apiblaze 0.19.32 → 0.20.2

package/dist/index.js

@@ -714,7 +714,7 @@ async function createTenantRow(teamId) {
     const { name } = await inquirer3.prompt([{
       type: "input",
       name: "name",
-      message: `Tenant name ${import_chalk30.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      message: `Tenant name ${import_chalk33.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
       validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
     }]);
     const slug = name.trim();
@@ -729,7 +729,7 @@ async function createTenantRow(teamId) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
-        console.log(import_chalk30.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
+        console.log(import_chalk33.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
         continue;
       }
       throw err;
@@ -746,11 +746,11 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     pageSize: 10,
     choices: [
       ...PROVIDERS.map((p) => ({ name: p.label, value: p.id })),
-      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk30.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
+      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk33.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
     ]
   }]);
   if (!provider) {
-    console.log(import_chalk30.default.dim("  No login method yet \u2014 add one later under Login methods."));
+    console.log(import_chalk33.default.dim("  No login method yet \u2014 add one later under Login methods."));
     return false;
   }
   const opt = PROVIDERS.find((p) => p.id === provider);
@@ -781,7 +781,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     if (a.callbacks.trim()) clientBody.authorizedCallbackUrls = a.callbacks.split(/\s*,\s*/).map((s) => s.trim()).filter(Boolean);
     if (a.scopes.trim() && opt.own) providerBody.scopes = a.scopes.split(/\s+/).filter(Boolean);
   }
-  const spinner = (0, import_ora10.default)("Setting up login...").start();
+  const spinner = (0, import_ora12.default)("Setting up login...").start();
   try {
     const client = await admin({ method: "POST", path: `${base2}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
     const clientId = client?.clientId ?? client?.client_id;
@@ -796,27 +796,27 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
 async function createTenantInteractive(teamId) {
   const { default: inquirer3 } = await import("inquirer");
   const tenant2 = await createTenantRow(teamId);
-  console.log(import_chalk30.default.green(`  Tenant ${import_chalk30.default.bold(tenant2)} created.`));
+  console.log(import_chalk33.default.green(`  Tenant ${import_chalk33.default.bold(tenant2)} created.`));
   const { users } = await inquirer3.prompt([{
     type: "confirm",
     name: "users",
     default: false,
-    message: `Enable Users & groups? ${import_chalk30.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
+    message: `Enable Users & groups? ${import_chalk33.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
   }]);
   if (users) {
     await admin({ method: "PATCH", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`, body: { enabled: true }, summary: "Enable Users & groups" }).catch(() => {
     });
-    console.log(import_chalk30.default.green("  Users & groups enabled."));
+    console.log(import_chalk33.default.green("  Users & groups enabled."));
   }
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk30, import_ora10, PROVIDERS, DEFAULT_SCOPES;
+var import_chalk33, import_ora12, PROVIDERS, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
-    import_chalk30 = __toESM(require("chalk"));
-    import_ora10 = __toESM(require("ora"));
+    import_chalk33 = __toESM(require("chalk"));
+    import_ora12 = __toESM(require("ora"));
     init_admin();
     PROVIDERS = [
       { id: "apiblaze", label: "APIblaze (via GitHub) \u2014 zero setup, recommended", own: false },
@@ -854,10 +854,10 @@ async function fetchPage2(teamId, q) {
 }
 function label(t, defaultTenant, active) {
   const tags = [
-    t.tenant_name === active ? import_chalk31.default.cyan("active scope") : "",
-    t.tenant_name === defaultTenant ? import_chalk31.default.dim("team default") : ""
+    t.tenant_name === active ? import_chalk34.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk34.default.dim("team default") : ""
   ].filter(Boolean).join(", ");
-  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk31.default.dim(`  ${t.display_name}`) : "";
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk34.default.dim(`  ${t.display_name}`) : "";
   return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
 }
 async function pickTenant(teamId, opts = {}) {
@@ -865,14 +865,14 @@ async function pickTenant(teamId, opts = {}) {
   const active = loadCredentials()?.activeTenant;
   let q = opts.initialQuery ?? "";
   for (; ; ) {
-    const spinner = (0, import_ora11.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const spinner = (0, import_ora13.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
     const page = await fetchPage2(teamId, q).finally(() => spinner.stop());
     if (!page.total && !q) {
       if (opts.allowCreate) {
         const { make } = await inquirer3.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
         if (make) return await createTenantInline(teamId);
       }
-      console.error(import_chalk31.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk34.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       return null;
     }
     const truncated = page.total > page.rows.length;
@@ -881,7 +881,7 @@ async function pickTenant(teamId, opts = {}) {
       value: t.tenant_name
     }));
     if (truncated || q) {
-      choices.push(new inquirer3.Separator(import_chalk31.default.dim(
+      choices.push(new inquirer3.Separator(import_chalk34.default.dim(
         truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
       )));
       choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
@@ -915,12 +915,12 @@ async function createTenantInline(teamId) {
   const { createTenantInteractive: createTenantInteractive2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
   return createTenantInteractive2(teamId);
 }
-var import_chalk31, import_ora11, PAGE;
+var import_chalk34, import_ora13, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
     "use strict";
-    import_chalk31 = __toESM(require("chalk"));
-    import_ora11 = __toESM(require("ora"));
+    import_chalk34 = __toESM(require("chalk"));
+    import_ora13 = __toESM(require("ora"));
     init_admin();
     init_auth();
     PAGE = 15;
@@ -929,10 +929,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk48 = __toESM(require("chalk"));
+var import_chalk51 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.32";
+var version = "0.20.2";
 
 // src/index.ts
 init_types();
@@ -3225,10 +3225,10 @@ async function runDelete(project, version2, opts) {
     }
     if (!opts.yes) {
       const { default: inquirer3 } = await import("inquirer");
-      const { confirm } = await inquirer3.prompt([
+      const { confirm: confirm2 } = await inquirer3.prompt([
         { type: "confirm", name: "confirm", message: `Permanently delete ${proj2.projectName} v${proj2.apiVersion}? This cannot be undone.`, default: false }
       ]);
-      if (!confirm) {
+      if (!confirm2) {
         console.log(import_chalk23.default.dim("Aborted."));
         return;
       }
@@ -3307,34 +3307,1313 @@ async function runExport(projectArg, versionArg, opts) {
   if (target === "kong") console.log(import_chalk24.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
 }
 
