chalk37.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk37.default.bold(t.tenant_name ?? t.name)}  ${import_chalk37.default.dim(t.display_name ?? "")}`);
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
       message: "Tenants:",
       choices: [
-        { name: `Manage a tenant\u2026  ${import_chalk34.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
+        { name: `Manage a tenant\u2026  ${import_chalk37.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
         { name: "Attach a tenant to this project", value: "attach" },
         ...tenants.length ? [{ name: "Detach a tenant from this project", value: "detach" }] : [],
         { name: "\u2190 Back", value: "back" }
@@ -5272,7 +6174,7 @@ async function tenantsMenu(proj2, opts) {
       }]);
       if (!t) continue;
       await admin({ method: "DELETE", path: `${base2}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
-      console.log(import_chalk34.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+      console.log(import_chalk37.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
 }
@@ -5315,7 +6217,7 @@ async function specMenu(proj2, opts) {
     choices: [
       { name: "Print the stored spec", value: "get" },
       { name: "Refresh the spec from its source", value: "refresh" },
-      { name: import_chalk34.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: import_chalk37.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -5323,7 +6225,7 @@ async function specMenu(proj2, opts) {
   if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
   else if (act === "refresh") {
     await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
-    console.log(import_chalk34.default.green("  Spec refresh triggered."));
+    console.log(import_chalk37.default.green("  Spec refresh triggered."));
   } else await runOpenapi(proj2.projectName, proj2.apiVersion);
 }
 async function agentsMenu(proj2, opts) {
@@ -5348,7 +6250,7 @@ async function agentsMenu(proj2, opts) {
 }
 
 // src/commands/group.ts
-var import_chalk35 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 var import_ora17 = __toESM(require("ora"));
 init_auth();
 init_admin();
@@ -5442,7 +6344,7 @@ async function userByRefOrCreate(t, ref) {
     if (!ref.includes("@")) throw e;
     const created = await t.call("/v1/admin/users", "POST", { email: ref.trim().toLowerCase() });
     if (!created?.abz_sub) throw e;
-    console.log(import_chalk35.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
+    console.log(import_chalk38.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
     return { abz_sub: created.abz_sub, email: created.email ?? ref, display_name: null };
   }
 }
@@ -5450,11 +6352,11 @@ async function runGroupList(opts) {
   const t = await resolveTransport(opts);
   const groups = await listGroups(t);
   if (opts.json) return void console.log(JSON.stringify(groups));
-  if (!groups.length) return void console.log(import_chalk35.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
-  console.log(import_chalk35.default.dim(`Tenant ${t.tenant}:`));
+  if (!groups.length) return void console.log(import_chalk38.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk38.default.dim(`Tenant ${t.tenant}:`));
   for (const g of groups) {
-    const sealed = g.name === "apiblaze_admins" ? import_chalk35.default.dim("  (admins \u2014 managed by allowlist)") : "";
-    console.log(`  ${import_chalk35.default.bold(g.name)}  ${import_chalk35.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+    const sealed = g.name === "apiblaze_admins" ? import_chalk38.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk38.default.bold(g.name)}  ${import_chalk38.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
   }
 }
 async function runGroupCreate(name, opts) {
@@ -5482,7 +6384,7 @@ async function runGroupCreate(name, opts) {
   const spinner = (0, import_ora17.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
-    spinner.succeed(`Group ${import_chalk35.default.bold(name)} created in ${t.tenant}.`);
+    spinner.succeed(`Group ${import_chalk38.default.bold(name)} created in ${t.tenant}.`);
   } catch (e) {
     spinner.fail("Create failed.");
     throw e;
@@ -5494,7 +6396,7 @@ async function runGroupDelete(name, opts) {
   const spinner = (0, import_ora17.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
-    spinner.succeed(`Group ${import_chalk35.default.bold(name)} deleted.`);
+    spinner.succeed(`Group ${import_chalk38.default.bold(name)} deleted.`);
   } catch (e) {
     spinner.fail("Delete failed.");
     throw e;
@@ -5507,11 +6409,11 @@ async function runGroupMembers(name, opts) {
   const subs = await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/subgroups`);
   if (opts.json) return void console.log(JSON.stringify({ ...detail, subgroups: subs?.subgroups ?? [] }));
   const members = detail?.members ?? [];
-  console.log(import_chalk35.default.bold(`${g.name}`) + import_chalk35.default.dim(`  (${t.tenant})`));
-  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk35.default.cyan("group-admin") : import_chalk35.default.dim("member")}`);
-  if (!members.length) console.log(import_chalk35.default.dim("  no members"));
+  console.log(import_chalk38.default.bold(`${g.name}`) + import_chalk38.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk38.default.cyan("group-admin") : import_chalk38.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk38.default.dim("  no members"));
   const sg = subs?.subgroups ?? [];
-  if (sg.length) console.log(import_chalk35.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+  if (sg.length) console.log(import_chalk38.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
 }
 async function runGroupAddUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
@@ -5521,7 +6423,7 @@ async function runGroupAddUser(userRef, groupName, opts) {
   const spinner = (0, import_ora17.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
-    spinner.succeed(`${import_chalk35.default.bold(label2(u))} added to ${import_chalk35.default.bold(g.name)} as ${role}.`);
+    spinner.succeed(`${import_chalk38.default.bold(label2(u))} added to ${import_chalk38.default.bold(g.name)} as ${role}.`);
   } catch (e) {
     spinner.fail("Add failed.");
     throw e;
@@ -5533,7 +6435,7 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
   const spinner = (0, import_ora17.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
-    spinner.succeed(`${import_chalk35.default.bold(label2(u))} removed from ${import_chalk35.default.bold(g.name)}.`);