-// src/commands/logs.ts
+// src/commands/recipe-search.ts
+var import_chalk25 = __toESM(require("chalk"));
+var import_ora8 = __toESM(require("ora"));
+init_caller();
+
+// src/lib/recipes.ts
+init_types();
+init_caller();
+var RECIPES_BASE = process.env.APIBLAZE_RECIPES_BASE || "https://recipes.apiblaze.com";
+function parseRecipeRef(raw) {
+  const m = /^@([a-z0-9]+)\/([a-z0-9]+)(?:@(\d+))?$/.exec((raw || "").trim().toLowerCase());
+  if (!m || m[1].length < 3 || m[2].length < 3) {
+    throw new Error(
+      `"${raw}" is not a recipe name. A recipe looks like @julien/gmail (or @julien/gmail@2 to pin a revision) \u2014 lowercase letters and digits only, at least 3 of each.`
+    );
+  }
+  return {
+    handle: m[1],
+    slug: m[2],
+    revision: m[3] ? Number(m[3]) : void 0,
+    name: `@${m[1]}/${m[2]}`
+  };
+}
+function resolveRecipeName(raw, githubHandle, proxyName) {
+  const given = (raw ?? "").trim();
+  if (given.startsWith("@")) {
+    return { ref: parseRecipeRef(given), derivedHandle: false, normalizedFrom: null };
+  }
+  const slug = normalizeName2(given || proxyName);
+  const handleRaw = (githubHandle ?? "").trim();
+  const handle = normalizeName2(handleRaw);
+  if (!handle || handle.length < 3) {
+    throw new Error(
+      "Could not work out a handle for you, so pass one: --as @yourhandle/name\n       (a handle is lowercase letters and digits, at least 3.)"
+    );
+  }
+  if (slug.length < 3) {
+    throw new Error(`"${given || proxyName}" is too short for a recipe name \u2014 at least 3 letters or digits.`);
+  }
+  return {
+    ref: parseRecipeRef(`@${handle}/${slug}`),
+    derivedHandle: true,
+    // GitHub allows hyphens; apiblaze names do not. Say so rather than silently
+    // publishing under a name they did not type.
+    normalizedFrom: handleRaw && handleRaw.toLowerCase() !== handle ? handleRaw : null
+  };
+}
+function normalizeName2(raw) {
+  return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+async function publicFetch(path8) {
+  const res = await fetch(`${RECIPES_BASE}/api/recipes${path8}`, {
+    headers: { accept: "application/json" }
+  }).catch((err) => {
+    throw new Error(`Could not reach the recipe registry at ${RECIPES_BASE} \u2014 ${err.message}`);
+  });
+  let data = null;
+  let json = false;
+  try {
+    data = await res.json();
+    json = true;
+  } catch {
+  }
+  return { status: res.status, data, json };
+}
+function registryDown(status) {
+  return new Error(
+    `The recipe registry at ${RECIPES_BASE}/api/recipes did not answer with JSON (HTTP ${status}).
+       Set APIBLAZE_RECIPES_BASE if you are pointing at a different deployment.`
+  );
+}
+async function searchRecipes(query, limit) {
+  const q = `?q=${encodeURIComponent(query ?? "")}${limit ? `&limit=${limit}` : ""}`;
+  const { status, data, json } = await publicFetch(`/search${q}`);
+  if (!json) throw registryDown(status);
+  if (status >= 400) throw new ApiError(status, data?.error ?? "Search failed.");
+  return data?.recipes ?? [];
+}
+async function getRecipeHead(ref) {
+  const { status, data, json } = await publicFetch(`/${ref.handle}/${ref.slug}`);
+  if (!json) throw registryDown(status);
+  if (status === 404) return null;
+  if (status >= 400) throw new ApiError(status, data?.error ?? "Lookup failed.");
+  return data;
+}
+async function fetchRecipeFile(ref, caller) {
+  const head = ref.revision !== void 0 ? null : await getRecipeHead(ref);
+  const revision = ref.revision ?? head?.revision;
+  if (revision !== void 0) {
+    const { status, data, json } = await publicFetch(
+      `/${ref.handle}/${ref.slug}/${revision}`
+    );
+    if (!json) throw registryDown(status);
+    if (status === 410) {
+      throw new Error(`${ref.name}@${revision} was withdrawn by its publisher. Try a different revision.`);
+    }
+    if (status < 400 && data) return data;
+  }
+  if (!caller) {
+    throw new Error(
+      `${ref.name} does not exist, or it is private.
+       Private recipes are visible only to the publisher's team \u2014 run \`apiblaze login\` if you are on it.`
+    );
+  }
+  const path8 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
+  try {
+    return await producer(caller, {
+      method: "GET",
+      path: path8,
+      summary: `Read private recipe ${ref.name}${revision !== void 0 ? `@${revision}` : ""}`
+    });
+  } catch (err) {
+    const status = err instanceof ApiError ? err.status : 0;
+    if (status === 404 || status === 400) {
+      throw new Error(
+        `${ref.name} does not exist, or it is private and your team does not own it.
+       (admin-api exposes no authorized read for a private recipe file yet \u2014 only GET /recipes/public/* is registered, so private install cannot resolve.)`
+      );
+    }
+    throw err;
+  }
+}
+function installUrls(ctx) {
+  return {
+    proxy_url: `https://${ctx.project}.abz.run`,
+    redirect_uri: `https://${ctx.tenant}.auth.apiblaze.com/callback`,
+    mcp_url: `https://${ctx.project}-${ctx.tenant}.mcp.apiblaze.com`,
+    portal_url: `https://${ctx.tenant}.portal.apiblaze.com`
+  };
+}
+function fillContext(text, ctx) {
+  const u = installUrls(ctx);
+  const table = {
+    redirect_uri: u.redirect_uri,
+    proxy_url: u.proxy_url,
+    mcp_url: u.mcp_url,
+    portal_url: u.portal_url,
+    project: ctx.project,
+    tenant: ctx.tenant
+  };
+  return (text || "").replace(/\{(redirect_uri|proxy_url|mcp_url|portal_url|project|tenant)\}/g, (m, k) => table[k] ?? m);
+}
+function fillAnswers(value, answers) {
+  if (typeof value === "string") {
+    return value.replace(/\{\{([A-Za-z0-9_]+)\}\}/g, (m, id) => Object.prototype.hasOwnProperty.call(answers, id) ? answers[id] : m);
+  }
+  if (Array.isArray(value)) return value.map((v) => fillAnswers(v, answers));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = fillAnswers(v, answers);
+    return out;
+  }
+  return value;
+}
+function countRoutes(spec2) {
+  const paths = spec2?.paths;
+  if (!paths || typeof paths !== "object") return 0;
+  const VERBS = ["get", "post", "put", "patch", "delete", "head", "options"];
+  let n = 0;
+  for (const item of Object.values(paths)) {
+    if (!item || typeof item !== "object") continue;
+    for (const k of Object.keys(item)) if (VERBS.includes(k.toLowerCase())) n++;
+  }
+  return n;
+}
+function firstUpstream(recipe) {
+  const envs = recipe.settings?.environments ?? {};
+  for (const e of Object.values(envs)) {
+    const t = typeof e?.target === "string" ? e.target.trim() : "";
+    if (t) return t;
+  }
+  return null;
+}
+function upstreamHosts(recipe) {
+  const envs = recipe.settings?.environments ?? {};
+  const out = [];
+  for (const e of Object.values(envs)) {
+    try {
+      const h = new URL(String(e?.target ?? "")).host;
+      if (h && !out.includes(h)) out.push(h);
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/commands/recipe-search.ts
+async function runRecipeSearch(query, opts) {
+  const spinner = !opts.json ? (0, import_ora8.default)("Searching recipes...").start() : null;
+  let hits;
+  try {
+    hits = await searchRecipes(query ?? "", opts.limit ? Number(opts.limit) : void 0);
+    spinner?.stop();
+  } catch (err) {
+    spinner?.fail("Search failed.");
+    throw err;
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(hits));
+    return;
+  }
+  if (!hits.length) {
+    console.log(import_chalk25.default.yellow(query ? `No public recipes match "${query}".` : "No public recipes yet."));
+    console.log(import_chalk25.default.dim("  Publish one with: apiblaze publish <proxy> --as @yourhandle/name"));
+    return;
+  }
+  console.log();
+  for (const h of hits) {
+    const pin = h.latest_revision ? import_chalk25.default.dim(`@${h.latest_revision}`) : "";
+    const installs = h.install_count ? import_chalk25.default.dim(`  ${h.install_count} install${h.install_count === 1 ? "" : "s"}`) : "";
+    console.log(`  ${import_chalk25.default.bold(h.name)}${pin}${h.display_name ? import_chalk25.default.dim(` \u2014 ${h.display_name}`) : ""}${installs}`);
+    if (h.summary) console.log(`      ${import_chalk25.default.dim(h.summary)}`);
+  }
+  console.log();
+  console.log(import_chalk25.default.dim(`  Install one with: ${import_chalk25.default.cyan(`npx apiblaze install ${hits[0].name}`)}`));
+  console.log(import_chalk25.default.dim(`  Read one first:   ${import_chalk25.default.cyan(`npx apiblaze show ${hits[0].name}`)}`));
+  console.log();
+}
+async function runRecipeShow(nameArg, opts) {
+  const ref = parseRecipeRef(nameArg);
+  const wantsSection = !!(opts.transforms || opts.settings || opts.auth || opts.openapi);
+  const caller = resolveCaller();
+  const head = ref.revision === void 0 ? await getRecipeHead(ref).catch(() => null) : null;
+  const spinner = !opts.json ? (0, import_ora8.default)(`Reading ${ref.name}...`).start() : null;
+  let recipe;
+  try {
+    recipe = await fetchRecipeFile(ref, caller);
+    spinner?.stop();
+  } catch (err) {
+    spinner?.stop();
+    throw err;
+  }
+  if (opts.json) {
+    if (opts.transforms) console.log(JSON.stringify(recipe.transformations));
+    else if (opts.settings) console.log(JSON.stringify(recipe.settings));
+    else if (opts.auth) console.log(JSON.stringify(recipe.auth));
+    else if (opts.openapi) console.log(JSON.stringify(recipe.openapi));
+    else console.log(JSON.stringify(recipe));
+    return;
+  }
+  console.log();
+  console.log(`${import_chalk25.default.bold(`${recipe.name}@${recipe.revision}`)}${import_chalk25.default.dim(` \u2014 by ${ref.handle}`)}`);
+  if (recipe.display_name) console.log(`  ${import_chalk25.default.bold(recipe.display_name)}`);
+  if (recipe.summary) console.log(`  ${recipe.summary}`);
+  const meta = [
+    head?.install_count !== void 0 ? `${head.install_count} install${head.install_count === 1 ? "" : "s"}` : null,
+    recipe.license ? `licence ${recipe.license}` : null,
+    recipe.published_at ? `published ${recipe.published_at.slice(0, 10)}` : null,
+    `api version ${recipe.api_version}`
+  ].filter(Boolean).join("  \xB7  ");
+  console.log(import_chalk25.default.dim(`  ${meta}`));
+  console.log();
+  if (wantsSection) {
+    if (opts.settings) printSection("settings", recipe.settings);
+    if (opts.auth) printAuth(recipe);
+    if (opts.transforms) printTransforms(recipe);
+    if (opts.openapi) console.log(JSON.stringify(recipe.openapi, null, 2));
+    return;
+  }
+  const hosts = upstreamHosts(recipe);
+  const routes = countRoutes(recipe.openapi);
+  const rules = recipe.transformations?.rules?.length ?? 0;
+  const tables = recipe.transformations?.mapping_tables?.length ?? 0;
+  const keyTypes = recipe.auth?.key_types?.length ?? 0;
+  if (hosts.length) console.log(`  ${import_chalk25.default.dim("sends requests to")}  ${hosts.join(", ")}`);
+  console.log(`  ${import_chalk25.default.dim("creates          ")}  ${describeCreates(keyTypes, routes, !!recipe.settings.mcp_enabled)}`);
+  console.log(`  ${import_chalk25.default.dim("asks you for     ")}  ${recipe.questions.length} value${recipe.questions.length === 1 ? "" : "s"}`);
+  if (rules || tables) {
+    console.log(`  ${import_chalk25.default.dim("transforms       ")}  ${rules} rule${rules === 1 ? "" : "s"}${tables ? `, ${tables} mapping table${tables === 1 ? "" : "s"}` : ""}`);
+  }
+  if (recipe.settings.publish_openapi === true) {
+    console.log(`  ${import_chalk25.default.dim("makes public     ")}  this API's spec`);
+  }
+  if (recipe.questions.length) {
+    console.log();
+    console.log(import_chalk25.default.bold("  It will ask you for"));
+    for (const q of recipe.questions) {
+      console.log(`    ${q.prompt}${q.secret ? import_chalk25.default.dim("  (hidden while you type)") : ""}`);
+      if (q.example) console.log(import_chalk25.default.dim(`      e.g. ${q.example}`));
+    }
+  }
+  if (recipe.requires_confirmation?.length) {
+    console.log();
+    console.log(import_chalk25.default.yellow("  Needs your explicit consent at install time"));
+    for (const c of recipe.requires_confirmation) {
+      console.log(`    ${import_chalk25.default.bold(c.kind)}  ${c.value}`);
+      console.log(import_chalk25.default.dim(`      ${c.why}`));
+    }
+  }
+  console.log();
+  console.log(import_chalk25.default.dim(`  Install:  ${import_chalk25.default.cyan(`npx apiblaze install ${recipe.name}`)}`));
+  console.log(import_chalk25.default.dim("  Sections: --settings  --auth  --transforms  --openapi"));
+  console.log();
+}
+function describeCreates(keyTypes, routes, mcp) {
+  const parts = ["1 proxy", "1 tenant"];
+  if (keyTypes) parts.push(`${keyTypes} key type${keyTypes === 1 ? "" : "s"}`);
+  if (routes) parts.push(mcp ? `${routes} MCP tools` : `${routes} route${routes === 1 ? "" : "s"}`);
+  return parts.join(", ");
+}
+function printSection(title, value) {
+  console.log(import_chalk25.default.bold(`  ${title}`));
+  console.log(indent(JSON.stringify(value ?? null, null, 2), "    "));
+  console.log();
+}
+function printAuth(recipe) {
+  const a = recipe.auth ?? { app_client: null, provider: null, key_types: [] };
+  console.log(import_chalk25.default.bold("  auth"));
+  if (a.provider) {
+    console.log(`    ${import_chalk25.default.dim("provider    ")} ${a.provider.type ?? "(unknown)"}`);
+    if (a.provider.scopes) console.log(`    ${import_chalk25.default.dim("scopes      ")} ${a.provider.scopes}`);
+    if (a.provider.target_server_token) console.log(`    ${import_chalk25.default.dim("sends to API")} ${a.provider.target_server_token}`);
+    console.log(import_chalk25.default.dim("    (no credentials travel in a recipe \u2014 install asks you for your own)"));
+  } else {
+    console.log(import_chalk25.default.dim("    no login provider \u2014 consumers call it with an API key"));
+  }
+  if (a.app_client) {
+    console.log(`    ${import_chalk25.default.dim("login app   ")} ${a.app_client.name ?? "(unnamed)"}`);
+  }
+  if (a.key_types?.length) {
+    console.log(`    ${import_chalk25.default.dim("key types   ")} ${a.key_types.map((k) => String(k.name)).join(", ")}`);
+  }
+  console.log();
+}
+function printTransforms(recipe) {
+  const rules = recipe.transformations?.rules ?? [];
+  const tables = recipe.transformations?.mapping_tables ?? [];
+  console.log(import_chalk25.default.bold(`  transforms (${rules.length})`));
+  for (const r of rules) {
+    const off = r.enabled === false ? import_chalk25.default.dim(" (disabled)") : "";
+    console.log(`    ${import_chalk25.default.bold(String(r.name ?? "(unnamed)"))}  ${import_chalk25.default.dim(String(r.phase ?? "request"))}${off}`);
+    console.log(indent(JSON.stringify(r.action ?? null, null, 2), "      "));
+    if (r.condition) console.log(indent(`when ${JSON.stringify(r.condition)}`, "      "));
+  }
+  if (tables.length) {
+    console.log();
+    console.log(import_chalk25.default.bold(`  mapping tables (${tables.length})`));
+    for (const t of tables) {
+      const entries2 = Array.isArray(t.entries) ? t.entries.length : 0;
+      console.log(`    ${import_chalk25.default.bold(String(t.name ?? "(unnamed)"))}  ${import_chalk25.default.dim(`${entries2} entr${entries2 === 1 ? "y" : "ies"}`)}`);
+    }
+  }
+  console.log();
+}
+function indent(text, pad) {
+  return text.split("\n").map((l) => `${pad}${l}`).join("\n");
+}
+
+// src/commands/recipe-install.ts
 var import_chalk26 = __toESM(require("chalk"));
+init_types();
+init_caller();
+init_api();
+var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
+async function runRecipeInstall(nameArg, opts) {
+  const ref = parseRecipeRef(nameArg);
+  const assumeYes = !!opts.yes;
+  const interactive = !!process.stdin.isTTY && !assumeYes;
+  const caller = requireCallerForInstall();
+  const recipe = await fetchRecipeFile(ref, caller);
+  const pinned = `${recipe.name}@${recipe.revision}`;
+  const picked = await chooseTeam(caller, opts.team, interactive);
+  const teamId = picked.teamId;
+  const chosenTeamId = picked.chosen ? picked.teamId : void 0;
+  const teamName = picked.teamName;
+  console.log();
+  console.log(`${import_chalk26.default.bold(pinned)}${import_chalk26.default.dim(` \u2014 by ${ref.handle}`)}`);
+  if (recipe.summary) console.log(`  ${recipe.summary}`);
+  console.log();
+  let project;
+  let apiVersion;
+  let tenant2;
+  let reinstall = false;
+  if (opts.into) {
+    reinstall = true;
+    const target = normalizeName2(opts.into);
+    const proj2 = await resolveProjectVia(caller, teamId, target, opts.apiversion);
+    project = proj2.projectId;
+    apiVersion = proj2.apiVersion;
+    tenant2 = await resolveReinstallTenant(caller, project, apiVersion);
+    await confirmReinstall(recipe, project, tenant2, interactive);
+  } else {
+    project = await chooseProxyName(ref.slug, opts.as, teamId, interactive);
+    apiVersion = recipe.api_version || "1.0.0";
+    tenant2 = `${project}users`;
+    await assertTenantFree(tenant2, teamId);
+    printSummary(recipe, project, tenant2);
+    if (!assumeYes && !await confirmYesNo("  continue?", interactive)) {
+      console.log(import_chalk26.default.yellow("  Cancelled \u2014 nothing was created."));
+      return;
+    }
+  }
+  const ctx = { project, tenant: tenant2 };
+  const declined = assumeYes ? declineAll(recipe.requires_confirmation ?? []) : await askConsent(recipe.requires_confirmation ?? [], interactive);
+  const answers = await askQuestions(recipe.questions ?? [], ctx, interactive);
+  const started = Date.now();
+  const steps = buildSteps({ recipe, caller, teamId, chosenTeamId, teamName, ctx, answers, declined, apiVersion, reinstall, pinned });
+  console.log();
+  for (const step of steps) {
+    if (step.skip) continue;
+    process.stdout.write(`  ${step.label.padEnd(33)}`);
+    try {
+      const note = await step.run();
+      console.log(`${import_chalk26.default.green("\u2713")}${note ? `  ${import_chalk26.default.dim(note)}` : ""}`);
+    } catch (err) {
+      console.log(`${import_chalk26.default.red("\u2717")}  ${import_chalk26.default.red(describeError(err))}`);
+      console.log();
+      if (step.n === 1) {
+        console.log(import_chalk26.default.red(`stopped at step 1 of ${steps.length}. Nothing was created.`));
+        console.log("run the same command again once the problem above is fixed:");
+        console.log(import_chalk26.default.cyan(`    npx apiblaze install ${nameArg}`));
+      } else {
+        console.log(import_chalk26.default.red(`stopped at step ${step.n} of ${steps.length}. ${project} exists but is not finished.`));
+        console.log("continue with:");
+        console.log(import_chalk26.default.cyan(`    npx apiblaze install ${nameArg} --into ${project}`));
+      }
+      console.log();
+      process.exit(1);
+    }
+  }
+  const secs = ((Date.now() - started) / 1e3).toFixed(0);
+  const urls = installUrls(ctx);
+  console.log();
+  console.log(`done in ${secs}s.`);
+  console.log(`  ${import_chalk26.default.dim("proxy ")} ${import_chalk26.default.bold(urls.proxy_url)}`);
+  if (recipe.settings.mcp_enabled === true) console.log(`  ${import_chalk26.default.dim("mcp   ")} ${import_chalk26.default.bold(urls.mcp_url)}`);
+  if (recipe.settings.enable_portal === true) console.log(`  ${import_chalk26.default.dim("portal")} ${import_chalk26.default.bold(urls.portal_url)}`);
+  console.log();
+}
+function buildSteps(inp) {
+  const { recipe, caller, ctx, answers, declined, reinstall, pinned } = inp;
+  const { project, tenant: tenant2 } = ctx;
+  let teamId = inp.teamId;
+  const { chosenTeamId, teamName } = inp;
+  const filled = fillAnswers(
+    {
+      settings: recipe.settings ?? {},
+      auth: recipe.auth ?? { app_client: null, provider: null, key_types: [] },
+      transformations: recipe.transformations ?? { rules: [], mapping_tables: [] },
+      openapi: recipe.openapi ?? null
+    },
+    answers
+  );
+  let apiVersion = inp.apiVersion;
+  const rules = (filled.transformations.rules ?? []).filter((r) => !declined.has(`transform:${String(r.name ?? "")}`));
+  const tables = filled.transformations.mapping_tables ?? [];
+  const keyTypes = filled.auth.key_types ?? [];
+  const routes = countRoutes(filled.openapi);
+  return [
+    {
+      n: 1,
+      label: `creating ${project}`,
+      skip: reinstall,
+      run: async () => {
+        const target = firstUpstream(recipe);
+        if (!target) throw new Error("this recipe carries no upstream URL, so there is nothing to create a proxy against");
+        const out = await producer(caller, {
+          method: "POST",
+          path: "/projects",
+          body: {
+            name: project,
+            target,
+            tenant: tenant2,
+            product_slug: project,
+            api_version: apiVersion,
+            auth_type: "api_key",
+            // Sent so a chosen team is honoured. create-project.ts:919 IGNORES an
+            // unauthorized team_id and silently substitutes the caller's default,
+            // returning 201 — so the landing team is verified below rather than
+            // assumed. Without that check "install into team B" could quietly
+            // create the proxy in team A.
+            team_id: chosenTeamId
+          },
+          summary: `Create proxy ${project} (tenant ${tenant2}) from ${pinned}`
+        });
+        if (out?.api_version) apiVersion = out.api_version;
+        const landed = await owningTeam(caller, project, teamId);
+        if (chosenTeamId && landed !== chosenTeamId) {
+          throw new Error(
+            `${project} was created in a different team than you chose. You may not have permission to create proxies there \u2014 delete it and re-run with a team you belong to.`
+          );
+        }
+        teamId = landed;
+        const landedName = teamName ?? await teamLabel(caller, landed);
+        return landedName ? `proxy + tenant in ${landedName}` : "proxy + tenant";
+      }
+    },
+    {
+      n: 2,
+      label: `recording ${pinned}`,
+      run: async () => {
+        await producer(caller, {
+          method: "PATCH",
+          path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}/installed`,
+          body: { installed_from: pinned, installed_tenant: tenant2 },
+          summary: `Stamp provenance ${pinned} on ${project}`
+        });
+        return "provenance";
+      }
+    },
+    {
+      n: 3,
+      label: "settings and environments",
+      run: async () => {
+        const s = filled.settings;
+        const body = {};
+        if (!declined.has("kind:upstream") && s.environments) body.environments = s.environments;
+        if (!declined.has("kind:quota") && s.throttling) body.throttling = s.throttling;
+        if (!declined.has("kind:cors") && s.cors !== void 0) body.cors = s.cors;
+        if (!declined.has("kind:request policy") && s.requests_policy) body.requests_policy = s.requests_policy;
+        if (!declined.has("kind:dev portal") && typeof s.enable_portal === "boolean") body.enable_portal = s.enable_portal;
+        if (!declined.has("kind:mcp server") && typeof s.mcp_enabled === "boolean") body.mcp_enabled = s.mcp_enabled;
+        if (typeof s.project_display_name === "string") body.display_name = s.project_display_name;
+        if (typeof s.publish_openapi === "boolean") body.publish_openapi = s.publish_openapi;
+        if (!Object.keys(body).length) return "nothing to apply";
+        await producer(caller, {
+          method: "PATCH",
+          path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}`,
+          body,
+          summary: `Apply recipe settings to ${project}`
+        });
+        return Object.keys(body).join(", ");
+      }
+    },
+    {
+      n: 4,
+      label: providerLabel(filled.auth.provider),
+      skip: !filled.auth.provider,
+      run: async () => {
+        const p = filled.auth.provider;
+        const clientId = answers.oauth_client_id;
+        const clientSecret = answers.oauth_client_secret;
+        if (!clientId || !clientSecret) {
+          throw new Error("the OAuth client id and secret were not supplied, so the login provider cannot be created");
+        }
+        const appClientId = await defaultAppClientId(caller, teamId, tenant2);
+        await producer(caller, {
+          method: "POST",
+          path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients/${encodeURIComponent(appClientId)}/providers`,
+          body: {
+            type: p.type,
+            clientId,
+            clientSecret,
+            scopes: p.scopes,
+            tokenType: p.token_type,
+            targetServerToken: p.target_server_token,
+            includeApiblazeAccessTokenHeader: p.include_apiblaze_access_token_header === true,
+            includeApiblazeIdTokenHeader: p.include_apiblaze_id_token_header === true
+          },
+          summary: `Create the ${String(p.type)} login provider on ${tenant2}`
+        });
+        return String(p.type);
+      }
+    },
+    {
+      n: 5,
+      label: keyTypes.length ? `${keyTypes.length} key type${keyTypes.length === 1 ? "" : "s"}` : "key types",
+      skip: !keyTypes.length,
+      run: async () => {
+        let added = 0;
+        let existed = 0;
+        await withCpKey(caller, teamId, async (cpKey) => {
+          for (const kt of keyTypes) {
+            const scopes = parseMaybeJson(kt.scopes_json);
+            const res = await fetch(`${APIKEYS_BASE}/key-types?product=apiblaze&tenant=${encodeURIComponent(tenant2)}`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json", "X-API-Key": cpKey },
+              body: JSON.stringify({
+                tenant: tenant2,
+                name: kt.name,
+                scopes: Array.isArray(scopes) ? scopes : [],
+                ...kt.default_expires_at_seconds != null ? { default_expires_at_seconds: kt.default_expires_at_seconds } : {}
+              })
+            });
+            if (res.status === 409) {
+              existed++;
+              continue;
+            }
+            if (!res.ok) {
+              const body = await res.json().catch(() => ({}));
+              const msg = typeof body.error === "string" ? body.error : body.error?.message;
+              throw new ApiError(res.status, `key type "${String(kt.name)}": ${msg ?? res.statusText}`);
+            }
+            added++;
+          }
+        });
+        return existed ? `${added} added, ${existed} already there` : `${added} added`;
+      }
+    },
+    {
+      n: 6,
+      label: transformsLabel(rules.length, tables.length),
+      skip: !rules.length && !tables.length,
+      run: async () => {
+        for (const t of tables) {
+          await producer(caller, {
+            method: "POST",
+            path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}/mappings`,
+            body: { name: t.name, entries: t.entries ?? [], encrypt_values: t.encrypt_values === true },
+            summary: `Create mapping table "${String(t.name)}"`
+          }).catch((err) => {
+            throw wrap(err, `mapping table "${String(t.name)}"`);
+          });
+        }
+        for (const r of rules) {
+          await producer(caller, {
+            method: "POST",
+            path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}/transforms`,
+            // The recipe carries `ord`; the create route reads `order`.
+            body: {
+              name: r.name,
+              action: r.action,
+              phase: r.phase ?? "request",
+              enabled: r.enabled !== false,
+              ...r.ord != null ? { order: r.ord } : {},
+              ...r.condition ? { condition: r.condition } : {}
+            },
+            summary: `Create transform rule "${String(r.name)}"`
+          }).catch((err) => {
+            throw wrap(err, `rule "${String(r.name)}"`);
+          });
+        }
+        return void 0;
+      }
+    },
+    {
+      n: 7,
+      label: routes ? `API spec \u2192 ${routes} routes${filled.settings.mcp_enabled === true ? ", MCP tools" : ""}` : "API spec",
+      skip: !filled.openapi,
+      run: async () => {
+        const out = await producer(caller, {
+          method: "POST",
+          path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}/refresh-spec`,
+          body: { specContent: JSON.stringify(filled.openapi) },
+          summary: `Install the recipe's OpenAPI spec on ${project}`
+        });
+        const added = out?.report?.routes?.added?.length ?? routes;
+        return out?.report?.applied?.mcp_regenerated ? `${added} routes, MCP rebuilt` : `${added} routes`;
+      }
+    }
+  ];
+}
+function providerLabel(provider) {
+  if (!provider) return "login provider";
+  const t = String(provider.type ?? "oauth");
+  return `${t.charAt(0).toUpperCase()}${t.slice(1)} provider`;
+}
+function transformsLabel(rules, tables) {
+  const parts = [];