+    spinner.succeed(`${import_chalk38.default.bold(label2(u))} removed from ${import_chalk38.default.bold(g.name)}.`);
   } catch (e) {
     spinner.fail("Remove failed.");
     throw e;
@@ -5545,7 +6447,7 @@ async function runGroupAddGroup(childName, parentName, opts) {
   const spinner = (0, import_ora17.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
-    spinner.succeed(`${import_chalk35.default.bold(child.name)} is now a subgroup of ${import_chalk35.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk38.default.bold(child.name)} is now a subgroup of ${import_chalk38.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Nest failed.");
     throw e;
@@ -5557,7 +6459,7 @@ async function runGroupRemoveGroup(childName, parentName, opts) {
   const spinner = (0, import_ora17.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
-    spinner.succeed(`${import_chalk35.default.bold(child.name)} un-nested from ${import_chalk35.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk38.default.bold(child.name)} un-nested from ${import_chalk38.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Un-nest failed.");
     throw e;
@@ -5568,18 +6470,18 @@ async function runGroupUsers(opts) {
   const users = await listUsers(t);
   const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
   if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
-  console.log(import_chalk35.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
-  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk35.default.dim(u.abz_sub)}`);
-  if (!users.length) console.log(import_chalk35.default.dim("  no users yet"));
+  console.log(import_chalk38.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk38.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk38.default.dim("  no users yet"));
   const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
   if (fresh.length) {
-    console.log(import_chalk35.default.dim("Seen in traffic (not yet users):"));
-    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk35.default.dim(o.source_label ?? "")}`);
+    console.log(import_chalk38.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk38.default.dim(o.source_label ?? "")}`);
   }
 }
 
 // src/commands/key.ts
-var import_chalk36 = __toESM(require("chalk"));
+var import_chalk39 = __toESM(require("chalk"));
 var import_ora18 = __toESM(require("ora"));
 init_caller();
 async function runApikeysMenu(opts) {
@@ -5609,11 +6511,11 @@ async function runKeyList(opts) {
     return;
   }
   if (!keys.length) {
-    console.log(import_chalk36.default.yellow("No developer keys."));
+    console.log(import_chalk39.default.yellow("No developer keys."));
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk36.default.bold(k.key_id ?? k.id)}  ${import_chalk36.default.dim(k.description ?? "")}  ${import_chalk36.default.dim(k.expires_at ?? "no expiry")}`);
+    console.log(`  ${import_chalk39.default.bold(k.key_id ?? k.id)}  ${import_chalk39.default.dim(k.description ?? "")}  ${import_chalk39.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
@@ -5635,9 +6537,9 @@ async function runKeyMint(opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    console.log(`  ${import_chalk36.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk36.default.bold("key")}:     ${import_chalk36.default.green(out?.key)}  ${import_chalk36.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk36.default.dim("expires:")} ${out.expires_at}`);
+    console.log(`  ${import_chalk39.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk39.default.bold("key")}:     ${import_chalk39.default.green(out?.key)}  ${import_chalk39.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk39.default.dim("expires:")} ${out.expires_at}`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
@@ -5664,7 +6566,7 @@ async function runKeyRevoke(keyId, opts) {
 init_iam();
 
 // src/commands/admins.ts
-var import_chalk37 = __toESM(require("chalk"));
+var import_chalk40 = __toESM(require("chalk"));
 var import_ora19 = __toESM(require("ora"));
 init_caller();
 function requireTenant(opts) {
@@ -5692,13 +6594,13 @@ async function runAdminsList(opts) {
     return;
   }
   if (!admins2.length) {
-    console.log(import_chalk37.default.yellow(`No tenant admins for ${tenant2} yet.`));
+    console.log(import_chalk40.default.yellow(`No tenant admins for ${tenant2} yet.`));
     return;
   }
   for (const a of admins2) {
     const email = typeof a === "string" ? a : a.email;
     const flags = [a.active === false ? "pending" : null, a.pinned ? "pinned" : null].filter(Boolean).join(", ");
-    console.log(`  ${import_chalk37.default.bold(email)}${flags ? import_chalk37.default.dim(`  (${flags})`) : ""}`);
+    console.log(`  ${import_chalk40.default.bold(email)}${flags ? import_chalk40.default.dim(`  (${flags})`) : ""}`);
   }
 }
 async function runAdminsAdd(email, opts) {
@@ -5713,9 +6615,9 @@ async function runAdminsAdd(email, opts) {
       body: { email },
       summary: `Add ${email} to tenant ${tenant2} admins`
     });
-    spinner?.succeed(`${import_chalk37.default.bold(email)} is now a tenant admin of ${import_chalk37.default.bold(tenant2)}.`);
+    spinner?.succeed(`${import_chalk40.default.bold(email)} is now a tenant admin of ${import_chalk40.default.bold(tenant2)}.`);
     if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
-    else console.log(import_chalk37.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
+    else console.log(import_chalk40.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
   } catch (err) {
     spinner?.fail("Add failed.");
     throw err;
@@ -5732,7 +6634,7 @@ async function runAdminsRemove(email, opts) {
       path: `${base(teamId, tenant2)}/${encodeURIComponent(email)}`,
       summary: `Remove ${email} from tenant ${tenant2} admins`
     });
-    spinner?.succeed(`Removed ${import_chalk37.default.bold(email)} from the tenant admins of ${import_chalk37.default.bold(tenant2)}.`);
+    spinner?.succeed(`Removed ${import_chalk40.default.bold(email)} from the tenant admins of ${import_chalk40.default.bold(tenant2)}.`);
   } catch (err) {
     spinner?.fail("Remove failed.");
     throw err;
@@ -5740,7 +6642,7 @@ async function runAdminsRemove(email, opts) {
 }
 
 // src/commands/preapprove.ts
-var import_chalk38 = __toESM(require("chalk"));
+var import_chalk41 = __toESM(require("chalk"));
 var import_ora20 = __toESM(require("ora"));
 
 // src/lib/preapproval.ts
@@ -5805,14 +6707,14 @@ async function runPreapprove(who, opts) {
     const rules = await listPreapprovalRules(tenant2);
     if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
     if (!rules.length) {
-      console.log(import_chalk38.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
-      console.log(import_chalk38.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      console.log(import_chalk41.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk41.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
       return;
     }
-    console.log(import_chalk38.default.dim(`Pre-approved for ${import_chalk38.default.bold(tenant2)}:`));
+    console.log(import_chalk41.default.dim(`Pre-approved for ${import_chalk41.default.bold(tenant2)}:`));
     for (const r of rules) {
-      const tag = r.kind === "domain" ? import_chalk38.default.cyan("@" + r.value + " (whole domain)") : r.value;
-      const grp = r.groups?.length ? import_chalk38.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      const tag = r.kind === "domain" ? import_chalk41.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk41.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
       console.log(`  ${tag}${grp}`);
     }
     return;
@@ -5823,17 +6725,17 @@ async function runPreapprove(who, opts) {
   if (opts.remove) {
     const spinner2 = (0, import_ora20.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
-    if (removed) spinner2.succeed(`${import_chalk38.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
-    else spinner2.warn(`No pre-approval rule for ${import_chalk38.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    if (removed) spinner2.succeed(`${import_chalk41.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk41.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
   const spinner = (0, import_ora20.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
-    spinner.succeed(`${import_chalk38.default.bold(what)} can now sign in to ${import_chalk38.default.bold(tenant2)}.`);
-    if (opts.group?.length) console.log(import_chalk38.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
-    console.log(import_chalk38.default.dim(`  See the full list:  apiblaze preapprove --list`));
+    spinner.succeed(`${import_chalk41.default.bold(what)} can now sign in to ${import_chalk41.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk41.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk41.default.dim(`  See the full list:  apiblaze preapprove --list`));
   } catch (err) {
     spinner.fail("Could not add the rule.");
     throw err;
@@ -5844,7 +6746,7 @@ async function runPreapprove(who, opts) {
 var fs9 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk40 = __toESM(require("chalk"));
+var import_chalk43 = __toESM(require("chalk"));
 var import_ora21 = __toESM(require("ora"));
 var import_yaml2 = require("yaml");
 init_auth();
@@ -5855,7 +6757,7 @@ init_admin();
 // src/commands/llm.ts
 var fs8 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
-var import_chalk39 = __toESM(require("chalk"));
+var import_chalk42 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_auth();
 var LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
@@ -5899,27 +6801,27 @@ async function runLlmSetKey(keyArg, opts) {
   }
   const existing = loadLlmConfig();
   saveLlmConfig({ key, provider, model: opts.model ?? existing?.model });
-  console.log(`${import_chalk39.default.green("\u2713")} Saved ${import_chalk39.default.bold(provider)} key ${maskSecret(key)}`);
-  console.log(import_chalk39.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
-  if (opts.model) console.log(import_chalk39.default.gray(`  Model: ${opts.model}`));
+  console.log(`${import_chalk42.default.green("\u2713")} Saved ${import_chalk42.default.bold(provider)} key ${maskSecret(key)}`);
+  console.log(import_chalk42.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
+  if (opts.model) console.log(import_chalk42.default.gray(`  Model: ${opts.model}`));
 }
 async function runLlmShow() {
   const cfg = loadLlmConfig();
   if (!cfg) {
-    console.log(import_chalk39.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
+    console.log(import_chalk42.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
     return;
   }
-  console.log(`Provider: ${import_chalk39.default.bold(cfg.provider)}`);
+  console.log(`Provider: ${import_chalk42.default.bold(cfg.provider)}`);
   console.log(`Key:      ${maskSecret(cfg.key)}`);
   if (cfg.model) console.log(`Model:    ${cfg.model}`);
-  console.log(import_chalk39.default.gray(`Stored at ${LLM_PATH}`));
+  console.log(import_chalk42.default.gray(`Stored at ${LLM_PATH}`));
 }
 async function runLlmClearKey() {
   try {
     fs8.unlinkSync(LLM_PATH);
-    console.log(`${import_chalk39.default.green("\u2713")} Removed local LLM key.`);
+    console.log(`${import_chalk42.default.green("\u2713")} Removed local LLM key.`);
   } catch {
-    console.log(import_chalk39.default.gray("No LLM key was set."));
+    console.log(import_chalk42.default.gray("No LLM key was set."));
   }
 }
 
@@ -5927,9 +6829,9 @@ async function runLlmClearKey() {
 init_trace();
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk40.default.red(`
+  console.error(import_chalk43.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk40.default.dim(hint));
+  if (hint) console.error(import_chalk43.default.dim(hint));
   process.exit(1);
 }
 function normalizeName2(raw) {
@@ -6077,7 +6979,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk40.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk43.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -6150,7 +7052,7 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     const fresh = await validConsumerToken(existing);
     if (fresh) {
       if (fresh.accessToken !== existing.accessToken) saveConsumer({ ...fresh, resource });
-      console.log(import_chalk40.default.dim(`  Using your consumer session on ${import_chalk40.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      console.log(import_chalk43.default.dim(`  Using your consumer session on ${import_chalk43.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
       return fresh;
     }
   }
@@ -6169,13 +7071,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     );
   }
   const clientId = pick2.client_id ?? pick2.clientId;
-  console.log(`${import_chalk40.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk40.default.bold(tenant2)}...`);
+  console.log(`${import_chalk43.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk43.default.bold(tenant2)}...`);
   const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk40.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk40.default.bold(userCode)}
+  Open: ${import_chalk43.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk43.default.bold(userCode)}