+  if (rules) parts.push(`${rules} transform${rules === 1 ? "" : "s"}`);
+  if (tables) parts.push(`${tables} mapping table${tables === 1 ? "" : "s"}`);
+  return parts.join(", ") || "transforms";
+}
+function parseMaybeJson(v) {
+  if (typeof v !== "string") return v;
+  try {
+    return JSON.parse(v);
+  } catch {
+    return v;
+  }
+}
+function wrap(err, what) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return new Error(`${what}: ${msg}`);
+}
+function describeError(err) {
+  if (err instanceof ApiError) {
+    const body = err.body;
+    return `${err.message}${body?.details && body.details !== err.message ? ` \u2014 ${body.details}` : ""}`;
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+async function withCpKey(caller, teamId, fn) {
+  if (caller.mode === "anon" && caller.cpKey) return fn(caller.cpKey);
+  const minted = await producer(caller, {
+    method: "POST",
+    path: `/teams/${encodeURIComponent(teamId)}/developer-keys`,
+    body: { description: "apiblaze install (temporary)", expires_in_seconds: 300 },
+    summary: "Mint a 5-minute control-plane key for the key-types step"
+  });
+  if (!minted?.key) throw new Error("could not mint a control-plane key for the key-types step");
+  try {
+    return await fn(minted.key);
+  } finally {
+    if (minted.key_id) {
+      await producer(caller, {
+        method: "DELETE",
+        path: `/teams/${encodeURIComponent(teamId)}/developer-keys/${encodeURIComponent(minted.key_id)}`,
+        summary: "Revoke the temporary control-plane key"
+      }).catch(() => {
+      });
+    }
+  }
+}
+async function teamLabel(caller, teamId) {
+  if (caller.mode === "anon") return null;
+  const teams = await getTeams().catch(() => []);
+  return teams.find((t) => t.teamId === teamId)?.name ?? null;
+}
+async function owningTeam(caller, project, preferred) {
+  const has = async (teamId) => {
+    const out = await producer(caller, {
+      method: "GET",
+      path: `/projects?team_id=${encodeURIComponent(teamId)}`,
+      summary: `Confirm ${project} landed in ${teamId}`
+    }).catch(() => ({ projects: [] }));
+    return (out?.projects ?? []).some((p) => p.project_id === project);
+  };
+  if (await has(preferred)) return preferred;
+  if (caller.mode === "anon") return preferred;
+  const { getTeams: getTeams2 } = await Promise.resolve().then(() => (init_api(), api_exports));
+  const teams = await getTeams2().catch(() => []);
+  for (const t of teams) {
+    if (t.teamId !== preferred && await has(t.teamId)) return t.teamId;
+  }
+  return preferred;
+}
+async function defaultAppClientId(caller, teamId, tenant2) {
+  const out = await producer(caller, {
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`,
+    summary: `Find the login app for ${tenant2}`
+  });
+  const list = Array.isArray(out) ? out : out?.app_clients ?? out?.clients ?? [];
+  const chosen = list.find((c) => c.is_default === true || c.default === true) ?? list[0];
+  const id = chosen?.client_id ?? chosen?.id;
+  if (typeof id !== "string" || !id) {
+    throw new Error(`tenant ${tenant2} has no login app to attach the provider to`);
+  }
+  return id;
+}
+async function nameIsFree(name, teamId) {
+  try {
+    const check = await checkProxyName(name, teamId);
+    return check.canUseProjectName && check.canUseApiVersion;
+  } catch {
+    return null;
+  }
+}
+async function chooseProxyName(slug, asOpt, teamId, interactive) {
+  if (asOpt !== void 0) {
+    const name = normalizeName2(asOpt);
+    if (name !== asOpt) console.log(import_chalk26.default.yellow(`  Using "${name}" \u2014 names are lowercase letters and digits only.`));
+    if (name.length < 3) throw new Error("A proxy name must be at least 3 characters (lowercase letters and digits only).");
+    const free = await nameIsFree(name, teamId);
+    if (free === false) throw new Error(`"${name}" is already taken. Pick another with --as.`);
+    return name;
+  }
+  const base2 = normalizeName2(`my${slug}`) || normalizeName2(slug);
+  let suggested = base2;
+  for (let i = 1; i <= 20; i++) {
+    const candidate = i === 1 ? base2 : `${base2}${i}`;
+    if (await nameIsFree(candidate, teamId) !== false) {
+      suggested = candidate;
+      break;
+    }
+  }
+  if (!interactive) return suggested;
+  const { default: inquirer3 } = await import("inquirer");
+  console.log(`  ${import_chalk26.default.dim("proxy")}   ${slug} \u2192 ${import_chalk26.default.bold(suggested)}   ${import_chalk26.default.dim("[enter to accept, or type a name]")}`);
+  for (; ; ) {
+    const { raw } = await inquirer3.prompt([{
+      type: "input",
+      name: "raw",
+      message: ">",
+      default: suggested,
+      transformer: (v) => normalizeName2(v)
+    }]);
+    const name = normalizeName2(raw);
+    if (name !== String(raw).trim()) {
+      console.log(import_chalk26.default.yellow(`  \u2192 using ${import_chalk26.default.bold(name)} (lowercase letters and digits only)`));
+    }
+    if (name.length < 3) {
+      console.log(import_chalk26.default.yellow("  Name must be at least 3 characters.\n"));
+      continue;
+    }
+    const free = await nameIsFree(name, teamId);
+    if (free === false) {
+      console.log(import_chalk26.default.yellow(`  "${name}" is taken. Try another.
+`));
+      continue;
+    }
+    if (free === null) console.log(import_chalk26.default.dim("  (could not verify availability; continuing)"));
+    console.log(`  ${import_chalk26.default.cyan("\u2192")} ${import_chalk26.default.bold(`https://${name}.abz.run`)}  ${import_chalk26.default.dim(`users live in the tenant ${name}users`)}`);
+    return name;
+  }
+}
+async function assertTenantFree(tenant2, teamId) {
+  if (await nameIsFree(tenant2, teamId) === false) {
+    throw new Error(
+      `The tenant name "${tenant2}" is already taken, so this proxy name cannot be used.
+       Pick a different proxy name (the tenant is always <proxy>users).`
+    );
+  }
+}
+function printSummary(recipe, project, tenant2) {
+  const hosts = upstreamHosts(recipe);
+  const routes = countRoutes(recipe.openapi);
+  const keyTypes = recipe.auth?.key_types?.length ?? 0;
+  const questions = recipe.questions?.length ?? 0;
+  console.log();
+  if (hosts.length) console.log(`  ${import_chalk26.default.dim("sends requests to")}  ${hosts.join(", ")}`);
+  console.log(`  ${import_chalk26.default.dim("creates          ")}  ${describeCreates(keyTypes, routes, recipe.settings.mcp_enabled === true)}`);
+  console.log(`  ${import_chalk26.default.dim("asks you for     ")}  ${questions} value${questions === 1 ? "" : "s"}`);
+  if (recipe.settings.publish_openapi === true) {
+    console.log(`  ${import_chalk26.default.dim("makes public     ")}  this API's spec, at ${project}.abz.run/${recipe.api_version}/openapi.json`);
+  }
+  console.log(import_chalk26.default.dim(`  ${"users live in".padEnd(17)}  ${tenant2}`));
+  console.log();
+}
+function declineAll(items) {
+  const skippable = items.filter((i) => i.kind !== "upstream");
+  const upstreams = items.filter((i) => i.kind === "upstream");
+  console.log();
+  for (const u of upstreams) {
+    console.log(import_chalk26.default.yellow(`  --yes: this proxy sends every request to ${import_chalk26.default.bold(u.value)}.`));
+  }
+  if (skippable.length) {
+    console.log(import_chalk26.default.yellow(`  --yes: installing without ${skippable.length} setting${skippable.length === 1 ? "" : "s"} that need consent.`));
+    for (const i of skippable) console.log(import_chalk26.default.dim(`    skipped  ${i.kind}  ${i.value}`));
+  }
+  return new Set(skippable.map((i) => i.kind));
+}
+async function confirmYesNo(message, interactive) {
+  if (!interactive) {
+    throw new Error(`${message.trim()} needs an answer, but there is no terminal to ask on. Run this from an interactive shell.`);
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  const { ok } = await inquirer3.prompt([{ type: "confirm", name: "ok", message, default: false }]);
+  return !!ok;
+}
+async function askConsent(items, interactive) {
+  const declined = /* @__PURE__ */ new Set();
+  if (!items.length) return declined;
+  const count = items.length;
+  const word = ["", "it", "both", "all three", "all four", "all five", "all six"][count] ?? `all ${count}`;
+  console.log();
+  console.log(import_chalk26.default.yellow("\u26A0 This recipe changes who can reach your proxy, what it trusts, and what it can cost."));
+  console.log();
+  for (const item of items) {
+    console.log(`  ${import_chalk26.default.bold(item.kind.padEnd(16))}  ${item.value}`);
+    for (const line of wrapText(item.why, 62)) console.log(`  ${" ".repeat(16)}  ${import_chalk26.default.dim(line)}`);
+  }
+  console.log();
+  console.log(`Type "${import_chalk26.default.bold("yes")}" to accept ${word}.`);
+  console.log("Press enter to install the recipe without them.");
+  let typed = "";
+  if (interactive) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { answer } = await inquirer3.prompt([{ type: "input", name: "answer", message: ">" }]);
+    typed = String(answer ?? "").trim();
+  }
+  if (typed.toLowerCase() === "yes") return declined;
+  for (const item of items) {
+    declined.add(item.kind === "transform" ? `transform:${item.value}` : `kind:${item.kind}`);
+  }
+  console.log(import_chalk26.default.dim(`  Installing without ${count} setting${count === 1 ? "" : "s"} \u2014 everything else is applied.`));
+  return declined;
+}
+async function askQuestions(questions, ctx, interactive) {
+  const answers = {};
+  if (!questions.length) return answers;
+  for (const q of questions) {
+    const envName = `ABZ_ANSWER_${q.id.toUpperCase()}`;
+    const fromEnv = process.env[envName];
+    if (q.before) {
+      const BOX = 64;
+      const title = "\u2500\u2500 from the publisher ";
+      console.log();
+      console.log(`  ${import_chalk26.default.dim(title + "\u2500".repeat(BOX - title.length))}`);
+      for (const line of fillContext(q.before, ctx).split("\n")) console.log(`  ${import_chalk26.default.dim("\u2502")} ${line}`);
+      console.log(`  ${import_chalk26.default.dim("\u2500".repeat(BOX))}`);
+    }
+    if (fromEnv !== void 0 && fromEnv !== "") {
+      answers[q.id] = fromEnv;
+      console.log(`  ${q.prompt}:  ${import_chalk26.default.dim(`(from ${envName})`)}`);
+      continue;
+    }
+    if (!interactive) {
+      throw new Error(
+        `This recipe needs "${q.prompt}" and there is no terminal to ask on.
+       Set ${envName} in the environment (never as a flag \u2014 a flag lands in shell history and CI logs).`
+      );
+    }
+    const { default: inquirer3 } = await import("inquirer");
+    if (q.example && !q.secret) console.log(import_chalk26.default.dim(`  e.g. ${q.example}`));
+    const { value } = await inquirer3.prompt([{
+      // `secret: true` masks the input — the Google client secret is typed once,
+      // goes to provider creation, and is never echoed or stored.
+      type: q.secret ? "password" : "input",
+      name: "value",
+      mask: "\u2022",
+      message: `  ${q.prompt}:`,
+      validate: (v) => String(v ?? "").trim() ? true : "Required."
+    }]);
+    answers[q.id] = String(value).trim();
+  }
+  return answers;
+}
+async function resolveReinstallTenant(caller, project, apiVersion) {
+  const out = await producer(caller, {
+    method: "GET",
+    path: `/projects/${encodeURIComponent(project)}/${encodeURIComponent(apiVersion)}/tenants`,
+    summary: `List tenants attached to ${project}`
+  });
+  const names = (out?.tenants ?? []).map((t) => typeof t === "string" ? t : t?.tenant_name).filter((t) => typeof t === "string" && !!t);
+  const derived = `${project}users`;
+  if (names.includes(derived)) return derived;
+  if (names.length === 1) return names[0];
+  if (!names.length) throw new Error(`${project} has no tenant attached, so there is nothing to reinstall into.`);
+  throw new Error(
+    `${project} has ${names.length} tenants (${names.join(", ")}) and none of them is ${derived}, so this proxy was not created by an install. Refusing to guess which one the recipe should overwrite.`
+  );
+}
+async function confirmReinstall(recipe, project, tenant2, interactive) {
+  const rules = recipe.transformations?.rules?.length ?? 0;
+  const tables = recipe.transformations?.mapping_tables?.length ?? 0;
+  const routes = countRoutes(recipe.openapi);
+  const keyTypes = recipe.auth?.key_types?.length ?? 0;
+  console.log(`This installs ${import_chalk26.default.bold(`${recipe.name}@${recipe.revision}`)} over ${import_chalk26.default.bold(project)}.`);
+  console.log();
+  console.log(`  ${import_chalk26.default.dim("settings  ".padEnd(16))}replaced`);
+  if (rules || tables) {
+    console.log(`  ${import_chalk26.default.dim("transforms".padEnd(16))}${rules} rule${rules === 1 ? "" : "s"}${tables ? ` and ${tables} mapping table${tables === 1 ? "" : "s"}` : ""} replaced \u2014 your edits to them are lost`);
+  }
+  if (routes) {
+    console.log(`  ${import_chalk26.default.dim("api spec  ".padEnd(16))}replaced, ${routes} routes regenerated${recipe.settings.mcp_enabled === true ? ", MCP rebuilt" : ""}`);
+  }
+  if (keyTypes) {
+    console.log(`  ${import_chalk26.default.dim("key types ".padEnd(16))}${keyTypes} added if missing; existing types left alone`);
+  }
+  console.log();
+  console.log(`  ${import_chalk26.default.dim("unchanged ".padEnd(16))}your API keys, your proxy URL, your users,`);
+  console.log(`  ${" ".repeat(16)}and any tenant other than ${tenant2}`);
+  console.log();
+  console.log(import_chalk26.default.yellow("This cannot be undone."));
+  if (!interactive) {
+    throw new Error("Reinstall needs a typed confirmation and there is no terminal to ask on.");
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  const { typed } = await inquirer3.prompt([{ type: "input", name: "typed", message: `Type the proxy name (${project}) to continue:` }]);
+  if (String(typed ?? "").trim() !== project) {
+    console.log(import_chalk26.default.yellow("Cancelled \u2014 nothing was changed."));
+    process.exit(0);
+  }
+}
+function requireCallerForInstall() {
+  try {
+    return requireCaller();
+  } catch {
+    console.error(import_chalk26.default.red(
+      "Installing writes a proxy into an account, so it needs a credential.\n  Run `apiblaze login`, or `apiblaze create` first (an anonymous workspace works too)."
+    ));
+    process.exit(1);
+  }
+}
+function wrapText(text, width) {
+  const words = (text || "").split(/\s+/).filter(Boolean);
+  const lines = [];
+  let cur = "";
+  for (const w of words) {
+    if (cur && `${cur} ${w}`.length > width) {
+      lines.push(cur);
+      cur = w;
+    } else {
+      cur = cur ? `${cur} ${w}` : w;
+    }
+  }
+  if (cur) lines.push(cur);
+  return lines;
+}
+async function chooseTeam(caller, optTeam, interactive) {
+  if (optTeam) return { ...await resolveActingTeam(caller, optTeam), chosen: true };
+  if (caller.mode === "anon" || !interactive) {
+    return { ...await resolveActingTeam(caller, void 0), chosen: false };
+  }
+  const active = await resolveActingTeam(caller, void 0);
+  const teams = await getTeams().catch(() => []);
+  if (teams.length < 2) return { ...active, chosen: false };
+  const { default: inquirer3 } = await import("inquirer");
+  const { picked } = await inquirer3.prompt([{
+    type: "list",
+    name: "picked",
+    message: "  which team should own this proxy?",
+    default: active.teamId,
+    choices: teams.map((t) => ({
+      name: t.teamId === active.teamId ? `${t.name} ${import_chalk26.default.dim("(active)")}` : t.name,
+      value: t.teamId
+    }))
+  }]);
+  const match = teams.find((t) => t.teamId === picked);
+  return { teamId: picked, teamName: match?.name, chosen: true };
+}
+
+// src/commands/recipe-publish.ts
+var import_chalk27 = __toESM(require("chalk"));
+var import_ora9 = __toESM(require("ora"));
+init_caller();
+init_auth();
+async function runRecipePublish(projectArg, opts) {
+  const creds = loadCredentials();
+  let resolved;
+  try {
+    resolved = resolveRecipeName(opts.as, creds?.githubHandle, normalizeName2(projectArg));
+  } catch (err) {
+    console.error(import_chalk27.default.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+    return;
+  }
+  const ref = resolved.ref;
+  if (resolved.derivedHandle) {
+    console.log(import_chalk27.default.dim(`  publishing as ${import_chalk27.default.bold(ref.name)}`));
+    if (resolved.normalizedFrom) {
+      console.log(import_chalk27.default.dim(`  (your GitHub login is ${resolved.normalizedFrom}; apiblaze names are letters and digits only)`));
+    }
+  }
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, projectArg, opts.apiversion);
+  const spinner = !opts.json ? (0, import_ora9.default)(`Reading ${proj2.projectId} v${proj2.apiVersion}...`).start() : null;
+  let prep;
+  try {
+    prep = await prepare(caller, proj2.projectId, proj2.apiVersion, ref.name, opts.tenant);
+    spinner?.stop();
+  } catch (err) {
+    spinner?.fail("Could not read the proxy.");
+    throw err;
+  }
+  let tenant2 = opts.tenant;
+  if (!prep.tenant_used && prep.tenants.length > 1) {
+    if (!interactive) {
+      console.error(import_chalk27.default.red(
+        `${proj2.projectId} has ${prep.tenants.length} tenants (${prep.tenants.join(", ")}). Pass --tenant <slug> to say which auth setup the recipe carries.`
+      ));
+      process.exit(1);
+    }
+    const { default: inquirer3 } = await import("inquirer");
+    const { picked } = await inquirer3.prompt([{
+      type: "list",
+      name: "picked",
+      choices: prep.tenants,
+      message: "This proxy has several tenants. Which auth setup should the recipe carry?"
+    }]);
+    tenant2 = picked;
+    prep = await prepare(caller, proj2.projectId, proj2.apiVersion, ref.name, tenant2);
+  }
+  if (!prep.name_available) {
+    console.error(import_chalk27.default.red(`${ref.name} belongs to another team, so you cannot publish a revision of it.`));
+    process.exit(1);
+  }
+  if (prep.envelope_violations.length) {
+    printEnvelopeViolations(prep.envelope_violations);
+    process.exit(1);
+  }
+  if (prep.dropped.length) {
+    console.log();
+    console.log(`${prep.dropped.length} setting${prep.dropped.length === 1 ? " was" : "s were"} not included, because they are not on the publish list:`);
+    for (const d of prep.dropped) console.log(import_chalk27.default.dim(`    ${d}`));
+    if (prep.hidden_tables_excluded) {
+      console.log(import_chalk27.default.dim(`  (${prep.hidden_tables_excluded} hidden mapping table${prep.hidden_tables_excluded === 1 ? "" : "s"} excluded \u2014 those values belong to your consumers.)`));
+    }
+    console.log();
+    if (!opts.yes && !await confirm("  continue without them?", interactive)) {
+      console.log(import_chalk27.default.yellow("Cancelled."));
+      return;
+    }
+  }
+  const decisions = {};
+  const promotions = [];
+  console.log();
+  console.log(`checked ${prep.checked_count} values against 12 known patterns. ${prep.findings.length || "none"} need${prep.findings.length === 1 ? "s" : ""} your decision${prep.findings.length ? ":" : "."}`);
+  if (prep.findings.length) {
+    if (opts.yes) {
+      console.log();
+      for (const f of prep.findings) printFinding(f);
+      console.log();
+      console.error(import_chalk27.default.red("--yes cannot accept scanner findings. Fix the value in the proxy, or publish interactively and decide."));
+      process.exit(1);
+    }
+    if (!interactive) {
+      for (const f of prep.findings) printFinding(f);
+      console.error(import_chalk27.default.red("\nThese need a decision and there is no terminal to ask on."));
+      process.exit(1);
+    }
+    const { default: inquirer3 } = await import("inquirer");
+    for (const f of prep.findings) {
+      console.log();
+      printFinding(f);
+      const { verdict } = await inquirer3.prompt([{
+        type: "list",
+        name: "verdict",
+        message: "  ",
+        choices: [
+          { name: "keep it as it is", value: "keep" },
+          { name: "ask the installer for their own value", value: "ask" },
+          { name: "remove it from the recipe", value: "remove" }
+        ]
+      }]);
+      decisions[f.path] = verdict;
+      if (verdict === "ask") promotions.push(await askPromotion(f.path));
+    }
+  }
+  console.log(import_chalk27.default.dim(`we cannot judge the other ${prep.unjudged_count} values. run \`apiblaze show ${ref.name}\` after publishing to read the whole recipe.`));
+  const totalQuestions = prep.question_ids.length + promotions.length;
+  if (totalQuestions > 5) {
+    console.log(import_chalk27.default.yellow(`
+\u26A0 installers will have to supply ${totalQuestions} values before this works.`));
+  }
+  const visibility = opts.private ? "private" : "public";
+  let confirmSpecPublic = false;
+  if (visibility === "public" && prep.spec_will_become_public) {
+    console.log();
+    console.log("Publishing publicly also makes this API's spec readable at");
+    console.log(`  ${import_chalk27.default.bold(`https://${proj2.projectId}.abz.run/${proj2.apiVersion}/openapi.json`)}`);
+    console.log("It is currently private.");
+    confirmSpecPublic = opts.yes ? true : await confirm("Continue?", interactive);
+    if (!confirmSpecPublic) {
+      console.log(import_chalk27.default.yellow("Cancelled \u2014 nothing was published."));
+      return;
+    }
+  }
+  const spin2 = !opts.json ? (0, import_ora9.default)(`Publishing ${ref.name}...`).start() : null;
+  let out;
+  try {
+    out = await producer(caller, {
+      method: "POST",
+      path: "/recipes/publish",
+      body: {
+        project_id: proj2.projectId,
+        api_version: proj2.apiVersion,
+        name: ref.name,
+        visibility,
+        candidate_sha256: prep.candidate_sha256,
+        decisions,
+        promotions,
+        ...opts.displayName ? { display_name: opts.displayName } : {},
+        ...opts.summary ? { summary: opts.summary } : {},
+        ...opts.license ? { license: opts.license } : {},
+        ...tenant2 ? { tenant: tenant2 } : {},
+        ...confirmSpecPublic ? { confirm_spec_public: true } : {}
+      },
+      summary: `Publish ${proj2.projectId} as ${ref.name} (${visibility})`
+    });
+    spin2?.succeed(`Published ${import_chalk27.default.bold(`${out.name}@${out.revision}`)} (${out.visibility}).`);
+  } catch (err) {
+    spin2?.fail("Publish failed.");
+    throw err;
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  console.log(`  ${import_chalk27.default.dim("size    ")} ${(out.size_bytes / 1024).toFixed(1)} KB`);
+  console.log(`  ${import_chalk27.default.dim("checksum")} ${out.sha256.slice(0, 16)}\u2026`);
+  console.log();
+  if (out.visibility === "public") {
+    console.log(import_chalk27.default.dim(`  Anyone can now run: ${import_chalk27.default.cyan(`npx apiblaze install ${out.name}`)}`));
+  } else {
+    console.log(import_chalk27.default.dim("  Private \u2014 only members of this team can see or install it."));
+  }
+  console.log(import_chalk27.default.dim(`  Pull it back with:  ${import_chalk27.default.cyan(`npx apiblaze withdraw ${out.name}@${out.revision}`)}`));
+  console.log();
+}
+async function prepare(caller, projectId, apiVersion, name, tenant2) {
+  return producer(caller, {
+    method: "POST",
+    path: "/recipes/prepare",
+    body: { project_id: projectId, api_version: apiVersion, name, ...tenant2 ? { tenant: tenant2 } : {} },
+    summary: `Prepare ${projectId} v${apiVersion} for publishing as ${name}`
+  });
+}
+function printFinding(f) {
+  const preview = (f.preview ?? "").replace(/\s+/g, " ").trim();
+  console.log(`  ${import_chalk27.default.bold(f.path)}`);
+  console.log(`      ${import_chalk27.default.yellow(preview.padEnd(38))}${import_chalk27.default.dim(f.why)}`);
+}
+function printEnvelopeViolations(violations) {
+  console.log();
+  console.error(import_chalk27.default.red("This proxy has transform rules a recipe cannot carry."));
+  console.log();
+  for (const v of violations) {
+    console.log(`  ${import_chalk27.default.bold(v.rule)}  ${import_chalk27.default.dim(`(${v.kind}s ${v.field})`)}`);
+    console.log(`      ${v.why}`);
+  }
+  console.log();
+  console.log("A recipe runs in a stranger's account, after apiblaze has attached their end user's");
+  console.log("real third-party token, so two rules are absolute:");
+  console.log(`  ${import_chalk27.default.dim("\u2022")} a rule may never READ Authorization, Cookie, or the third-party token headers \u2014`);
+  console.log("    those hold a live credential that works at the provider without apiblaze;");
+  console.log(`  ${import_chalk27.default.dim("\u2022")} a rule may never WRITE an identity header (x-end-user-id and friends) \u2014`);
+  console.log("    those tell the installer's own backend who is calling.");
+  console.log();
+  console.log("Writing Authorization from a question or a fixed value is fine \u2014 that is the");
+  console.log("bring-your-own-key case. Change the rules above, then publish again.");
+  console.log();
+}
+async function askPromotion(path8) {
+  const { default: inquirer3 } = await import("inquirer");
+  const suggestedId = path8.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
+  const answers = await inquirer3.prompt([
+    { type: "input", name: "prompt", message: "  prompt them with:", validate: (v) => v.trim() ? true : "Required." },
+    { type: "input", name: "example", message: "  example:" },
+    { type: "input", name: "before", message: "  before (optional):" },
+    { type: "confirm", name: "secret", message: "  is the answer a secret (hide it while they type)?", default: false },
+    { type: "input", name: "id", message: "  id:", default: suggestedId }
+  ]);
+  const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
+  console.log(import_chalk27.default.dim(`      \u2192 replaced with {{${id}}}`));
+  return {
+    path: path8,
+    id,
+    prompt: String(answers.prompt).trim(),
+    ...answers.example ? { example: String(answers.example).trim() } : {},
+    ...answers.before ? { before: String(answers.before).trim() } : {},
+    secret: answers.secret === true
+  };
+}
+async function confirm(message, interactive) {
+  if (!interactive) return false;
+  const { default: inquirer3 } = await import("inquirer");
+  const { ok } = await inquirer3.prompt([{ type: "confirm", name: "ok", message, default: false }]);
+  return !!ok;
+}
+async function runRecipeWithdraw(nameArg, opts) {
+  const ref = parseRecipeRef(nameArg);
+  if (ref.revision === void 0) {
+    console.error(import_chalk27.default.red(`Name the revision to withdraw, e.g. ${nameArg}@3. Revisions are withdrawn one at a time.`));
+    process.exit(1);
+  }
+  const interactive = !!process.stdin.isTTY && !opts.json;
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const mine = await producer(caller, {
+    method: "GET",
+    path: `/recipes/mine?team_id=${encodeURIComponent(teamId)}`,
+    summary: `List recipes published by ${teamId}`
+  }).catch(() => ({ recipes: [] }));
+  const row = (mine?.recipes ?? []).find((r) => r.name === ref.name);
+  const installs = row?.install_count ?? 0;
+  console.log();
+  console.log(`this permanently deletes revision ${ref.revision}. installs of it will fail.`);
+  if (installs) console.log(`${installs} account${installs === 1 ? "" : "s"} installed it \u2014 rotate any secrets it contained.`);
+  if (interactive) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { typed } = await inquirer3.prompt([{ type: "input", name: "typed", message: `type the recipe name to confirm (${ref.name}):` }]);
+    if (String(typed ?? "").trim() !== ref.name) {
+      console.log(import_chalk27.default.yellow("Cancelled \u2014 nothing was withdrawn."));
+      return;
+    }
+  } else {
+    console.error(import_chalk27.default.red("Withdrawing needs a typed confirmation and there is no terminal to ask on."));
+    process.exit(1);
+  }
+  const spinner = !opts.json ? (0, import_ora9.default)("Withdrawing...").start() : null;
+  let out;
+  try {
+    out = await producer(caller, {
+      method: "DELETE",
+      path: `/recipes/${ref.handle}/${ref.slug}/${ref.revision}`,
+      summary: `Withdraw ${ref.name}@${ref.revision}`
+    });
+    spinner?.stop();
+  } catch (err) {
+    spinner?.fail("Withdraw failed.");
+    throw err;
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  console.log();
+  console.log(
+    out.cache_purged === true ? "withdrawn. cached copies were purged." : `withdrawn. ${out.cache_note ?? "cached copies may be served for a few more minutes"}.`
+  );
+  console.log("rotate any secrets it contained now, not later.");
+  console.log();
+}
+
+// src/commands/logs.ts
+var import_chalk29 = __toESM(require("chalk"));
 init_admin();
 init_auth();
 init_resolve();
 