 `);
-    console.log(import_chalk40.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk43.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, resource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -6191,7 +7093,7 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     resource
   };
   saveConsumer(creds);
-  console.log(`  ${import_chalk40.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk40.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  console.log(`  ${import_chalk43.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk43.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
 async function cpPost(anon, path8, body, summary) {
@@ -6220,7 +7122,7 @@ async function provision(spec2, target, opts) {
   let name = opts.name ? base2 : `${base2}${salt()}`;
   const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
   if (anon && opts.access === "invite") {
-    console.log(import_chalk40.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+    console.log(import_chalk43.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
   }
   const DUAL_AUTH = {
     mode: "authenticate",
@@ -6319,7 +7221,7 @@ async function provision(spec2, target, opts) {
       try {
         await addPreapprovalRule(tenant2, email);
       } catch {
-        console.log(import_chalk40.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+        console.log(import_chalk43.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
       }
     }
   }
@@ -6363,7 +7265,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk40.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk43.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -6371,7 +7273,7 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk40.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk43.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
@@ -6412,15 +7314,15 @@ var revealAuth = false;
 function renderToolEvents(events, cred) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk40.default.green("\u2713") : import_chalk40.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk40.default.cyan(e.name)} ${import_chalk40.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
+    const mark = ok ? import_chalk43.default.green("\u2713") : import_chalk43.default.red("\u2717");
+    console.log(`  ${mark} ${import_chalk43.default.cyan(e.name)} ${import_chalk43.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk40.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
+      console.log(import_chalk43.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
       if (cred) {
         const shown = revealAuth ? cred.value : maskKey(cred.value);
         const keyLine = `        -H '${cred.header}: ${shown}'`;
-        const hint = revealAuth ? "" : import_chalk40.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk40.default.dim(keyLine) + hint);
+        const hint = revealAuth ? "" : import_chalk43.default.yellow("  \u2190 /showauth will reveal this");
+        console.log(import_chalk43.default.dim(keyLine) + hint);
       }
     }
   }
@@ -6441,20 +7343,20 @@ function renderToolResults(delta, events) {
       }
     })();
     const lines = pretty.split("\n");
-    console.log(import_chalk40.default.dim("      response:"));
+    console.log(import_chalk43.default.dim("      response:"));
     for (const line of lines.slice(0, cap)) {
-      console.log(import_chalk40.default.dim(`        ${line}`));
+      console.log(import_chalk43.default.dim(`        ${line}`));
     }
-    if (lines.length > cap) console.log(import_chalk40.default.dim(`        \u2026${lines.length - cap} more lines`));
+    if (lines.length > cap) console.log(import_chalk43.default.dim(`        \u2026${lines.length - cap} more lines`));
   }
 }
 function billingLine(billing) {
   if (!billing || typeof billing.cents !== "number") return null;
   if (typeof billing.free_turns_remaining === "number") return null;
   const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk40.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk40.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
+  let line = import_chalk43.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk43.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
   if (typeof billing.credits_remaining === "number") {
-    line += import_chalk40.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk43.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -6462,21 +7364,21 @@ function freeBudgetWarning(billing, anon) {
   if (!anon || !billing) return null;
   if (typeof billing.free_turns_remaining === "number") {
     const left2 = billing.free_turns_remaining;
-    if (left2 <= 0) return import_chalk40.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk40.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
+    if (left2 <= 0) return import_chalk43.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk43.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof billing.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(billing.cents || 0, 0.02);
   const left = Math.floor(billing.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk40.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk40.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk43.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk43.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 function printAssistant(delta) {
   for (let i = delta.length - 1; i >= 0; i--) {
     const m = delta[i];
     if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk40.default.green("assistant \u203A ") + m.content + "\n");
+      console.log("\n" + import_chalk43.default.green("assistant \u203A ") + m.content + "\n");
       return;
     }
   }
@@ -6502,7 +7404,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk40.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk43.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     let data = null;
@@ -6522,9 +7424,9 @@ async function replTurn(p, messages, userText) {
     if (res.status === 401) {
       const reason = data && (data.error || data.message) || null;
       const usingKey = !p.consumerAuth;
-      console.log(import_chalk40.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
+      console.log(import_chalk43.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
       console.log(
-        import_chalk40.default.dim(
+        import_chalk43.default.dim(
           usingKey ? "  Sent an API key. If the key was revoked, re-run `apiblaze apichat` to re-provision." : "  Sent your consumer OAuth token. Re-run `apiblaze apichat` to sign in again."
         )
       );
@@ -6532,7 +7434,7 @@ async function replTurn(p, messages, userText) {
     }
     if (!res.ok || !data) {
       const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk40.default.red(`  Chat error: ${err}`));
+      console.log(import_chalk43.default.red(`  Chat error: ${err}`));
       return;
     }
     if (Array.isArray(data.delta)) {
@@ -6553,25 +7455,25 @@ async function replTurn(p, messages, userText) {
     if (warn) console.log(warn);
     if (!data.continue) return;
   }
-  console.log(import_chalk40.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
+  console.log(import_chalk43.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
 }
 function renderUpsell(p, upsell) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk40.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk40.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk43.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk43.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
-  console.log("\n" + import_chalk40.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
-  if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "PAUSED") {
+  console.log("\n" + import_chalk43.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "QUOTA" || upsell.reason === "PROXY_CAP" || upsell.reason === "PAUSED" || upsell.reason === "BYO_REQUIRED") {
     if (!loggedIn) {
-      console.log(import_chalk40.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk43.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk40.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk43.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk40.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk43.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
@@ -6664,9 +7566,9 @@ async function openServerProxy(project) {
   let consumerAuth = false;
   if (acceptsApiKey) {
     if (!dpKey) {
-      console.log(import_chalk40.default.dim(`  Minting an API key for tenant ${import_chalk40.default.bold(tenant2)} to query project ${import_chalk40.default.bold(project.projectName)}\u2026`));
+      console.log(import_chalk43.default.dim(`  Minting an API key for tenant ${import_chalk43.default.bold(tenant2)} to query project ${import_chalk43.default.bold(project.projectName)}\u2026`));
       dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-      console.log(`  ${import_chalk40.default.green("\u2714")} API key: ${import_chalk40.default.dim(maskKey(dpKey))}`);
+      console.log(`  ${import_chalk43.default.green("\u2714")} API key: ${import_chalk43.default.dim(maskKey(dpKey))}`);
     }
   } else {
     consumerAuth = true;
@@ -6695,9 +7597,9 @@ async function openServerProxy(project) {
     const spec2 = raw && (raw.spec ?? raw);
     spinner.stop();
     if (!spec2 || !(spec2.paths || spec2.openapi)) {
-      console.log(import_chalk40.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk43.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     } else {
-      console.log(import_chalk40.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
+      console.log(import_chalk43.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -6753,7 +7655,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk40.default.bold(a.name)} ${import_chalk40.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk43.default.bold(a.name)} ${import_chalk43.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -6763,14 +7665,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk40.default.bold(pr.projectName)} ${import_chalk40.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk43.default.bold(pr.projectName)} ${import_chalk43.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk40.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk43.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -6873,36 +7775,36 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk40.default.cyan.bold("Chat with your API") + import_chalk40.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk40.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk43.default.cyan.bold("Chat with your API") + import_chalk43.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk43.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk40.default.dim(
+    import_chalk43.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk40.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk43.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk40.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk43.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk40.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk43.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       const justLoggedIn = !loadCredentials();
       if (justLoggedIn) {
-        console.log(import_chalk40.default.dim("  Logging in to claim your workspace\u2026"));
+        console.log(import_chalk43.default.dim("  Logging in to claim your workspace\u2026"));
         try {
           await runLogin();
         } catch (err) {
-          console.log(import_chalk40.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk43.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           continue;
         }
         if (!loadCredentials()) continue;
@@ -6913,30 +7815,30 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk40.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk43.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk40.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk43.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk40.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk43.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk40.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk43.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk40.default.dim("\nBye."));
+  console.log(import_chalk43.default.dim("\nBye."));
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk40.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk43.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -6949,7 +7851,7 @@ async function runApichat(opts) {
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk40.default.dim("Target:")} ${import_chalk40.default.bold(target)}`);
+  console.log(`  ${import_chalk43.default.dim("Target:")} ${import_chalk43.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -6958,7 +7860,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk40.default.dim("Proxy: ")} ${import_chalk40.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk43.default.dim("Proxy: ")} ${import_chalk43.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -6978,30 +7880,30 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk40.default.dim("  Target auth: none required."));
+    console.log(import_chalk43.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk40.default.green("\u2713")} proxy  ${import_chalk40.default.bold(p.proxyUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk43.default.green("\u2713")} proxy  ${import_chalk43.default.bold(p.proxyUrl)}`);
   if (mcpUrl) {
-    console.log(`  ${import_chalk40.default.green("\u2713")} mcp    ${import_chalk40.default.bold(mcpUrl)}`);
+    console.log(`  ${import_chalk43.default.green("\u2713")} mcp    ${import_chalk43.default.bold(mcpUrl)}`);
     if (p.access === "invite") {
-      console.log(import_chalk40.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
-      console.log(import_chalk40.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+      console.log(import_chalk43.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk43.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
     } else {
-      console.log(import_chalk40.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+      console.log(import_chalk43.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
     }
   }
   if (p.anon) {
-    console.log(import_chalk40.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
+    console.log(import_chalk43.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk41 = __toESM(require("chalk"));
+var import_chalk44 = __toESM(require("chalk"));
 var import_ora22 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -7020,10 +7922,10 @@ async function consumerFetch(creds, suffix, init) {
   }
   return { status: res.status, data, creds: fresh };
 }
-function requireConsumer() {
+function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk41.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk44.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -7034,7 +7936,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk41.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk44.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -7052,19 +7954,19 @@ async function runConsumerLogin(opts) {