 // src/lib/log-view.ts
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk28 = __toESM(require("chalk"));
 var readline2 = __toESM(require("readline"));
 function statusColor(status) {
-  if (status < 300) return import_chalk25.default.green;
-  if (status < 400) return import_chalk25.default.blue;
-  if (status < 500) return import_chalk25.default.yellow;
-  return import_chalk25.default.red;
+  if (status < 300) return import_chalk28.default.green;
+  if (status < 400) return import_chalk28.default.blue;
+  if (status < 500) return import_chalk28.default.yellow;
+  return import_chalk28.default.red;
 }
 function methodColor(method) {
   switch ((method || "").toUpperCase()) {
     case "GET":
-      return import_chalk25.default.green;
+      return import_chalk28.default.green;
     case "POST":
-      return import_chalk25.default.blue;
+      return import_chalk28.default.blue;
     case "PUT":
     case "PATCH":
-      return import_chalk25.default.yellow;
+      return import_chalk28.default.yellow;
     case "DELETE":
-      return import_chalk25.default.red;
+      return import_chalk28.default.red;
     default:
-      return import_chalk25.default.white;
+      return import_chalk28.default.white;
   }
 }
 function clock(ts) {
@@ -3346,12 +4625,12 @@ function routeCell(route) {
   return (r.length > ROUTE_W ? `\u2026${r.slice(-(ROUTE_W - 1))}` : r).padEnd(ROUTE_W);
 }
 function formatRow(r) {
-  const time = import_chalk25.default.dim(clock(r.ts));
+  const time = import_chalk28.default.dim(clock(r.ts));
   const method = methodColor(r.method)(String(r.method || "\u2014").padEnd(6));
   const route = routeCell(String(r.route || "\u2014"));
   const status = statusColor(r.status)(String(r.status ?? "\u2014").padStart(3));
-  const ms = import_chalk25.default.dim(`${r.duration_ms}ms`.padStart(8));
-  const step = r.error_step ? import_chalk25.default.dim(` ${r.error_step}`) : "";
+  const ms = import_chalk28.default.dim(`${r.duration_ms}ms`.padStart(8));
+  const step = r.error_step ? import_chalk28.default.dim(` ${r.error_step}`) : "";
   return `${time}  ${method} ${route} ${status} ${ms}${step}`;
 }
 function printRow(r, json) {
@@ -3366,15 +4645,15 @@ var WindowNotices = class {
   note(res) {
     if (res.history_unavailable && !this.saidUnavailable) {
       this.saidUnavailable = true;
-      console.error(import_chalk25.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
+      console.error(import_chalk28.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
     }
     if ((res.history_markers?.length ?? 0) > 0 && !this.saidGap) {
       this.saidGap = true;
-      console.error(import_chalk25.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
+      console.error(import_chalk28.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
     }
     if ((res.dropped_this_hour ?? 0) > 0 && !this.saidDropped) {
       this.saidDropped = true;
-      console.error(import_chalk25.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
+      console.error(import_chalk28.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
     }
   }
 };
@@ -3433,13 +4712,13 @@ async function runTailSession(opts) {
     if (!held.length && !heldRowsDropped && !heldNotesDropped) return;
     const rows = held.filter((h) => h.kind === "row").length;
     const total = rows + heldRowsDropped;
-    if (total) console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
+    if (total) console.log(import_chalk28.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
     for (const h of held) {
       if (h.kind === "row") printRow(h.row, opts.json);
       else console.error(h.msg);
     }
     if (heldRowsDropped || heldNotesDropped) {
-      console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
+      console.log(import_chalk28.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
     }
     held.length = 0;
     heldRowsDropped = 0;
@@ -3453,7 +4732,7 @@ async function runTailSession(opts) {
       activeSocket?.close();
     } catch {
     }
-    if (!opts.json) console.log(import_chalk25.default.dim("\nStopped."));
+    if (!opts.json) console.log(import_chalk28.default.dim("\nStopped."));
     process.exit(0);
   }
   function onKeypress(_s, key) {
@@ -3481,17 +4760,17 @@ async function runTailSession(opts) {
   async function openInspector() {
     if (paused) return;
     if (recent.length === 0) {
-      console.log(import_chalk25.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
+      console.log(import_chalk28.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
       return;
     }
     paused = true;
     unbindKeys();
     try {
       const { default: inquirer3 } = await import("inquirer");
-      console.log(import_chalk25.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
+      console.log(import_chalk28.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
       for (; ; ) {
         const choices = recent.slice(-TAIL_INSPECT_CHOICES).reverse().map((r) => ({ name: formatRow(r), value: r.request_id }));
-        choices.push({ name: import_chalk25.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
+        choices.push({ name: import_chalk28.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
         const { picked } = await inquirer3.prompt([{
           type: "list",
           name: "picked",
@@ -3502,12 +4781,12 @@ async function runTailSession(opts) {
         if (picked === "__resume__") break;
         const row = recent.find((r) => r.request_id === picked);
         if (row) printDetail(row, opts.detail);
-        else console.log(import_chalk25.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
+        else console.log(import_chalk28.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
       }
     } finally {
       paused = false;
       flushHeld();
-      console.log(import_chalk25.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
+      console.log(import_chalk28.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
       bindKeys();
     }
   }
@@ -3517,12 +4796,12 @@ async function runTailSession(opts) {
     if (reconnects >= MAX_RECONNECTS) {
       paused = false;
       flushHeld();
-      console.error(import_chalk25.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
+      console.error(import_chalk28.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
       process.exit(1);
     }
     const delay = Math.min(1e3 * 2 ** reconnects, 15e3);
     reconnects++;
-    diag(import_chalk25.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
+    diag(import_chalk28.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
     setTimeout(() => {
       if (!closed) void connect();
     }, delay);
@@ -3533,7 +4812,7 @@ async function runTailSession(opts) {
       url = await opts.mintTicket();
     } catch (err) {
       if (!everConnected) {
-        console.error(import_chalk25.default.red(`Could not start tail: ${err.message}`));
+        console.error(import_chalk28.default.red(`Could not start tail: ${err.message}`));
         process.exit(1);
       }
       lastFailure = `ticket mint failed: ${err.message}`;
@@ -3546,7 +4825,7 @@ async function runTailSession(opts) {
     } catch (err) {
       lastFailure = `bad tail URL: ${err.message}`;
       if (!everConnected) {
-        console.error(import_chalk25.default.red(`Could not start tail: ${lastFailure}`));
+        console.error(import_chalk28.default.red(`Could not start tail: ${lastFailure}`));
         process.exit(1);
       }
       scheduleReconnect();
@@ -3561,9 +4840,9 @@ async function runTailSession(opts) {
       lastInbound = Date.now();
       lastFailure = "";
       if (isReconnect) {
-        diag(import_chalk25.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
+        diag(import_chalk28.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
       } else {
-        diag(import_chalk25.default.dim(interactive ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
+        diag(import_chalk28.default.dim(interactive ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
       }
       bindKeys();
       pingTimer = setInterval(() => {
@@ -3590,7 +4869,7 @@ async function runTailSession(opts) {
         return;
       }
       if (frame?.type === "ceiling") {
-        diag(import_chalk25.default.yellow(
+        diag(import_chalk28.default.yellow(
           `\u26A0 volume ceiling \u2014 ${Number(frame.dropped_this_hour) || 0} rows dropped this hour; errors keep streaming.`
         ));
         return;
@@ -3670,10 +4949,10 @@ async function fetchPage(fetchWindow3, params, notices) {
       return { rows, nextCursor: res.next_cursor ?? void 0 };
     }
     if (hop >= MAX_EMPTY_HOPS) {
-      console.error(import_chalk25.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
+      console.error(import_chalk28.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
       return { rows: [], nextCursor: res.next_cursor, fuseTripped: true };
     }
-    if (hop === 0) console.error(import_chalk25.default.dim("searching older history\u2026"));
+    if (hop === 0) console.error(import_chalk28.default.dim("searching older history\u2026"));
     cursor = res.next_cursor;
   }
 }
@@ -3713,18 +4992,18 @@ async function runPlainList(opts, notices) {
     }
   }
   if (rows.length === 0) {
-    console.log(import_chalk25.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+    console.log(import_chalk28.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
     return;
   }
   const now = Date.now();
   for (const d of groupIntoDays(rows)) {
-    console.log(import_chalk25.default.bold(dayLabel(d.dayMs, now)));
+    console.log(import_chalk28.default.bold(dayLabel(d.dayMs, now)));
     for (const r of d.rows) console.log(`  ${formatRow(r)}`);
     console.log("");
   }
   const errs = rows.filter((r) => r.status >= 400).length;
   const tail = fuseTripped ? " \xB7 stopped early (long empty span) \u2014 older requests may still exist" : more ? " \xB7 showing the most recent \u2014 `--json` streams the rest" : "";
-  console.log(import_chalk25.default.dim(
+  console.log(import_chalk28.default.dim(
     `${rows.length} request${rows.length === 1 ? "" : "s"} \xB7 ${errs} error${errs === 1 ? "" : "s"}${tail}`
   ));
 }
@@ -3743,7 +5022,7 @@ async function runHistoryBrowser(opts) {
       for (const r of page.rows) console.log(JSON.stringify(r));
       any = any || page.rows.length > 0;
       if (page.fuseTripped || !page.nextCursor) {
-        if (!any && !page.fuseTripped) console.error(import_chalk25.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+        if (!any && !page.fuseTripped) console.error(import_chalk28.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
         return;
       }
       cursor2 = page.nextCursor;
@@ -3764,7 +5043,7 @@ async function runHistoryBrowser(opts) {
     scanRows = first.rows;
     scanCursor = first.nextCursor;
     if (scanRows.length === 0) {
-      console.log(import_chalk25.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+      console.log(import_chalk28.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
       return;
     }
   }
@@ -3775,10 +5054,10 @@ async function runHistoryBrowser(opts) {
     const now2 = Date.now();
     const oldestKey = days[days.length - 1]?.key;
     const choices = days.map((d) => ({
-      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk25.default.red(`  ${d.errors} errors`) : ""}`,
+      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk28.default.red(`  ${d.errors} errors`) : ""}`,
       value: d.key
     }));
-    if (scanCursor) choices.push({ name: import_chalk25.default.dim("\u2026 older days"), value: "__older__" });
+    if (scanCursor) choices.push({ name: import_chalk28.default.dim("\u2026 older days"), value: "__older__" });
     const { chosenDay } = await inquirer3.prompt([{
       type: "list",
       name: "chosenDay",
@@ -3798,7 +5077,7 @@ async function runHistoryBrowser(opts) {
         scanCursor = void 0;
       } else {
         scanCursor = more.nextCursor;
-        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk25.default.dim("That was everything \u2014 no older requests."));
+        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk28.default.dim("That was everything \u2014 no older requests."));
       }
       continue;
     }
@@ -3820,11 +5099,11 @@ async function runHistoryBrowser(opts) {
       cursor
     }, notices);
     if (page.rows.length === 0 && pageRows.length === 0) {
-      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
+      console.log(import_chalk28.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
       return;
     }
     if (page.rows.length === 0) {
-      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
+      console.log(import_chalk28.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
       moreCursor = void 0;
     } else {
       pageRows = page.rows;
@@ -3835,8 +5114,8 @@ async function runHistoryBrowser(opts) {
       name: formatRow(r),
       value: r.request_id
     }));
-    if (moreCursor) choices.push({ name: import_chalk25.default.dim("\u2026 load more"), value: "__more__" });
-    choices.push({ name: import_chalk25.default.dim("quit"), value: "__quit__" });
+    if (moreCursor) choices.push({ name: import_chalk28.default.dim("\u2026 load more"), value: "__more__" });
+    choices.push({ name: import_chalk28.default.dim("quit"), value: "__quit__" });
     for (; ; ) {
       const { picked } = await inquirer3.prompt([{
         type: "list",
@@ -3886,19 +5165,19 @@ function wrapCells(items, width) {
 ${PANE_INDENT}`);
 }
 function renderHeaders(h) {
-  if (!h) return import_chalk25.default.dim("\u2014");
+  if (!h) return import_chalk28.default.dim("\u2014");
   const width = process.stdout.columns || 100;
   if (h.values) {
     const e = Object.entries(h.values);
-    if (!e.length) return import_chalk25.default.dim("none");
+    if (!e.length) return import_chalk28.default.dim("none");
     const rank = (k) => {
       const i = HEADER_PRIORITY.indexOf(k.toLowerCase());
       return i === -1 ? NOISE_HEADER.test(k) ? 999 : 500 : i;
     };
-    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk25.default.dim(k + ":")} ${v}`).join(`
+    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk28.default.dim(k + ":")} ${v}`).join(`
 ${PANE_INDENT}`);
   }
-  if (!h.names?.length) return import_chalk25.default.dim("none");
+  if (!h.names?.length) return import_chalk28.default.dim("none");
   const names = [...h.names];
   const noise = names.filter((n) => NOISE_HEADER.test(n));
   const shown = names.filter((n) => !NOISE_HEADER.test(n)).sort((a, b) => {
@@ -3906,70 +5185,70 @@ ${PANE_INDENT}`);
     const ib = HEADER_PRIORITY.indexOf(b.toLowerCase());
     return (ia === -1 ? 500 : ia) - (ib === -1 ? 500 : ib) || a.localeCompare(b);
   });
-  const body = shown.length ? wrapCells(shown, width) : import_chalk25.default.dim("(all forwarding headers)");
+  const body = shown.length ? wrapCells(shown, width) : import_chalk28.default.dim("(all forwarding headers)");
   const tail = noise.length ? `
-${PANE_INDENT}${import_chalk25.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
-  return `${body}${tail}  ${import_chalk25.default.dim("(names only)")}`;
+${PANE_INDENT}${import_chalk28.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
+  return `${body}${tail}  ${import_chalk28.default.dim("(names only)")}`;
 }
 function renderBody(b) {
-  if (!b) return import_chalk25.default.dim("\u2014");
+  if (!b) return import_chalk28.default.dim("\u2014");
   const meta = [b.content_type, b.size != null ? `${b.size}B` : null, b.truncated ? "truncated" : null].filter(Boolean).join(" \xB7 ");
-  if (b.not_captured) return import_chalk25.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
+  if (b.not_captured) return import_chalk28.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
   const isShape = b.value === void 0 && b.shape !== void 0;
   const content = b.value !== void 0 ? b.value : b.shape;
   if (content === null || content === void 0 || content === "" || content === "empty") {
-    return import_chalk25.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
+    return import_chalk28.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
   }
   const text = typeof content === "string" ? content : JSON.stringify(content, null, 2);
-  const head = isShape ? import_chalk25.default.dim("shape only (values not captured)\n      ") : "";
+  const head = isShape ? import_chalk28.default.dim("shape only (values not captured)\n      ") : "";
   return head + text.split("\n").join("\n      ");
 }
 function pane(title, tone, view, empty) {
   console.log(`  ${tone(title)}`);
   if (empty !== void 0) {
-    console.log(`    ${import_chalk25.default.dim(empty)}`);
+    console.log(`    ${import_chalk28.default.dim(empty)}`);
     return;
   }
   const v = view ?? {};
-  if (v.url) console.log(`    ${import_chalk25.default.dim("target")}   ${v.url}`);
+  if (v.url) console.log(`    ${import_chalk28.default.dim("target")}   ${v.url}`);
   if (v.status != null) {
-    console.log(`    ${import_chalk25.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk25.default.dim(" " + v.status_text) : ""}`);
+    console.log(`    ${import_chalk28.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk28.default.dim(" " + v.status_text) : ""}`);
   }
-  if (v.raw_path) console.log(`    ${import_chalk25.default.dim("path")}     ${v.raw_path}`);
+  if (v.raw_path) console.log(`    ${import_chalk28.default.dim("path")}     ${v.raw_path}`);
   if (v.query && Object.keys(v.query).length) {
-    console.log(`    ${import_chalk25.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
+    console.log(`    ${import_chalk28.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
   }
-  if (v.jwt !== void 0) console.log(`    ${import_chalk25.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
-  console.log(`    ${import_chalk25.default.dim("headers")}  ${renderHeaders(v.headers)}`);
-  console.log(`    ${import_chalk25.default.dim("body")}     ${renderBody(v.body)}`);
+  if (v.jwt !== void 0) console.log(`    ${import_chalk28.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
+  console.log(`    ${import_chalk28.default.dim("headers")}  ${renderHeaders(v.headers)}`);
+  console.log(`    ${import_chalk28.default.dim("body")}     ${renderBody(v.body)}`);
 }
 function printDetail(r, mode = "producer") {
   const v = r.views;
   console.log("");
-  console.log(import_chalk25.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk25.default.dim(`  ${r.duration_ms}ms`));
+  console.log(import_chalk28.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk28.default.dim(`  ${r.duration_ms}ms`));
   const cost = typeof r.cost_cents === "number" && r.cost_cents > 0 ? ` \xB7 ${r.cost_cents}\xA2` : "";
-  console.log(import_chalk25.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
+  console.log(import_chalk28.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
   console.log("");
   if (!v) {
-    console.log(import_chalk25.default.dim("  No view detail captured for this request.\n"));
+    console.log(import_chalk28.default.dim("  No view detail captured for this request.\n"));
     return;
   }
-  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk25.default.cyan, v.request);
+  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk28.default.cyan, v.request);
   if (mode === "producer") {
     pane(
       "Request (after) \u2014 APIblaze \u2192 upstream",
-      import_chalk25.default.cyan,
+      import_chalk28.default.cyan,
       v.forwarded_request,
       v.forwarded_request ? void 0 : "Request did not reach an upstream."
     );
     pane(
       "Response (before) \u2014 upstream \u2192 APIblaze",
-      import_chalk25.default.magenta,
+      import_chalk28.default.magenta,
       v.upstream_response,
       v.upstream_response ? void 0 : "No upstream response."
     );
   }
-  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk25.default.magenta, v.response);
+  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk28.default.magenta, v.response);
   console.log("");
 }
 
@@ -4018,7 +5297,7 @@ async function resolve(projectArg, versionArg, opts) {
   return { projectId, projectName: match.projectName, version: version2, tenant: tenant2 };
 }
 function otherPlaneHint() {
-  if (loadConsumer()) console.log(import_chalk26.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
+  if (loadConsumer()) console.log(import_chalk29.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
 }
 function fetchWindow(projectId, version2, tenant2) {
   return (params) => {
@@ -4037,8 +5316,8 @@ function fetchWindow(projectId, version2, tenant2) {
 async function runLogsTail(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk29.default.bold("API Producer logs") + import_chalk29.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk29.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
   }
   await runTailSession({
@@ -4059,8 +5338,8 @@ async function runLogsTail(projectArg, versionArg, opts) {
 async function runLogsList(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk29.default.bold("API Producer logs") + import_chalk29.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk29.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
     console.log("");
   }
@@ -4074,15 +5353,15 @@ async function runLogsList(projectArg, versionArg, opts) {
 }
 
 // src/commands/consumer-logs.ts
-var import_chalk27 = __toESM(require("chalk"));
+var import_chalk30 = __toESM(require("chalk"));
 init_auth();
 var CONSUMER_LOGS_BASE = process.env.APIBLAZE_CONSUMER_LOGS_BASE || "https://logs.apiblaze.com/consumer";
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk27.default.red("Not logged in as an API Consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk30.default.red("Not logged in as an API Consumer. Run `apiblaze consumer login` first."));
     if (loadCredentials()) {
-      console.error(import_chalk27.default.dim("You're signed in as an API Producer \u2014 for a proxy's full logs run `apiblaze logs <project>`."));
+      console.error(import_chalk30.default.dim("You're signed in as an API Producer \u2014 for a proxy's full logs run `apiblaze logs <project>`."));
     }
     process.exit(1);
   }
@@ -4113,7 +5392,7 @@ async function consumerLogsFetch(session, suffix, init) {
   return data;
 }
 function otherPlaneHint2() {
-  if (loadCredentials()) console.log(import_chalk27.default.dim("  \u2039producer view: apiblaze logs <project>\u203A"));
+  if (loadCredentials()) console.log(import_chalk30.default.dim("  \u2039producer view: apiblaze logs <project>\u203A"));
 }
 function fetchWindow2(session, project) {
   return (params) => {
@@ -4129,8 +5408,8 @@ function fetchWindow2(session, project) {
 async function runConsumerLogsTail(opts) {
   const session = requireConsumer();
   if (!opts.json) {
-    console.log(import_chalk27.default.bold("API Consumer logs") + import_chalk27.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk27.default.dim("cost and upstream details are producer-only and are not sent"));
+    console.log(import_chalk30.default.bold("API Consumer logs") + import_chalk30.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk30.default.dim("cost and upstream details are producer-only and are not sent"));
     otherPlaneHint2();
   }
   await runTailSession({
@@ -4148,8 +5427,8 @@ async function runConsumerLogsTail(opts) {
 async function runConsumerLogsList(opts) {
   const session = requireConsumer();
   if (!opts.json) {
-    console.log(import_chalk27.default.bold("API Consumer logs") + import_chalk27.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk27.default.dim("cost and upstream details are producer-only and are not sent"));
+    console.log(import_chalk30.default.bold("API Consumer logs") + import_chalk30.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk30.default.dim("cost and upstream details are producer-only and are not sent"));
     otherPlaneHint2();
     console.log("");
   }
@@ -4163,14 +5442,14 @@ async function runConsumerLogsList(opts) {
 }
 
 // src/commands/config.ts
-var import_chalk28 = __toESM(require("chalk"));
-var import_ora8 = __toESM(require("ora"));
+var import_chalk31 = __toESM(require("chalk"));
+var import_ora10 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 async function patchConfig(project, opts, body, summary) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora8.default)(summary + "...").start();
+  const spinner = (0, import_ora10.default)(summary + "...").start();
   try {
     const out = await admin({
       method: "PATCH",
@@ -4187,7 +5466,7 @@ async function patchConfig(project, opts, body, summary) {
 }
 async function runTargetSet(project, opts) {
   if (!opts.url) {
-    console.error(import_chalk28.default.red("--url is required."));
+    console.error(import_chalk31.default.red("--url is required."));
     process.exit(1);
   }
   const body = opts.env ? { environments: { [opts.env]: { target: opts.url } } } : { target_url: opts.url };
@@ -4200,45 +5479,45 @@ async function runThrottleSet(project, opts) {
   if (opts.quota !== void 0) throttling.proxyQuota = Number(opts.quota);
   if (opts.period !== void 0) {
     if (!["daily", "weekly", "monthly"].includes(opts.period)) {
-      console.error(import_chalk28.default.red("--period must be daily, weekly, or monthly."));
+      console.error(import_chalk31.default.red("--period must be daily, weekly, or monthly."));
       process.exit(1);
     }
     throttling.quotaPeriod = opts.period;
   }
   if (Object.keys(throttling).length === 0) {
-    console.error(import_chalk28.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
+    console.error(import_chalk31.default.red("Nothing to set. Pass at least one of --rate, --end-user-rate, --quota, --period."));
     process.exit(1);
   }
   await patchConfig(project, opts, { throttling }, `Update throttling ${JSON.stringify(throttling)}`);
 }
 async function runRename(project, opts) {
   if (!opts.displayName) {
-    console.error(import_chalk28.default.red("--display-name is required."));
+    console.error(import_chalk31.default.red("--display-name is required."));
     process.exit(1);
   }
   await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
 }
 
 // src/commands/config-browse.ts
-var import_chalk37 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_chalk40 = __toESM(require("chalk"));
+var import_ora18 = __toESM(require("ora"));
 init_admin();
 init_auth();
 init_resolve();
 
 // src/commands/domain.ts
-var import_chalk29 = __toESM(require("chalk"));
-var import_ora9 = __toESM(require("ora"));
+var import_chalk32 = __toESM(require("chalk"));
+var import_ora11 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
-    console.error(import_chalk29.default.red("--domain is required."));
+    console.error(import_chalk32.default.red("--domain is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora9.default)(`Registering ${opts.domain}...`).start();
+  const spinner = (0, import_ora11.default)(`Registering ${opts.domain}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -4252,9 +5531,9 @@ async function runDomainAdd(project, opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    if (out?.cnameRecord) console.log(`  ${import_chalk29.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
-    if (out?.dcv) console.log(`  ${import_chalk29.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
-    if (out?.id) console.log(import_chalk29.default.dim(`  domain id: ${out.id}`));
+    if (out?.cnameRecord) console.log(`  ${import_chalk32.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
+    if (out?.dcv) console.log(`  ${import_chalk32.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (out?.id) console.log(import_chalk32.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
     spinner.fail("Domain registration failed.");
     throw err;
@@ -4274,14 +5553,14 @@ async function runDomainList(project, opts) {
     return;
   }
   if (!domains.length) {
-    console.log(import_chalk29.default.yellow("No custom domains."));
+    console.log(import_chalk32.default.yellow("No custom domains."));
     return;
   }
-  for (const d of domains) console.log(`  ${import_chalk29.default.bold(d.hostname)}  ${import_chalk29.default.dim(d.status ?? "")}  ${import_chalk29.default.dim(d.id ?? "")}`);
+  for (const d of domains) console.log(`  ${import_chalk32.default.bold(d.hostname)}  ${import_chalk32.default.dim(d.status ?? "")}  ${import_chalk32.default.dim(d.id ?? "")}`);
 }
 async function runDomainStatus(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk29.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk32.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
@@ -4291,16 +5570,16 @@ async function runDomainStatus(project, opts) {
     path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
-  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk29.default.bold(out?.hostname ?? opts.id)}: ${import_chalk29.default.cyan(out?.status ?? "unknown")}`);
+  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk32.default.bold(out?.hostname ?? opts.id)}: ${import_chalk32.default.cyan(out?.status ?? "unknown")}`);
 }
 async function runDomainRemove(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk29.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk32.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora9.default)("Removing domain...").start();
+  const spinner = (0, import_ora11.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
@@ -4317,7 +5596,7 @@ async function runDomainSetBase(project, opts) {
   const env = opts.env ?? "prod";
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora9.default)("Setting base domain...").start();
+  const spinner = (0, import_ora11.default)("Setting base domain...").start();
   try {
     await admin({
       method: "PUT",
@@ -4333,8 +5612,8 @@ async function runDomainSetBase(project, opts) {
 }
 
 // src/commands/tenant.ts
-var import_chalk32 = __toESM(require("chalk"));
-var import_ora12 = __toESM(require("ora"));
+var import_chalk35 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -4342,20 +5621,20 @@ init_tenant_pick();
 async function runTenantUse(query, opts) {
   const creds = loadCredentials();
   if (!creds) {
-    console.error(import_chalk32.default.red("Not logged in. Run `apiblaze login` first."));
+    console.error(import_chalk35.default.red("Not logged in. Run `apiblaze login` first."));
     process.exit(1);
   }
   if (opts.clear) {
     delete creds.activeTenant;
     saveCredentials(creds);
-    console.log(import_chalk32.default.green("Tenant scope cleared."));
+    console.log(import_chalk35.default.green("Tenant scope cleared."));
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
   const slug = await pickTenant(teamId, { message: "Scope future commands to which tenant?", initialQuery: query });
   if (!slug) process.exit(1);
   saveCredentials({ ...creds, activeTenant: slug });
-  console.log(import_chalk32.default.green(`Tenant scope set to ${import_chalk32.default.bold(slug)}.`) + import_chalk32.default.dim("  (clear with `apiblaze tenant use --clear`)"));
+  console.log(import_chalk35.default.green(`Tenant scope set to ${import_chalk35.default.bold(slug)}.`) + import_chalk35.default.dim("  (clear with `apiblaze tenant use --clear`)"));
 }
 async function runTenantList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -4372,26 +5651,26 @@ async function runTenantList(opts) {
     return;
   }
   if (!tenants.length) {
-    console.log(import_chalk32.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
+    console.log(import_chalk35.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
     return;
   }
   for (const t of tenants) {
     const name = typeof t === "string" ? t : t.tenant_name;
-    const display = typeof t === "string" ? "" : import_chalk32.default.dim(`  ${t.display_name ?? ""}`);
-    console.log(`  ${import_chalk32.default.bold(name)}${display}`);
+    const display = typeof t === "string" ? "" : import_chalk35.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk35.default.bold(name)}${display}`);
   }
   const total = out?.total ?? tenants.length;
   if (total > tenants.length) {
-    console.log(import_chalk32.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
+    console.log(import_chalk35.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
   }
 }
 async function runTenantCreate(opts) {
   if (!opts.name) {
-    console.error(import_chalk32.default.red("--name (display name) is required."));
+    console.error(import_chalk35.default.red("--name (display name) is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora12.default)("Creating tenant...").start();
+  const spinner = (0, import_ora14.default)("Creating tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -4399,7 +5678,7 @@ async function runTenantCreate(opts) {
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
       summary: `Create tenant "${opts.name}"`
     });
-    spinner.succeed(`Created tenant ${import_chalk32.default.bold(out?.tenant_name ?? opts.name)}.`);
+    spinner.succeed(`Created tenant ${import_chalk35.default.bold(out?.tenant_name ?? opts.name)}.`);
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Tenant create failed.");
@@ -4408,12 +5687,12 @@ async function runTenantCreate(opts) {
 }
 async function runTenantAttach(project, opts) {
   if (!opts.tenant) {
-    console.error(import_chalk32.default.red("--tenant <slug> is required."));
+    console.error(import_chalk35.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora12.default)("Attaching tenant...").start();
+  const spinner = (0, import_ora14.default)("Attaching tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -4432,15 +5711,15 @@ async function runTenantDelete(slug, opts) {
   const { teamId } = await resolveTeam(opts.team);
   if (!opts.yes && !opts.json) {
     const { default: inquirer3 } = await import("inquirer");
-    const { confirm } = await inquirer3.prompt([
+    const { confirm: confirm2 } = await inquirer3.prompt([
       { type: "confirm", name: "confirm", message: `Permanently delete tenant "${slug}" and everything under it? This cannot be undone.`, default: false }
     ]);
-    if (!confirm) {
-      console.log(import_chalk32.default.dim("Aborted."));
+    if (!confirm2) {
+      console.log(import_chalk35.default.dim("Aborted."));
       return;
     }
   }
-  const spinner = (0, import_ora12.default)("Deleting tenant...").start();
+  const spinner = (0, import_ora14.default)("Deleting tenant...").start();
   try {
     await admin({
       method: "DELETE",
@@ -4455,13 +5734,13 @@ async function runTenantDelete(slug, opts) {
 }
 async function runTenantCors(opts) {
   if (!opts.tenant) {
-    console.error(import_chalk32.default.red("--tenant <slug> is required."));
+    console.error(import_chalk35.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   const cors = origins.length ? { allowed_origins: origins } : null;
-  const spinner = (0, import_ora12.default)("Updating CORS...").start();
+  const spinner = (0, import_ora14.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
@@ -4477,8 +5756,8 @@ async function runTenantCors(opts) {
 }
 