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk41.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk44.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk41.default.cyan("\u2192")} Logging in to ${import_chalk41.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk44.default.cyan("\u2192")} Logging in to ${import_chalk44.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk41.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk41.default.bold(userCode)}
+  Open: ${import_chalk44.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk44.default.bold(userCode)}
 `);
-    console.log(import_chalk41.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk44.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -7079,10 +7981,10 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk41.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk44.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
-  const creds = requireConsumer();
+  const creds = requireConsumer2();
   const fresh = await validConsumerToken(creds) ?? creds;
   const exp = (t) => {
     const p = t ? decodeJwt2(t) : null;
@@ -7092,29 +7994,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk41.default.cyan("Consumer")} ${import_chalk41.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk41.default.bold(fresh.tenant)}
+  console.log(`${import_chalk44.default.cyan("Consumer")} ${import_chalk44.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk44.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk41.default.bold("access_token")}  ${import_chalk41.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk44.default.bold("access_token")}  ${import_chalk44.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk41.default.bold("id_token")}      ${import_chalk41.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk44.default.bold("id_token")}      ${import_chalk44.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk41.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk44.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk41.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk44.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
-  const creds = requireConsumer();
+  const creds = requireConsumer2();
   const { default: inquirer3 } = await import("inquirer");
   const spinner = (0, import_ora22.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk41.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk41.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk44.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk44.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -7122,16 +8024,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk41.default.yellow("No API keys yet."));
+    console.log(import_chalk44.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk41.default.green(clear) : import_chalk41.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk41.default.dim(`exp ${k.expires_at}`) : import_chalk41.default.dim("no expiry");
-      console.log(`  ${import_chalk41.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk41.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk44.default.green(clear) : import_chalk44.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk44.default.dim(`exp ${k.expires_at}`) : import_chalk44.default.dim("no expiry");
+      console.log(`  ${import_chalk44.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk44.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk41.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk44.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -7153,12 +8055,12 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk41.default.green(key)}  ${import_chalk41.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk41.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk44.default.green(key)}  ${import_chalk44.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk44.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk42 = __toESM(require("chalk"));
+var import_chalk45 = __toESM(require("chalk"));
 var import_ora23 = __toESM(require("ora"));
 var fs10 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
@@ -7201,7 +8103,7 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk42.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk45.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs10.existsSync(path7.join(root, f));
@@ -7212,7 +8114,7 @@ function installSidecarPackage(root) {
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk42.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk42.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk45.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk45.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -7363,29 +8265,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk42.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk42.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk45.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk42.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk45.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk42.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk42.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk45.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk45.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk42.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk45.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk42.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk42.default.cyan("apiblaze login")}  then  ${import_chalk42.default.cyan("apiblaze claim")}   ${import_chalk42.default.dim("(no code needed here)")}`);
-  console.log(import_chalk42.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk45.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk45.default.cyan("apiblaze login")}  then  ${import_chalk45.default.cyan("apiblaze claim")}   ${import_chalk45.default.dim("(no code needed here)")}`);
+  console.log(import_chalk45.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path7.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk42.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk45.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -7396,10 +8298,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk42.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk42.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk45.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk42.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk45.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -7422,38 +8324,38 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk42.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk45.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk42.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk45.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk42.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk42.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk45.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk42.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk42.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk42.default.bold("candidates")} \u2014 list them:  ${import_chalk42.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk42.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk45.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk45.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk45.default.bold("candidates")} \u2014 list them:  ${import_chalk45.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk45.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk42.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk42.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk45.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk45.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk42.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk42.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk42.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk45.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk45.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk45.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk42.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk42.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk45.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk45.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk43 = __toESM(require("chalk"));
+var import_chalk46 = __toESM(require("chalk"));
 var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -7464,7 +8366,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk43.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk46.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -7482,27 +8384,27 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk43.default.bold(`
+  console.log(import_chalk46.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk43.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk43.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk43.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk43.default.bold(`