 // src/commands/tenant-drill.ts
-var import_chalk33 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_chalk36 = __toESM(require("chalk"));
+var import_ora15 = __toESM(require("ora"));
 var import_crypto = require("crypto");
 init_admin();
 init_auth();
@@ -4508,17 +5787,17 @@ async function validScopedTenant(teamId, query) {
   const next = { ...creds };
   delete next.activeTenant;
   saveCredentials2(next);
-  console.log(import_chalk33.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
+  console.log(import_chalk36.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
   return void 0;
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer3 } = await import("inquirer");
   const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
-  console.log(import_chalk33.default.bold(`
+  console.log(import_chalk36.default.bold(`
 Tenant ${tenant2}`));
-  console.log(import_chalk33.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
+  console.log(import_chalk36.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
-    const spinner = (0, import_ora13.default)("Reading tenant state...").start();
+    const spinner = (0, import_ora15.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
       admin({ method: "GET", path: `${base2}/iam`, summary: "Read IAM toggle" }).catch(() => null),
       admin({ method: "GET", path: `${base2}/cors`, summary: "Read tenant CORS" }).catch(() => null),
@@ -4532,18 +5811,18 @@ Tenant ${tenant2}`));
     const nClients = Array.isArray(clients) ? clients.length : 0;
     const nOpaque = opaque?.opaque?.endpoint ? 1 : 0;
     const nLogin = nClients + nIssuers + nOpaque;
-    const onOff = (b) => b ? import_chalk33.default.green("on") : import_chalk33.default.dim("off");
+    const onOff = (b) => b ? import_chalk36.default.green("on") : import_chalk36.default.dim("off");
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
       message: `Tenant ${tenant2}:`,
       pageSize: 12,
       choices: [
-        { name: `Login methods (${nLogin})  ${import_chalk33.default.dim("how your consumers sign in")}`, value: "login" },
-        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk33.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
-        { name: `Portal admins (${nEmails})  ${import_chalk33.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
-        new inquirer3.Separator(import_chalk33.default.dim("  Settings")),
-        { name: `CORS: ${cors?.cors ? import_chalk33.default.cyan(JSON.stringify(cors.cors)) : import_chalk33.default.dim("(unset)")}  ${import_chalk33.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
+        { name: `Login methods (${nLogin})  ${import_chalk36.default.dim("how your consumers sign in")}`, value: "login" },
+        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk36.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
+        { name: `Portal admins (${nEmails})  ${import_chalk36.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
+        new inquirer3.Separator(import_chalk36.default.dim("  Settings")),
+        { name: `CORS: ${cors?.cors ? import_chalk36.default.cyan(JSON.stringify(cors.cors)) : import_chalk36.default.dim("(unset)")}  ${import_chalk36.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -4556,7 +5835,7 @@ Tenant ${tenant2}`));
       case "iam": {
         const { v } = await inquirer3.prompt([{ type: "confirm", name: "v", message: "Enable Users & groups?", default: !!iam?.iam_enabled }]);
         await admin({ method: "PATCH", path: `${base2}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
-        console.log(import_chalk33.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
+        console.log(import_chalk36.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
         break;
       }
       case "cors": {
@@ -4569,11 +5848,11 @@ Tenant ${tenant2}`));
         if (v === "") break;
         const parsed = v === "null" ? null : safeJson(v);
         if (parsed === void 0) {
-          console.log(import_chalk33.default.yellow("  Not valid JSON \u2014 unchanged."));
+          console.log(import_chalk36.default.yellow("  Not valid JSON \u2014 unchanged."));
           break;
         }
         await admin({ method: "PUT", path: `${base2}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
-        console.log(import_chalk33.default.green("  CORS updated."));
+        console.log(import_chalk36.default.green("  CORS updated."));
         break;
       }
       case "emails":
@@ -4585,7 +5864,7 @@ Tenant ${tenant2}`));
 async function loginMethodsMenu(teamId, tenant2, base2) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora13.default)("Loading login methods...").start();
+    const spinner = (0, import_ora15.default)("Loading login methods...").start();
     const [rawClients, rawIssuers, rawOpaque] = await Promise.all([
       admin({ method: "GET", path: `${base2}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
       admin({ method: "GET", path: `${base2}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
@@ -4597,15 +5876,15 @@ async function loginMethodsMenu(teamId, tenant2, base2) {
     const choices = [];
     for (const c of appClients) {
       const nP = (c.providers ?? []).length || c.providers_count || 0;
-      choices.push({ name: `${import_chalk33.default.cyan("APIblaze-hosted")}  ${import_chalk33.default.bold(c.name ?? c.clientId)}  ${import_chalk33.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk33.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
+      choices.push({ name: `${import_chalk36.default.cyan("APIblaze-hosted")}  ${import_chalk36.default.bold(c.name ?? c.clientId)}  ${import_chalk36.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk36.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
     }
     for (const i of issuers) {
-      choices.push({ name: `${import_chalk33.default.cyan("Your own \u2014 JWT ")}  ${import_chalk33.default.bold(i.iss)}  ${import_chalk33.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
+      choices.push({ name: `${import_chalk36.default.cyan("Your own \u2014 JWT ")}  ${import_chalk36.default.bold(i.iss)}  ${import_chalk36.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
     }
     if (opaque?.endpoint) {
-      choices.push({ name: `${import_chalk33.default.cyan("Your own \u2014 opaque")}  ${import_chalk33.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
+      choices.push({ name: `${import_chalk36.default.cyan("Your own \u2014 opaque")}  ${import_chalk36.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
     }
-    if (!choices.length) console.log(import_chalk33.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
+    if (!choices.length) console.log(import_chalk36.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
@@ -4645,9 +5924,9 @@ async function addLoginMethod(teamId, tenant2, base2) {
     message: "How do people log in?",
     pageSize: 8,
     choices: [
-      { name: `APIblaze hosted login page  ${import_chalk33.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
-      { name: `Your own hosted login \u2014 JWT  ${import_chalk33.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
-      { name: `Your own login \u2014 opaque token  ${import_chalk33.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
+      { name: `APIblaze hosted login page  ${import_chalk36.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
+      { name: `Your own hosted login \u2014 JWT  ${import_chalk36.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
+      { name: `Your own login \u2014 opaque token  ${import_chalk36.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
       { name: "\u2190 Back", value: null }
     ]
   }]);
@@ -4671,8 +5950,8 @@ function safeJson(s) {
 async function emailsMenu(base2, emails) {
   const { default: inquirer3 } = await import("inquirer");
   console.log();
-  if (!emails.length) console.log(import_chalk33.default.dim("  No consumer-admin emails."));
-  for (const e of emails) console.log(`  ${import_chalk33.default.bold(e.email ?? e)}  ${import_chalk33.default.dim(e.status ?? "")}`);
+  if (!emails.length) console.log(import_chalk36.default.dim("  No consumer-admin emails."));
+  for (const e of emails) console.log(`  ${import_chalk36.default.bold(e.email ?? e)}  ${import_chalk36.default.dim(e.status ?? "")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
@@ -4687,7 +5966,7 @@ async function emailsMenu(base2, emails) {
   if (act === "add") {
     const { email } = await inquirer3.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
     await admin({ method: "POST", path: `${base2}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
-    console.log(import_chalk33.default.green(`  ${email} added.`));
+    console.log(import_chalk36.default.green(`  ${email} added.`));
   } else {
     const { e } = await inquirer3.prompt([{
       type: "list",
@@ -4697,7 +5976,7 @@ async function emailsMenu(base2, emails) {
     }]);
     if (!e) return;
     await admin({ method: "DELETE", path: `${base2}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
-    console.log(import_chalk33.default.green(`  ${e} removed.`));
+    console.log(import_chalk36.default.green(`  ${e} removed.`));
   }
 }
 async function addIssuer(base2) {
@@ -4718,19 +5997,19 @@ async function addIssuer(base2) {
     body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
     summary: `Add external issuer ${a.iss.trim()}`
   });
-  console.log(import_chalk33.default.green("  JWT login method saved."));
+  console.log(import_chalk36.default.green("  JWT login method saved."));
 }
 async function issuerHome(base2, issuer) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk33.default.bold(issuer.iss)}  ${import_chalk33.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
+  ${import_chalk36.default.bold(issuer.iss)}  ${import_chalk36.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This JWT login method:",
     choices: [
       { name: "Replace it (re-enter details)", value: "edit" },
-      { name: import_chalk33.default.red("Delete it"), value: "rm" },
+      { name: import_chalk36.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -4746,7 +6025,7 @@ async function issuerHome(base2, issuer) {
     path: `${base2}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
     summary: `Delete issuer ${issuer.iss}`
   });
-  console.log(import_chalk33.default.green("  Deleted."));
+  console.log(import_chalk36.default.green("  Deleted."));
 }
 async function setOpaque(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
@@ -4755,19 +6034,19 @@ async function setOpaque(base2, cur) {
     { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
   ]);
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
-  console.log(import_chalk33.default.green("  Opaque login method set."));
+  console.log(import_chalk36.default.green("  Opaque login method set."));
 }
 async function opaqueHome(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk33.default.bold(cur.endpoint)}  ${import_chalk33.default.dim(cur.method ?? "GET")}`);
+  ${import_chalk36.default.bold(cur.endpoint)}  ${import_chalk36.default.dim(cur.method ?? "GET")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This opaque login method:",
     choices: [
       { name: "Replace it", value: "edit" },
-      { name: import_chalk33.default.red("Delete it"), value: "rm" },
+      { name: import_chalk36.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -4777,14 +6056,14 @@ async function opaqueHome(base2, cur) {
     return;
   }
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
-  console.log(import_chalk33.default.green("  Deleted."));
+  console.log(import_chalk36.default.green("  Deleted."));
 }
 async function clientHome(base2, summary) {
   const { default: inquirer3 } = await import("inquirer");
   const id = summary.clientId ?? summary.client_id;
   const cBase = `${base2}/app-clients/${encodeURIComponent(id)}`;
   for (; ; ) {
-    const spinner = (0, import_ora13.default)("Reading app client...").start();
+    const spinner = (0, import_ora15.default)("Reading app client...").start();
     const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
     spinner.stop();
     const cb = c.authorizedCallbackUrls ?? c.authorized_callback_urls ?? [];
@@ -4796,13 +6075,13 @@ async function clientHome(base2, summary) {
       message: `${c.name ?? id}:`,
       pageSize: 12,
       choices: [
-        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk33.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
-        { name: `Callback URLs: ${cb.length ? import_chalk33.default.cyan(cb.join(", ")) : import_chalk33.default.dim("(none)")}`, value: "callbacks" },
-        { name: `Scopes: ${scopes.length ? import_chalk33.default.cyan(scopes.join(" ")) : import_chalk33.default.dim("(defaults)")}`, value: "scopes" },
+        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk36.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
+        { name: `Callback URLs: ${cb.length ? import_chalk36.default.cyan(cb.join(", ")) : import_chalk36.default.dim("(none)")}`, value: "callbacks" },
+        { name: `Scopes: ${scopes.length ? import_chalk36.default.cyan(scopes.join(" ")) : import_chalk36.default.dim("(defaults)")}`, value: "scopes" },
         { name: `Token expiries: access ${c.accessTokenExpiry ?? 3600}s \xB7 id ${c.idTokenExpiry ?? 3600}s \xB7 refresh ${c.refreshTokenExpiry ?? 2592e3}s`, value: "expiries" },
         { name: "Reveal client secret", value: "secret" },
         { name: "Rotate client secret", value: "rotate" },
-        { name: import_chalk33.default.red("Delete this app client"), value: "delete" },
+        { name: import_chalk36.default.red("Delete this app client"), value: "delete" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -4815,13 +6094,13 @@ async function clientHome(base2, summary) {
       case "callbacks": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Callback URLs (comma-separated):", default: cb.join(", ") }]);
         await admin({ method: "PATCH", path: cBase, body: { authorizedCallbackUrls: parseList(v) }, summary: "Update callback URLs" });
-        console.log(import_chalk33.default.green("  Callbacks updated."));
+        console.log(import_chalk36.default.green("  Callbacks updated."));
         break;
       }
       case "scopes": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Scopes (space/comma-separated):", default: scopes.join(" ") }]);
         await admin({ method: "PATCH", path: cBase, body: { scopes: v.split(/[\s,]+/).filter(Boolean) }, summary: "Update scopes" });
-        console.log(import_chalk33.default.green("  Scopes updated."));
+        console.log(import_chalk36.default.green("  Scopes updated."));
         break;
       }
       case "expiries": {
@@ -4836,14 +6115,14 @@ async function clientHome(base2, summary) {
           body: { accessTokenExpiry: Number(a.access), idTokenExpiry: Number(a.id), refreshTokenExpiry: Number(a.refresh) },
           summary: "Update token expiries"
         });
-        console.log(import_chalk33.default.green("  Expiries updated."));
+        console.log(import_chalk36.default.green("  Expiries updated."));
         break;
       }
       case "secret": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: "Print the client secret to this terminal?", default: false }]);
         if (!sure) break;
         const s = await admin({ method: "GET", path: `${cBase}/secret`, summary: "Reveal client secret" });
-        console.log(`  ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk36.default.bold("client_secret")}: ${import_chalk36.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
         break;
       }
       case "rotate": {
@@ -4851,14 +6130,14 @@ async function clientHome(base2, summary) {
         if (!sure) break;
         const fresh = randomSecret();
         await admin({ method: "PATCH", path: cBase, body: { clientSecret: fresh }, summary: "Rotate client secret" });
-        console.log(`  New ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(fresh)}  ${import_chalk33.default.dim("(store it now)")}`);
+        console.log(`  New ${import_chalk36.default.bold("client_secret")}: ${import_chalk36.default.green(fresh)}  ${import_chalk36.default.dim("(store it now)")}`);
         break;
       }
       case "delete": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Delete app client "${c.name ?? id}"? Consumers logged in through it will lose access.`, default: false }]);
         if (!sure) break;
         await admin({ method: "DELETE", path: cBase, summary: `Delete app client ${id}` });
-        console.log(import_chalk33.default.green("  App client deleted."));
+        console.log(import_chalk36.default.green("  App client deleted."));
         return;
       }
     }
@@ -4879,15 +6158,15 @@ var DEFAULT_SCOPES2 = {
 async function providersMenu(cBase, clientLabel) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora13.default)("Loading providers...").start();
+    const spinner = (0, import_ora15.default)("Loading providers...").start();
     const raw = await admin({ method: "GET", path: `${cBase}/providers`, summary: "List login providers" }).catch(() => []);
     spinner.stop();
     const providers = Array.isArray(raw) ? raw : [];
     console.log();
     for (const p of providers) {
-      console.log(`  ${import_chalk33.default.bold(p.type)}  ${import_chalk33.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
+      console.log(`  ${import_chalk36.default.bold(p.type)}  ${import_chalk36.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
     }
-    if (!providers.length) console.log(import_chalk33.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
+    if (!providers.length) console.log(import_chalk36.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
@@ -4945,23 +6224,23 @@ async function providersMenu(cBase, clientLabel) {
         body.targetServerToken = routing;
       }
       await admin({ method: "POST", path: `${cBase}/providers`, body, summary: `Add ${type} login provider` });
-      console.log(import_chalk33.default.green(`  ${type} provider added.`));
+      console.log(import_chalk36.default.green(`  ${type} provider added.`));
     } else {
       const { p } = await inquirer3.prompt([{
         type: "list",
         name: "p",
         message: act === "rm" ? "Remove which provider?" : "Reveal which secret?",
-        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk33.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
+        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk36.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
       }]);
       if (!p) continue;
       if (act === "rm") {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Remove the ${p.type} provider? Consumers using it can no longer sign in.`, default: false }]);
         if (!sure) continue;
         await admin({ method: "DELETE", path: `${cBase}/providers/${encodeURIComponent(p.id)}`, summary: `Remove ${p.type} provider` });
-        console.log(import_chalk33.default.green(`  ${p.type} removed.`));
+        console.log(import_chalk36.default.green(`  ${p.type} removed.`));
       } else {
         const s = await admin({ method: "GET", path: `${cBase}/providers/${encodeURIComponent(p.id)}/secret`, summary: `Reveal ${p.type} provider secret` });
-        console.log(`  ${import_chalk33.default.bold("client_secret")}: ${import_chalk33.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk36.default.bold("client_secret")}: ${import_chalk36.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
       }
     }
   }
@@ -4969,8 +6248,8 @@ async function providersMenu(cBase, clientLabel) {
 
 // src/commands/spec.ts
 var fs7 = __toESM(require("fs"));
-var import_chalk34 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_chalk37 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
 init_admin();
 init_api();
 init_resolve();
@@ -4986,19 +6265,19 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk34.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk37.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs7.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk34.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk37.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora14.default)("Uploading spec...").start();
+  const spinner = (0, import_ora16.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -5022,28 +6301,28 @@ async function runSpecSet(project, opts) {
 function printSpecChangeReport(report, projectName) {
   const r = report.routes;
   if (r) {
-    for (const a of r.added) console.log(import_chalk34.default.green(`  + ${a}`));
-    for (const d of r.removed) console.log(import_chalk34.default.red(`  \u2212 ${d}`));
-    for (const rn of r.renamed ?? []) console.log(import_chalk34.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
-    for (const m of r.modified ?? []) console.log(import_chalk34.default.dim(`  \xB1 ${m} (params/schema changed)`));
+    for (const a of r.added) console.log(import_chalk37.default.green(`  + ${a}`));
+    for (const d of r.removed) console.log(import_chalk37.default.red(`  \u2212 ${d}`));
+    for (const rn of r.renamed ?? []) console.log(import_chalk37.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
+    for (const m of r.modified ?? []) console.log(import_chalk37.default.dim(`  \xB1 ${m} (params/schema changed)`));
   }
-  if (report.applied?.mcp_regenerated) console.log(import_chalk34.default.dim("  MCP catalogue regenerated."));
-  if (report.applied?.candidates_cleared) console.log(import_chalk34.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
+  if (report.applied?.mcp_regenerated) console.log(import_chalk37.default.dim("  MCP catalogue regenerated."));
+  if (report.applied?.candidates_cleared) console.log(import_chalk37.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
   for (const item of report.attention ?? []) {
-    console.log(import_chalk34.default.yellow(`  \u26A0 ${item.detail}`));
+    console.log(import_chalk37.default.yellow(`  \u26A0 ${item.detail}`));
     if (item.suggestion?.carry_from && item.suggestion.carry_to) {
-      console.log(import_chalk34.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
+      console.log(import_chalk37.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
     }
   }
 }
 async function runSpecCarry(project, opts) {
   if (!opts.method || !opts.from || !opts.to) {
-    console.error(import_chalk34.default.red("--method, --from and --to are required."));
+    console.error(import_chalk37.default.red("--method, --from and --to are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora14.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
+  const spinner = (0, import_ora16.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
   const res = await agentCall(`/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/carry`, "POST", {
     method: opts.method.toUpperCase(),
     from_resource: opts.from,
@@ -5060,13 +6339,13 @@ async function runSpecCarry(project, opts) {
 }
 async function runSpecDeleteRule(project, opts) {
   if (!opts.method || !opts.route) {
-    console.error(import_chalk34.default.red("--method and --route are required."));
+    console.error(import_chalk37.default.red("--method and --route are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
   const encoded = opts.route.replace(/\{/g, "%7B").replace(/\}/g, "%7D");
-  const spinner = (0, import_ora14.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
+  const spinner = (0, import_ora16.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
   const res = await agentCall(
     `/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/${opts.method.toUpperCase()}${encoded.startsWith("/") ? encoded : `/${encoded}`}`,
     "DELETE"
@@ -5080,14 +6359,14 @@ async function runSpecDeleteRule(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk36 = __toESM(require("chalk"));
-var import_ora15 = __toESM(require("ora"));
+var import_chalk39 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
 
 // src/lib/tools.ts
-var import_chalk35 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 init_admin();
 init_api();
 init_resolve();
@@ -5107,15 +6386,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      const lines = [`  ${import_chalk35.default.dim("Proxy URL:")}  ${import_chalk35.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk35.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk38.default.dim("Proxy URL:")}  ${import_chalk38.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk38.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk35.default.bold("API keys")} ${import_chalk35.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk38.default.bold("API keys")} ${import_chalk38.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk35.default.cyan(env.padEnd(w))}  ${import_chalk35.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk38.default.cyan(env.padEnd(w))}  ${import_chalk38.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk35.default.dim("Try it:")}`, `    ${import_chalk35.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk38.default.dim("Try it:")}`, `    ${import_chalk38.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -5271,23 +6550,23 @@ function truncate(value, max = 1500) {
 }
 function printCost(resp) {
   const line = formatBilling(resp.billing);
-  if (line) console.log(import_chalk36.default.magenta(`  ${line}`) + import_chalk36.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
+  if (line) console.log(import_chalk39.default.magenta(`  ${line}`) + import_chalk39.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk36.default.bold("APIblaze agent") + import_chalk36.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk36.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk39.default.bold("APIblaze agent") + import_chalk39.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk39.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk36.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk39.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora15.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora17.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -5295,21 +6574,21 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk36.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk39.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp);
-      if (resp.reply) console.log(import_chalk36.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk39.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora15.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora17.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -5327,11 +6606,11 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk36.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk39.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk36.default.dim("\nBye."));
+  console.log(import_chalk39.default.dim("\nBye."));
 }
 
 // src/commands/config-browse.ts
@@ -5617,11 +6896,11 @@ function dig(blob, dotted) {
 }
 var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
 function show(v) {
-  if (v === void 0) return import_chalk37.default.dim("(unset)");
-  if (v === null) return import_chalk37.default.dim("null");
-  if (typeof v === "object") return import_chalk37.default.cyan(JSON.stringify(v));
-  if (typeof v === "boolean") return v ? import_chalk37.default.green("on") : import_chalk37.default.red("off");
-  return import_chalk37.default.cyan(String(v));
+  if (v === void 0) return import_chalk40.default.dim("(unset)");
+  if (v === null) return import_chalk40.default.dim("null");
+  if (typeof v === "object") return import_chalk40.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk40.default.green("on") : import_chalk40.default.red("off");
+  return import_chalk40.default.cyan(String(v));
 }
 function parseValue(raw) {
   if (raw === "true") return true;
@@ -5648,7 +6927,7 @@ async function fetchConfigBlob(proj2) {
 }
 async function patchSetting(proj2, s, value, cfg) {
   const body = s.toPatch(value, cfg);
-  const spinner = (0, import_ora16.default)(`Set ${s.key}...`).start();
+  const spinner = (0, import_ora18.default)(`Set ${s.key}...`).start();
   try {
     await admin({
       method: "PATCH",
@@ -5663,10 +6942,10 @@ async function patchSetting(proj2, s, value, cfg) {
   }
 }
 var loginFirst = (what) => {
-  console.log(import_chalk37.default.yellow(`
+  console.log(import_chalk40.default.yellow(`
   Log in first to ${what}.`));
-  console.log(import_chalk37.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
-  console.log(import_chalk37.default.dim("  anonymously and want to bring it into your account.\n"));
+  console.log(import_chalk40.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk40.default.dim("  anonymously and want to bring it into your account.\n"));
 };
 async function runConfig(project, key, value, opts) {
   const creds = loadCredentials();
@@ -5683,9 +6962,9 @@ async function runConfig(project, key, value, opts) {
   }
   const setting = SETTINGS.find((s) => s.key === key);
   if (!setting) {
-    console.error(import_chalk37.default.red(`Unknown setting "${key}".`));
-    console.error(import_chalk37.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
-    console.error(import_chalk37.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    console.error(import_chalk40.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk40.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk40.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
     process.exit(1);
   }
   if (value === void 0) {
@@ -5700,7 +6979,7 @@ async function pickProject(teamId) {
   const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const projects = await getProjects2(teamId).catch(() => []);
   if (!projects.length) {
-    console.error(import_chalk37.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    console.error(import_chalk40.default.red("No projects in this team. Create one: `npx apiblaze create`."));
     process.exit(1);
   }
   const { default: inquirer3 } = await import("inquirer");
@@ -5708,7 +6987,7 @@ async function pickProject(teamId) {
     type: "list",
     name: "picked",
     message: "Which project?",
-    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk37.default.dim("v" + p.apiVersion)}`, value: p }))
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk40.default.dim("v" + p.apiVersion)}`, value: p }))
   }]);
   return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
 }
@@ -5719,25 +6998,25 @@ function printAll(proj2, cfg, json) {
     console.log(JSON.stringify(out, null, 2));
     return;
   }
-  console.log(import_chalk37.default.bold(`
+  console.log(import_chalk40.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
   for (const group2 of SETTING_GROUPS) {
-    console.log(import_chalk37.default.bold(group2));
+    console.log(import_chalk40.default.bold(group2));
     for (const s of SETTINGS.filter((x) => x.group === group2)) {
-      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk37.default.dim(s.desc)}`);
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk40.default.dim(s.desc)}`);
     }
     console.log();
   }
-  console.log(import_chalk37.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+  console.log(import_chalk40.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
 }
 async function discoveryMenu(project) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk37.default.bold(`
+  console.log(import_chalk40.default.bold(`
 APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
 `));
-  console.log(import_chalk37.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
-  console.log(import_chalk37.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  console.log(import_chalk40.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk40.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
@@ -5745,13 +7024,13 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
       message: "Explore:",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk40.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({
-          name: `${g}  ${import_chalk37.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          name: `${g}  ${import_chalk40.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
           value: { kind: "settings", g }
         })),
-        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk37.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer3.Separator(import_chalk40.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk40.default.dim(f.desc)}`, value: { kind: "feature", f } })),
         new inquirer3.Separator(),
         { name: "Exit", value: { kind: "exit" } }
       ]
@@ -5760,24 +7039,24 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
     if (pick2.kind === "settings") {
       console.log();
       for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
-        console.log(`  ${import_chalk37.default.bold(s.label.padEnd(28))} ${import_chalk37.default.dim(s.desc)}`);
-        console.log(`  ${import_chalk37.default.dim("  key: " + s.key)}`);
+        console.log(`  ${import_chalk40.default.bold(s.label.padEnd(28))} ${import_chalk40.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk40.default.dim("  key: " + s.key)}`);
       }
       loginFirst("view or change these settings");
     } else {
       const f = pick2.f;
       console.log(`
-  ${import_chalk37.default.bold(f.label)} \u2014 ${f.desc}`);
+  ${import_chalk40.default.bold(f.label)} \u2014 ${f.desc}`);
       loginFirst(`use ${f.label.toLowerCase()}`);
     }
   }
 }
 async function navigator(proj2, cfg, opts) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk37.default.bold(`
+  console.log(import_chalk40.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
 `));
-  console.log(import_chalk37.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  console.log(import_chalk40.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
   let blob = cfg;
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
@@ -5786,10 +7065,10 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
       message: "Where to?",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk40.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
-        new inquirer3.Separator(import_chalk37.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk37.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer3.Separator(import_chalk40.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk40.default.dim(f.desc)}`, value: { kind: f.go } })),
         new inquirer3.Separator(),
         { name: "Show all settings", value: { kind: "list" } },
         { name: "Exit", value: { kind: "exit" } }
@@ -5829,7 +7108,7 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
         }
       }
     } catch (err) {
-      console.error(import_chalk37.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_chalk40.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
 }
@@ -5843,7 +7122,7 @@ async function settingsGroup(proj2, cfg, group2) {
       message: group2 + ":",
       pageSize: 16,
       choices: [
-        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk37.default.dim(s2.desc)}`, value: s2 })),
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk40.default.dim(s2.desc)}`, value: s2 })),
         new inquirer3.Separator(),
         { name: "\u2190 Back", value: null }
       ]
@@ -5861,7 +7140,7 @@ async function settingsGroup(proj2, cfg, group2) {
     } else if (s.type === "number") {
       const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
       if (v === "" || Number.isNaN(Number(v))) {
-        console.log(import_chalk37.default.yellow("  Not a number \u2014 unchanged."));
+        console.log(import_chalk40.default.yellow("  Not a number \u2014 unchanged."));
         continue;
       }
       value = Number(v);
@@ -5942,7 +7221,7 @@ async function buildCondition(phase) {
   const items = [];
   for (; ; ) {
     const a = await inquirer3.prompt([
-      { type: "input", name: "source", message: `Condition field ${import_chalk37.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
+      { type: "input", name: "source", message: `Condition field ${import_chalk40.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
       { type: "list", name: "operator", message: "Operator:", choices: [
         "eq",
         "neq",
@@ -5973,7 +7252,7 @@ async function buildCondition(phase) {
 function showCondition(cond) {
   if (!Array.isArray(cond) || !cond.length) return "";
   const s = cond.map((c) => `${c.source} ${c.operator}${c.value !== void 0 ? ` "${c.value}"` : ""}${c.logicOp ? ` ${c.logicOp}` : ""}`).join(" ");
-  return import_chalk37.default.dim(`  when ${s}`);
+  return import_chalk40.default.dim(`  when ${s}`);
 }
 async function transformsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
@@ -5982,12 +7261,12 @@ async function transformsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
-    if (!rules.length) console.log(import_chalk37.default.dim("  No transform rules yet."));
+    if (!rules.length) console.log(import_chalk40.default.dim("  No transform rules yet."));
     for (const r of rules) {
       const a = r.action ?? {};
       const fns = [...a.source_fns ?? [], ...a.dest_fns ?? []].map((f) => f.fn);
-      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk37.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
-      console.log(`  ${r.enabled ? import_chalk37.default.green("\u25CF") : import_chalk37.default.dim("\u25CB")} ${import_chalk37.default.bold(r.name)}  ${import_chalk37.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk40.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
+      console.log(`  ${r.enabled ? import_chalk40.default.green("\u25CF") : import_chalk40.default.dim("\u25CB")} ${import_chalk40.default.bold(r.name)}  ${import_chalk40.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -5999,7 +7278,7 @@ async function transformsMenu(proj2) {
           { name: "Enable/disable a rule", value: "toggle" },
           { name: "Delete a rule", value: "delete" }
         ] : [],
-        { name: import_chalk37.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
+        { name: import_chalk40.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -6012,11 +7291,11 @@ async function transformsMenu(proj2) {
       }]);
       const body = parseValue(raw);
       if (!body || typeof body !== "object" || Array.isArray(body)) {
-        console.log(import_chalk37.default.yellow("  Not a JSON object \u2014 skipped."));
+        console.log(import_chalk40.default.yellow("  Not a JSON object \u2014 skipped."));
         continue;
       }
       await admin({ method: "POST", path: base2, body, summary: "Create transform rule (raw JSON)" });
-      console.log(import_chalk37.default.green("  Rule created."));
+      console.log(import_chalk40.default.green("  Rule created."));
       continue;
     }
     if (act === "add") {
@@ -6032,7 +7311,7 @@ async function transformsMenu(proj2) {
           { name: "Remove a field", value: "remove" }
         ] }
       ]);
-      const fieldHint = import_chalk37.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      const fieldHint = import_chalk40.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
       let action2;
       if (ans.kind === "hardcode") {
         const a = await inquirer3.prompt([
@@ -6061,7 +7340,7 @@ async function transformsMenu(proj2) {
         };
       }
       const condition = await buildCondition(ans.phase);
-      const spinner = (0, import_ora16.default)("Creating rule...").start();
+      const spinner = (0, import_ora18.default)("Creating rule...").start();
       try {
         await admin({
           method: "POST",
@@ -6079,16 +7358,16 @@ async function transformsMenu(proj2) {
         type: "list",
         name: "rule",
         message: act === "toggle" ? "Which rule?" : "Delete which rule?",
-        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk37.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk40.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
       }]);
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
         await admin({ method: "PUT", path: `${base2}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
-        console.log(import_chalk37.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+        console.log(import_chalk40.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
         await admin({ method: "DELETE", path: `${base2}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
-        console.log(import_chalk37.default.green(`  ${rule.name} deleted.`));
+        console.log(import_chalk40.default.green(`  ${rule.name} deleted.`));
       }
     }
   }
@@ -6100,9 +7379,9 @@ async function mappingsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
-    if (!tables.length) console.log(import_chalk37.default.dim("  No mapping tables yet."));
+    if (!tables.length) console.log(import_chalk40.default.dim("  No mapping tables yet."));
     for (const t of tables) {
-      console.log(`  ${import_chalk37.default.bold(t.name)}  ${import_chalk37.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+      console.log(`  ${import_chalk40.default.bold(t.name)}  ${import_chalk40.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -6122,11 +7401,11 @@ async function mappingsMenu(proj2) {
       ]);
       const entries2 = parseValue(a.entries);
       if (!Array.isArray(entries2)) {
-        console.log(import_chalk37.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        console.log(import_chalk40.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
       await admin({ method: "POST", path: base2, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
-      console.log(import_chalk37.default.green(`  Table "${a.name}" created.`));
+      console.log(import_chalk40.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer3.prompt([{
         type: "list",
@@ -6136,7 +7415,7 @@ async function mappingsMenu(proj2) {
       }]);
       if (!table) continue;
       await admin({ method: "DELETE", path: `${base2}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
-      console.log(import_chalk37.default.green(`  ${table.name} deleted.`));
+      console.log(import_chalk40.default.green(`  ${table.name} deleted.`));
     }
   }
 }
@@ -6147,14 +7426,14 @@ async function tenantsMenu(proj2, opts) {
     const out = await admin({ method: "GET", path: base2, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
-    if (!tenants.length) console.log(import_chalk37.default.dim("  No tenants attached (consumers use the default tenant)."));
-    for (const t of tenants) console.log(`  ${import_chalk37.default.bold(t.tenant_name ?? t.name)}  ${import_chalk37.default.dim(t.display_name ?? "")}`);
+    if (!tenants.length) console.log(import_chalk40.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk40.default.bold(t.tenant_name ?? t.name)}  ${import_chalk40.default.dim(t.display_name ?? "")}`);
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
       message: "Tenants:",
       choices: [
-        { name: `Manage a tenant\u2026  ${import_chalk37.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
+        { name: `Manage a tenant\u2026  ${import_chalk40.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
         { name: "Attach a tenant to this project", value: "attach" },
         ...tenants.length ? [{ name: "Detach a tenant from this project", value: "detach" }] : [],
         { name: "\u2190 Back", value: "back" }
@@ -6177,7 +7456,7 @@ async function tenantsMenu(proj2, opts) {
       }]);
       if (!t) continue;
       await admin({ method: "DELETE", path: `${base2}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
-      console.log(import_chalk37.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+      console.log(import_chalk40.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
 }
@@ -6220,7 +7499,7 @@ async function specMenu(proj2, opts) {
     choices: [
       { name: "Print the stored spec", value: "get" },
       { name: "Refresh the spec from its source", value: "refresh" },
-      { name: import_chalk37.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: import_chalk40.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -6228,7 +7507,7 @@ async function specMenu(proj2, opts) {
   if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
   else if (act === "refresh") {
     await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
-    console.log(import_chalk37.default.green("  Spec refresh triggered."));
+    console.log(import_chalk40.default.green("  Spec refresh triggered."));
   } else await runOpenapi(proj2.projectName, proj2.apiVersion);
 }
 async function agentsMenu(proj2, opts) {
@@ -6253,8 +7532,8 @@ async function agentsMenu(proj2, opts) {
 }
 
 // src/commands/group.ts
-var import_chalk38 = __toESM(require("chalk"));
-var import_ora17 = __toESM(require("ora"));
+var import_chalk41 = __toESM(require("chalk"));
+var import_ora19 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
@@ -6347,7 +7626,7 @@ async function userByRefOrCreate(t, ref) {
     if (!ref.includes("@")) throw e;
     const created = await t.call("/v1/admin/users", "POST", { email: ref.trim().toLowerCase() });
     if (!created?.abz_sub) throw e;
-    console.log(import_chalk38.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
+    console.log(import_chalk41.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
     return { abz_sub: created.abz_sub, email: created.email ?? ref, display_name: null };
   }
 }
@@ -6355,11 +7634,11 @@ async function runGroupList(opts) {
   const t = await resolveTransport(opts);
   const groups = await listGroups(t);
   if (opts.json) return void console.log(JSON.stringify(groups));
-  if (!groups.length) return void console.log(import_chalk38.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
-  console.log(import_chalk38.default.dim(`Tenant ${t.tenant}:`));
+  if (!groups.length) return void console.log(import_chalk41.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk41.default.dim(`Tenant ${t.tenant}:`));
   for (const g of groups) {
-    const sealed = g.name === "apiblaze_admins" ? import_chalk38.default.dim("  (admins \u2014 managed by allowlist)") : "";
-    console.log(`  ${import_chalk38.default.bold(g.name)}  ${import_chalk38.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+    const sealed = g.name === "apiblaze_admins" ? import_chalk41.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk41.default.bold(g.name)}  ${import_chalk41.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
   }
 }
 async function runGroupCreate(name, opts) {
@@ -6384,10 +7663,10 @@ async function runGroupCreate(name, opts) {
       }
     }
   }
-  const spinner = (0, import_ora17.default)(`Creating group ${name}...`).start();
+  const spinner = (0, import_ora19.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
-    spinner.succeed(`Group ${import_chalk38.default.bold(name)} created in ${t.tenant}.`);
+    spinner.succeed(`Group ${import_chalk41.default.bold(name)} created in ${t.tenant}.`);
   } catch (e) {
     spinner.fail("Create failed.");
     throw e;
@@ -6396,10 +7675,10 @@ async function runGroupCreate(name, opts) {
 async function runGroupDelete(name, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, name);
-  const spinner = (0, import_ora17.default)(`Deleting group ${name}...`).start();
+  const spinner = (0, import_ora19.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
-    spinner.succeed(`Group ${import_chalk38.default.bold(name)} deleted.`);
+    spinner.succeed(`Group ${import_chalk41.default.bold(name)} deleted.`);
   } catch (e) {
     spinner.fail("Delete failed.");
     throw e;
@@ -6412,21 +7691,21 @@ async function runGroupMembers(name, opts) {
   const subs = await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/subgroups`);
   if (opts.json) return void console.log(JSON.stringify({ ...detail, subgroups: subs?.subgroups ?? [] }));
   const members = detail?.members ?? [];
-  console.log(import_chalk38.default.bold(`${g.name}`) + import_chalk38.default.dim(`  (${t.tenant})`));
-  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk38.default.cyan("group-admin") : import_chalk38.default.dim("member")}`);
-  if (!members.length) console.log(import_chalk38.default.dim("  no members"));
+  console.log(import_chalk41.default.bold(`${g.name}`) + import_chalk41.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk41.default.cyan("group-admin") : import_chalk41.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk41.default.dim("  no members"));
   const sg = subs?.subgroups ?? [];
-  if (sg.length) console.log(import_chalk38.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+  if (sg.length) console.log(import_chalk41.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
 }
 async function runGroupAddUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, groupName);
   const u = await userByRefOrCreate(t, userRef);
   const role = opts.role === "admin" ? "admin" : "member";
-  const spinner = (0, import_ora17.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  const spinner = (0, import_ora19.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
-    spinner.succeed(`${import_chalk38.default.bold(label2(u))} added to ${import_chalk38.default.bold(g.name)} as ${role}.`);
+    spinner.succeed(`${import_chalk41.default.bold(label2(u))} added to ${import_chalk41.default.bold(g.name)} as ${role}.`);
   } catch (e) {
     spinner.fail("Add failed.");
     throw e;
@@ -6435,10 +7714,10 @@ async function runGroupAddUser(userRef, groupName, opts) {
 async function runGroupRemoveUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
-  const spinner = (0, import_ora17.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  const spinner = (0, import_ora19.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
-    spinner.succeed(`${import_chalk38.default.bold(label2(u))} removed from ${import_chalk38.default.bold(g.name)}.`);
+    spinner.succeed(`${import_chalk41.default.bold(label2(u))} removed from ${import_chalk41.default.bold(g.name)}.`);
   } catch (e) {
     spinner.fail("Remove failed.");
     throw e;
@@ -6447,10 +7726,10 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
 async function runGroupAddGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora17.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  const spinner = (0, import_ora19.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
-    spinner.succeed(`${import_chalk38.default.bold(child.name)} is now a subgroup of ${import_chalk38.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk41.default.bold(child.name)} is now a subgroup of ${import_chalk41.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Nest failed.");
     throw e;
@@ -6459,10 +7738,10 @@ async function runGroupAddGroup(childName, parentName, opts) {
 async function runGroupRemoveGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora17.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  const spinner = (0, import_ora19.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
-    spinner.succeed(`${import_chalk38.default.bold(child.name)} un-nested from ${import_chalk38.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk41.default.bold(child.name)} un-nested from ${import_chalk41.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Un-nest failed.");
     throw e;
@@ -6473,19 +7752,19 @@ async function runGroupUsers(opts) {
   const users = await listUsers(t);
   const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
   if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
-  console.log(import_chalk38.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
-  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk38.default.dim(u.abz_sub)}`);
-  if (!users.length) console.log(import_chalk38.default.dim("  no users yet"));
+  console.log(import_chalk41.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk41.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk41.default.dim("  no users yet"));
   const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
   if (fresh.length) {
-    console.log(import_chalk38.default.dim("Seen in traffic (not yet users):"));
-    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk38.default.dim(o.source_label ?? "")}`);
+    console.log(import_chalk41.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk41.default.dim(o.source_label ?? "")}`);
   }
 }
 