+  if (!routed.length) console.log(import_chalk46.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk46.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk46.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk46.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk43.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk46.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk43.default.yellow("\u25CB")} ${c.origin}  ${import_chalk43.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk46.default.yellow("\u25CB")} ${c.origin}  ${import_chalk46.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk43.default.dim(`
+    console.log(import_chalk46.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk43.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk46.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk43.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk46.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
     const spinner2 = (0, import_ora24.default)(`Approving ${origin} (anonymous)...`).start();
@@ -7555,7 +8457,7 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk44 = __toESM(require("chalk"));
+var import_chalk47 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
@@ -7588,82 +8490,82 @@ function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk44.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk44.default.bold("\n  Upstash"));
+  console.log(import_chalk47.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk47.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk44.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk44.default.yellow(o.key)} ${import_chalk44.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk44.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk47.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk47.default.yellow(o.key)} ${import_chalk47.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk47.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk44.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk47.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk44.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk47.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk44.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk44.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk44.default.red(`    error: ${e}`));
-  console.log(import_chalk44.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk47.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk47.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
+  console.log(import_chalk47.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk44.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk47.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk44.default.yellow(s.store_id)} ${import_chalk44.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk47.default.yellow(s.store_id)} ${import_chalk47.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk44.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk47.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk44.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk47.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk44.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk47.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk44.default.yellow(s.store_id)} ${import_chalk44.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk47.default.yellow(s.store_id)} ${import_chalk47.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk44.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk47.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk44.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk47.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk44.default.red(`    error: ${e}`));
-  console.log(import_chalk44.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
+  console.log(import_chalk47.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk44.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk44.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk44.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk47.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk47.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk47.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk44.default.green(`    no ghost tuples ${import_chalk44.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk47.default.green(`    no ghost tuples ${import_chalk47.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk44.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk47.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk44.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk47.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk44.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk47.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk44.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk44.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk47.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk44.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk47.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk44.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk44.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk44.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk44.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk44.default.cyan("apiblaze op credits")}        list credit wallets`);
-      console.log(import_chalk44.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+      console.log(import_chalk47.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk47.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk47.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk47.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk47.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk47.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
 `));
       return;
     }
@@ -7682,17 +8584,17 @@ async function runOp(sub, opts = {}) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk44.default.green("Nothing to sweep."));
+        console.log(import_chalk47.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
-        const readline2 = await import("readline/promises");
-        const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+        const readline3 = await import("readline/promises");
+        const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk44.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk47.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk44.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk47.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -7703,15 +8605,15 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk44.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk47.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk44.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk44.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk44.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk47.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk47.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk47.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk44.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk47.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -7766,15 +8668,15 @@ var runSetup = (opts) => runSidecar({ team: opts.team, dir: opts.dir, yes: opts.
 var withSetupOptions = (cmd) => cmd.option("--team <id|name>", "Team to set up under (defaults to your active team)").option("--dir <path>", "Project directory (defaults to cwd)").option("--no-inspector", "Skip generating the dev-only /abz-inspector page").option("--rotate", "Mint a fresh invoke key even if one already exists").option("--new-session", "Start a fresh anonymous session (logged-out only)").option("-y, --yes", "Skip prompts");
 withSetupOptions(program.command("init").description("Set up the APIblaze sidecar in a Next.js app (shortcut for `apiblaze sidecar setup`)")).action(action((opts) => runSetup(opts)));
 var sidecar = program.command("sidecar").description("The APIblaze sidecar \u2014 set it up, then approve which origins route through APIblaze").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((opts) => runOriginsList(opts)));
-withSetupOptions(sidecar.command("setup").description("Wire a Next.js app to route its external fetches through APIblaze")).action(action((opts) => runSetup(opts)));
-sidecar.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts) => runOriginsApprove(origin, opts)));
-sidecar.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsDeny(origin, opts)));
-sidecar.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts) => runOriginsRemove(origin, opts)));
+withSetupOptions(sidecar.command("setup").description("Wire a Next.js app to route its external fetches through APIblaze")).action(action((opts, cmd) => runSetup({ ...cmd.parent?.opts(), ...opts })));
+sidecar.command("approve").description("Route an origin through APIblaze (creates its proxy)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts, cmd) => runOriginsApprove(origin, { ...cmd.parent?.opts(), ...opts })));
+sidecar.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts, cmd) => runOriginsDeny(origin, { ...cmd.parent?.opts(), ...opts })));
+sidecar.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts, cmd) => runOriginsRemove(origin, { ...cmd.parent?.opts(), ...opts })));
 program.command("dev").description("Put your localhost behind a public URL (dev tunnel)").argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port to tunnel", "3000").option("--project <nameOrId>", "Tunnel this specific project (skips the picker \u2014 for scripts)").option("-y, --yes", "Skip confirmation prompts (non-interactive)").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").option("--new-session", "Logged-out only: start a fresh anonymous workspace instead of reusing this machine's (each run = a throwaway proxy)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk45.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk48.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile, newSession: opts.newSession });
@@ -7787,6 +8689,8 @@ var consumer = program.command("consumer").description("Act as a consumer of you
 consumer.command("login").description("Log in to a tenant's portal as a consumer (device flow)").option("--team <id|name>", "Team whose tenants to choose from (producer mode)").option("--tenant <slug>", "Tenant to log in to (skips the picker)").option("--client <clientId>", "App client id \u2014 for standalone login without a producer session").action(action((opts) => runConsumerLogin(opts)));
 consumer.command("tokens").description("Show the logged-in consumer access / refresh / id tokens").option("--json", "Output machine-readable JSON").action(action((opts) => runConsumerTokens(opts)));
 consumer.command("apikeys").description("List your consumer API keys (reveals expiring ones), then offer to create one").option("--json", "Output machine-readable JSON").action(action((opts) => runConsumerApikeys(opts)));
+var consumerLogs = consumer.command("logs").description("API Consumer view \u2014 stream YOUR OWN requests on this tenant live (see `consumer logs list` for past days)").option("--project <name>", "Only this project (when the tenant serves several)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit raw NDJSON rows (pipe into jq)").action(action((opts) => runConsumerLogsTail(opts)));
+consumerLogs.command("list").description("API Consumer view \u2014 browse YOUR OWN past requests by day, then open one for detail").option("--project <name>", "Only this project (when the tenant serves several)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit ALL matching rows as NDJSON, newest first (non-interactive)").option("--plain", "Print day-grouped rows instead of prompting (automatic when piped)").action(action((_o, cmd) => runConsumerLogsList(cmd.optsWithGlobals())));
 program.command("flush").description("Wipe ALL local state (login, workspace keys, apichats, DP keys, secrets)").option("-y, --yes", "Skip the confirmation prompt").action(runFlush);
 program.command("logout").description("Sign out (asks whether to drop the Producer or Consumer login)").option("--producer", "Log out of the API Producer identity").option("--consumer", "Log out of the API Consumer identity").option("--all", "Log out of both").action(action((opts) => runLogout(opts)));
 program.command("whoami").description("Show who you are \u2014 both API Producer and API Consumer").option("--json", "Output machine-readable JSON").action(async (opts) => {
@@ -7823,6 +8727,8 @@ program.command("projects").description("List the projects in your team").action
 });
 program.command("delete").description("Delete a proxy and everything under it (asks first)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--team <id|name>", "Team the project is in (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON").action(action((project, version2, opts) => runDelete(project, version2, opts)));
 program.command("export").description("Export config and data for migration out of APIblaze (Kong, ...)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--kong", "Produce a runnable Kong OSS bundle (decK config + plugins + docker-compose)").option("--data", "Plain data export (default)").option("--secrets", "Include decrypted producer-supplied secrets (member role; audit-logged)").option("--keys <mode>", "API-key export: hashes (default, consumers keep keys) | mint | none").option("--no-consumers", "Skip the end-user lane (users, groups, keys)").option("-o, --out <file>", "Output zip path").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, opts) => runExport(project, version2, { ...opts, noConsumers: opts.consumers === false })));
+var logs = program.command("logs").description("API Producer view \u2014 stream this proxy's requests from EVERY caller live (see `apiblaze logs list` to browse past days)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--tenant <slug>", "Tenant to tail (auto when one is attached; prompted otherwise)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit raw NDJSON rows (pipe into jq)").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, opts) => runLogsTail(project, version2, opts)));
+logs.command("list").description("API Producer view \u2014 browse EVERY caller's past requests by day, then open one to see its 4 views").argument("<project>", "Project name or id").argument("[version]", "API version (defaults to the first match)").option("--tenant <slug>", "Tenant to read (auto when one is attached; prompted otherwise)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit ALL matching rows as NDJSON, newest first (non-interactive)").option("--plain", "Print day-grouped rows instead of prompting (automatic when piped)").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, _o, cmd) => runLogsList(project, version2, cmd.optsWithGlobals())));
 program.command("config").description("Browse and change every proxy setting & feature (interactive; git-config-style get/set)").argument("[project]", "Project name or id (omit to pick interactively)").argument("[key]", "Setting key, e.g. throttling.proxyQuota (omit for the menu)").argument("[value]", "New value (omit to read the current value)").option("--list", "Print every setting and its current value").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Machine-readable output (with --list or a key read)").action(action((project, key, value, opts) => runConfig(project, key, value, opts)));
 program.command("target").description("Change where a proxy forwards requests").argument("<project>", "Project name or id").requiredOption("--url <url>", "Target URL to forward to").option("--env <env>", "Environment to scope the target to (e.g. prod, dev)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTargetSet(project, opts)));
 program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
@@ -7874,10 +8780,11 @@ spec.command("delete-rule").description("Delete the saved rules for a route (e.g
 var HELP_GROUPS = [
   { title: "Chat", commands: ["apichat", "agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
-  { title: "Control plane commands", commands: ["config", "projects", "tenant", "group", "admins", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
-    { parent: "consumer", sub: "apikeys" }
+    { parent: "consumer", sub: "apikeys" },
+    { parent: "consumer", sub: "logs" }
   ] }
 ];
 var helpLabel = (e) => typeof e === "string" ? e : `${e.parent} ${e.sub}`;
@@ -7893,7 +8800,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk45.default.bold(g.title)}
+    return `${import_chalk48.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -7928,14 +8835,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk45.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk48.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk45.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk45.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk48.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk48.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -7943,16 +8850,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk45.default.red(`
+    console.error(import_chalk48.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk45.default.red(`
+    console.error(import_chalk48.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk45.default.red("\nUnknown error"));
+    console.error(import_chalk48.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);