 // src/commands/key.ts
-var import_chalk39 = __toESM(require("chalk"));
-var import_ora18 = __toESM(require("ora"));
+var import_chalk42 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 init_caller();
 async function runApikeysMenu(opts) {
   await runKeyList(opts);
@@ -6514,11 +7793,11 @@ async function runKeyList(opts) {
     return;
   }
   if (!keys.length) {
-    console.log(import_chalk39.default.yellow("No developer keys."));
+    console.log(import_chalk42.default.yellow("No developer keys."));
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk39.default.bold(k.key_id ?? k.id)}  ${import_chalk39.default.dim(k.description ?? "")}  ${import_chalk39.default.dim(k.expires_at ?? "no expiry")}`);
+    console.log(`  ${import_chalk42.default.bold(k.key_id ?? k.id)}  ${import_chalk42.default.dim(k.description ?? "")}  ${import_chalk42.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
@@ -6527,7 +7806,7 @@ async function runKeyMint(opts) {
   const body = { role: "consumer-admin" };
   if (opts.desc) body.description = opts.desc;
   if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
-  const spinner = (0, import_ora18.default)("Minting key...").start();
+  const spinner = (0, import_ora20.default)("Minting key...").start();
   try {
     const out = await producer(caller, {
       method: "POST",
@@ -6540,9 +7819,9 @@ async function runKeyMint(opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    console.log(`  ${import_chalk39.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk39.default.bold("key")}:     ${import_chalk39.default.green(out?.key)}  ${import_chalk39.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk39.default.dim("expires:")} ${out.expires_at}`);
+    console.log(`  ${import_chalk42.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk42.default.bold("key")}:     ${import_chalk42.default.green(out?.key)}  ${import_chalk42.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk42.default.dim("expires:")} ${out.expires_at}`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
@@ -6551,7 +7830,7 @@ async function runKeyMint(opts) {
 async function runKeyRevoke(keyId, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
-  const spinner = (0, import_ora18.default)("Revoking key...").start();
+  const spinner = (0, import_ora20.default)("Revoking key...").start();
   try {
     await producer(caller, {
       method: "DELETE",
@@ -6569,8 +7848,8 @@ async function runKeyRevoke(keyId, opts) {
 init_iam();
 
 // src/commands/admins.ts
-var import_chalk40 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_chalk43 = __toESM(require("chalk"));
+var import_ora21 = __toESM(require("ora"));
 init_caller();
 function requireTenant(opts) {
   const t = (opts.tenant ?? "").trim();
@@ -6597,20 +7876,20 @@ async function runAdminsList(opts) {
     return;
   }
   if (!admins2.length) {
-    console.log(import_chalk40.default.yellow(`No tenant admins for ${tenant2} yet.`));
+    console.log(import_chalk43.default.yellow(`No tenant admins for ${tenant2} yet.`));
     return;
   }
   for (const a of admins2) {
     const email = typeof a === "string" ? a : a.email;
     const flags = [a.active === false ? "pending" : null, a.pinned ? "pinned" : null].filter(Boolean).join(", ");
-    console.log(`  ${import_chalk40.default.bold(email)}${flags ? import_chalk40.default.dim(`  (${flags})`) : ""}`);
+    console.log(`  ${import_chalk43.default.bold(email)}${flags ? import_chalk43.default.dim(`  (${flags})`) : ""}`);
   }
 }
 async function runAdminsAdd(email, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const tenant2 = requireTenant(opts);
-  const spinner = opts.json ? null : (0, import_ora19.default)(`Adding ${email} as a tenant admin of ${tenant2}...`).start();
+  const spinner = opts.json ? null : (0, import_ora21.default)(`Adding ${email} as a tenant admin of ${tenant2}...`).start();
   try {
     const out = await producer(caller, {
       method: "POST",
@@ -6618,9 +7897,9 @@ async function runAdminsAdd(email, opts) {
       body: { email },
       summary: `Add ${email} to tenant ${tenant2} admins`
     });
-    spinner?.succeed(`${import_chalk40.default.bold(email)} is now a tenant admin of ${import_chalk40.default.bold(tenant2)}.`);
+    spinner?.succeed(`${import_chalk43.default.bold(email)} is now a tenant admin of ${import_chalk43.default.bold(tenant2)}.`);
     if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
-    else console.log(import_chalk40.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
+    else console.log(import_chalk43.default.dim("  Reload the Users & Groups widget \u2014 access flips from \u201Cpending\u201D to ready."));
   } catch (err) {
     spinner?.fail("Add failed.");
     throw err;
@@ -6630,14 +7909,14 @@ async function runAdminsRemove(email, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const tenant2 = requireTenant(opts);
-  const spinner = opts.json ? null : (0, import_ora19.default)(`Removing ${email} from the tenant admins of ${tenant2}...`).start();
+  const spinner = opts.json ? null : (0, import_ora21.default)(`Removing ${email} from the tenant admins of ${tenant2}...`).start();
   try {
     await producer(caller, {
       method: "DELETE",
       path: `${base(teamId, tenant2)}/${encodeURIComponent(email)}`,
       summary: `Remove ${email} from tenant ${tenant2} admins`
     });
-    spinner?.succeed(`Removed ${import_chalk40.default.bold(email)} from the tenant admins of ${import_chalk40.default.bold(tenant2)}.`);
+    spinner?.succeed(`Removed ${import_chalk43.default.bold(email)} from the tenant admins of ${import_chalk43.default.bold(tenant2)}.`);
   } catch (err) {
     spinner?.fail("Remove failed.");
     throw err;
@@ -6645,8 +7924,8 @@ async function runAdminsRemove(email, opts) {
 }
 
 // src/commands/preapprove.ts
-var import_chalk41 = __toESM(require("chalk"));
-var import_ora20 = __toESM(require("ora"));
+var import_chalk44 = __toESM(require("chalk"));
+var import_ora22 = __toESM(require("ora"));
 
 // src/lib/preapproval.ts
 init_auth();
@@ -6710,14 +7989,14 @@ async function runPreapprove(who, opts) {
     const rules = await listPreapprovalRules(tenant2);
     if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
     if (!rules.length) {
-      console.log(import_chalk41.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
-      console.log(import_chalk41.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      console.log(import_chalk44.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk44.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
       return;
     }
-    console.log(import_chalk41.default.dim(`Pre-approved for ${import_chalk41.default.bold(tenant2)}:`));
+    console.log(import_chalk44.default.dim(`Pre-approved for ${import_chalk44.default.bold(tenant2)}:`));
     for (const r of rules) {
-      const tag = r.kind === "domain" ? import_chalk41.default.cyan("@" + r.value + " (whole domain)") : r.value;
-      const grp = r.groups?.length ? import_chalk41.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      const tag = r.kind === "domain" ? import_chalk44.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk44.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
       console.log(`  ${tag}${grp}`);
     }
     return;
@@ -6726,19 +8005,19 @@ async function runPreapprove(who, opts) {
     throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
   }
   if (opts.remove) {
-    const spinner2 = (0, import_ora20.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const spinner2 = (0, import_ora22.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
-    if (removed) spinner2.succeed(`${import_chalk41.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
-    else spinner2.warn(`No pre-approval rule for ${import_chalk41.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    if (removed) spinner2.succeed(`${import_chalk44.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk44.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
-  const spinner = (0, import_ora20.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  const spinner = (0, import_ora22.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
-    spinner.succeed(`${import_chalk41.default.bold(what)} can now sign in to ${import_chalk41.default.bold(tenant2)}.`);
-    if (opts.group?.length) console.log(import_chalk41.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
-    console.log(import_chalk41.default.dim(`  See the full list:  apiblaze preapprove --list`));
+    spinner.succeed(`${import_chalk44.default.bold(what)} can now sign in to ${import_chalk44.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk44.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk44.default.dim(`  See the full list:  apiblaze preapprove --list`));
   } catch (err) {
     spinner.fail("Could not add the rule.");
     throw err;
@@ -6749,8 +8028,8 @@ async function runPreapprove(who, opts) {
 var fs9 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk43 = __toESM(require("chalk"));
-var import_ora21 = __toESM(require("ora"));
+var import_chalk46 = __toESM(require("chalk"));
+var import_ora23 = __toESM(require("ora"));
 var import_yaml2 = require("yaml");
 init_auth();
 init_anon_cred();
@@ -6760,7 +8039,7 @@ init_admin();
 // src/commands/llm.ts
 var fs8 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
-var import_chalk42 = __toESM(require("chalk"));
+var import_chalk45 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_auth();
 var LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
@@ -6804,27 +8083,27 @@ async function runLlmSetKey(keyArg, opts) {
   }
   const existing = loadLlmConfig();
   saveLlmConfig({ key, provider, model: opts.model ?? existing?.model });
-  console.log(`${import_chalk42.default.green("\u2713")} Saved ${import_chalk42.default.bold(provider)} key ${maskSecret(key)}`);
-  console.log(import_chalk42.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
-  if (opts.model) console.log(import_chalk42.default.gray(`  Model: ${opts.model}`));
+  console.log(`${import_chalk45.default.green("\u2713")} Saved ${import_chalk45.default.bold(provider)} key ${maskSecret(key)}`);
+  console.log(import_chalk45.default.gray(`  Stored locally at ${LLM_PATH} (0600) \u2014 never sent to APIblaze except per chat turn.`));
+  if (opts.model) console.log(import_chalk45.default.gray(`  Model: ${opts.model}`));
 }
 async function runLlmShow() {
   const cfg = loadLlmConfig();
   if (!cfg) {
-    console.log(import_chalk42.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
+    console.log(import_chalk45.default.gray("No LLM key set. `apiblaze llm set-key sk-...` to add one (optional \u2014 chat works without it)."));
     return;
   }
-  console.log(`Provider: ${import_chalk42.default.bold(cfg.provider)}`);
+  console.log(`Provider: ${import_chalk45.default.bold(cfg.provider)}`);
   console.log(`Key:      ${maskSecret(cfg.key)}`);
   if (cfg.model) console.log(`Model:    ${cfg.model}`);
-  console.log(import_chalk42.default.gray(`Stored at ${LLM_PATH}`));
+  console.log(import_chalk45.default.gray(`Stored at ${LLM_PATH}`));
 }
 async function runLlmClearKey() {
   try {
     fs8.unlinkSync(LLM_PATH);
-    console.log(`${import_chalk42.default.green("\u2713")} Removed local LLM key.`);
+    console.log(`${import_chalk45.default.green("\u2713")} Removed local LLM key.`);
   } catch {
-    console.log(import_chalk42.default.gray("No LLM key was set."));
+    console.log(import_chalk45.default.gray("No LLM key was set."));
   }
 }
 
@@ -6832,12 +8111,12 @@ async function runLlmClearKey() {
 init_trace();
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk43.default.red(`
+  console.error(import_chalk46.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk43.default.dim(hint));
+  if (hint) console.error(import_chalk46.default.dim(hint));
   process.exit(1);
 }
-function normalizeName2(raw) {
+function normalizeName3(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
 function isHttpUrl2(s) {
@@ -6982,7 +8261,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk43.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk46.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -7055,11 +8334,11 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     const fresh = await validConsumerToken(existing);
     if (fresh) {
       if (fresh.accessToken !== existing.accessToken) saveConsumer({ ...fresh, resource });
-      console.log(import_chalk43.default.dim(`  Using your consumer session on ${import_chalk43.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      console.log(import_chalk46.default.dim(`  Using your consumer session on ${import_chalk46.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
       return fresh;
     }
   }
-  const spinner = (0, import_ora21.default)(`Finding the login app for ${tenant2}...`).start();
+  const spinner = (0, import_ora23.default)(`Finding the login app for ${tenant2}...`).start();
   const clients = await admin({
     method: "GET",
     path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`,
@@ -7074,13 +8353,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     );
   }
   const clientId = pick2.client_id ?? pick2.clientId;
-  console.log(`${import_chalk43.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk43.default.bold(tenant2)}...`);
+  console.log(`${import_chalk46.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk46.default.bold(tenant2)}...`);
   const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk43.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk43.default.bold(userCode)}
+  Open: ${import_chalk46.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk46.default.bold(userCode)}
 `);
-    console.log(import_chalk43.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk46.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, resource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -7096,7 +8375,7 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     resource
   };
   saveConsumer(creds);
-  console.log(`  ${import_chalk43.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk43.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  console.log(`  ${import_chalk46.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk46.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
 async function cpPost(anon, path8, body, summary) {
@@ -7111,21 +8390,21 @@ async function provision(spec2, target, opts) {
   const loggedIn = !!loadCredentials();
   const anon = !loggedIn;
   const salt = () => Math.random().toString(36).slice(2, 6);
-  let base2 = opts.name ? normalizeName2(opts.name) : "";
+  let base2 = opts.name ? normalizeName3(opts.name) : "";
   if (!base2) {
     try {
       const host = new URL(target).hostname;
-      base2 = normalizeName2(host.split(".")[0]);
-      if (base2.length < 3) base2 = normalizeName2(host);
+      base2 = normalizeName3(host.split(".")[0]);
+      if (base2.length < 3) base2 = normalizeName3(host);
     } catch {
     }
   }
-  if (!base2 && spec2.info && typeof spec2.info.title === "string") base2 = normalizeName2(spec2.info.title);
+  if (!base2 && spec2.info && typeof spec2.info.title === "string") base2 = normalizeName3(spec2.info.title);
   if (!base2 || base2.length < 3) base2 = "apichat";
   let name = opts.name ? base2 : `${base2}${salt()}`;
   const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
   if (anon && opts.access === "invite") {
-    console.log(import_chalk43.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+    console.log(import_chalk46.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
   }
   const DUAL_AUTH = {
     mode: "authenticate",
@@ -7137,7 +8416,7 @@ async function provision(spec2, target, opts) {
     yes: opts.yes,
     json: opts.json
   }) : void 0;
-  const spinner = (0, import_ora21.default)("Provisioning an api_key proxy...").start();
+  const spinner = (0, import_ora23.default)("Provisioning an api_key proxy...").start();
   let result;
   for (let attempt = 0; attempt < 4; attempt++) {
     try {
@@ -7224,14 +8503,14 @@ async function provision(spec2, target, opts) {
       try {
         await addPreapprovalRule(tenant2, email);
       } catch {
-        console.log(import_chalk43.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+        console.log(import_chalk46.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
       }
     }
   }
   return { projectId, version: version2, environment, dpKey, mcpHost, proxyUrl, anon, access, tenant: tenant2 };
 }
 async function writeTargetAuth(p, auth, secret) {
-  const spinner = (0, import_ora21.default)("Storing target credentials (encrypted)...").start();
+  const spinner = (0, import_ora23.default)("Storing target credentials (encrypted)...").start();
   try {
     await cpPost(
       p.anon,
@@ -7253,7 +8532,7 @@ async function writeTargetAuth(p, auth, secret) {
   }
 }
 async function uploadSpec(p, specText, opts) {
-  const spinner = (0, import_ora21.default)("Uploading the spec...").start();
+  const spinner = (0, import_ora23.default)("Uploading the spec...").start();
   let out;
   try {
     out = await cpPost(
@@ -7268,7 +8547,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk43.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk46.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -7276,12 +8555,12 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk43.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk46.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
 async function publishMcp(p, spec2) {
-  const spinner = (0, import_ora21.default)("Publishing the MCP catalogue...").start();
+  const spinner = (0, import_ora23.default)("Publishing the MCP catalogue...").start();
   try {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
@@ -7317,15 +8596,15 @@ var revealAuth = false;
 function renderToolEvents(events, cred) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk43.default.green("\u2713") : import_chalk43.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk43.default.cyan(e.name)} ${import_chalk43.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
+    const mark = ok ? import_chalk46.default.green("\u2713") : import_chalk46.default.red("\u2717");
+    console.log(`  ${mark} ${import_chalk46.default.cyan(e.name)} ${import_chalk46.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk43.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
+      console.log(import_chalk46.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
       if (cred) {
         const shown = revealAuth ? cred.value : maskKey(cred.value);
         const keyLine = `        -H '${cred.header}: ${shown}'`;
-        const hint = revealAuth ? "" : import_chalk43.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk43.default.dim(keyLine) + hint);
+        const hint = revealAuth ? "" : import_chalk46.default.yellow("  \u2190 /showauth will reveal this");
+        console.log(import_chalk46.default.dim(keyLine) + hint);
       }
     }
   }
@@ -7346,20 +8625,20 @@ function renderToolResults(delta, events) {
       }
     })();
     const lines = pretty.split("\n");
-    console.log(import_chalk43.default.dim("      response:"));
+    console.log(import_chalk46.default.dim("      response:"));
     for (const line of lines.slice(0, cap)) {
-      console.log(import_chalk43.default.dim(`        ${line}`));
+      console.log(import_chalk46.default.dim(`        ${line}`));
     }
-    if (lines.length > cap) console.log(import_chalk43.default.dim(`        \u2026${lines.length - cap} more lines`));
+    if (lines.length > cap) console.log(import_chalk46.default.dim(`        \u2026${lines.length - cap} more lines`));
   }
 }
 function billingLine(billing) {
   if (!billing || typeof billing.cents !== "number") return null;
   if (typeof billing.free_turns_remaining === "number") return null;
   const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk43.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk43.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
+  let line = import_chalk46.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk46.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
   if (typeof billing.credits_remaining === "number") {
-    line += import_chalk43.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk46.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -7367,21 +8646,21 @@ function freeBudgetWarning(billing, anon) {
   if (!anon || !billing) return null;
   if (typeof billing.free_turns_remaining === "number") {
     const left2 = billing.free_turns_remaining;
-    if (left2 <= 0) return import_chalk43.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk43.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
+    if (left2 <= 0) return import_chalk46.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk46.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof billing.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(billing.cents || 0, 0.02);
   const left = Math.floor(billing.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk43.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk43.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk46.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk46.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 function printAssistant(delta) {
   for (let i = delta.length - 1; i >= 0; i--) {
     const m = delta[i];
     if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk43.default.green("assistant \u203A ") + m.content + "\n");
+      console.log("\n" + import_chalk46.default.green("assistant \u203A ") + m.content + "\n");
       return;
     }
   }
@@ -7391,7 +8670,7 @@ async function replTurn(p, messages, userText) {
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
   for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora21.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
+    const spinner = (0, import_ora23.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
     const body = {
       turn_id: turnId,
       messages,
@@ -7407,7 +8686,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk43.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk46.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     let data = null;
@@ -7427,9 +8706,9 @@ async function replTurn(p, messages, userText) {
     if (res.status === 401) {
       const reason = data && (data.error || data.message) || null;
       const usingKey = !p.consumerAuth;
-      console.log(import_chalk43.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
+      console.log(import_chalk46.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
       console.log(
-        import_chalk43.default.dim(
+        import_chalk46.default.dim(
           usingKey ? "  Sent an API key. If the key was revoked, re-run `apiblaze apichat` to re-provision." : "  Sent your consumer OAuth token. Re-run `apiblaze apichat` to sign in again."
         )
       );
@@ -7437,7 +8716,7 @@ async function replTurn(p, messages, userText) {
     }
     if (!res.ok || !data) {
       const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk43.default.red(`  Chat error: ${err}`));
+      console.log(import_chalk46.default.red(`  Chat error: ${err}`));
       return;
     }
     if (Array.isArray(data.delta)) {
@@ -7458,25 +8737,25 @@ async function replTurn(p, messages, userText) {
     if (warn) console.log(warn);
     if (!data.continue) return;
   }
-  console.log(import_chalk43.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
+  console.log(import_chalk46.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
 }
 function renderUpsell(p, upsell) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk43.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk43.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk46.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk46.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
-  console.log("\n" + import_chalk43.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  console.log("\n" + import_chalk46.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "QUOTA" || upsell.reason === "PROXY_CAP" || upsell.reason === "PAUSED" || upsell.reason === "BYO_REQUIRED") {
     if (!loggedIn) {
-      console.log(import_chalk43.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk46.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk43.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk46.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk43.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk46.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
@@ -7569,9 +8848,9 @@ async function openServerProxy(project) {
   let consumerAuth = false;
   if (acceptsApiKey) {
     if (!dpKey) {
-      console.log(import_chalk43.default.dim(`  Minting an API key for tenant ${import_chalk43.default.bold(tenant2)} to query project ${import_chalk43.default.bold(project.projectName)}\u2026`));
+      console.log(import_chalk46.default.dim(`  Minting an API key for tenant ${import_chalk46.default.bold(tenant2)} to query project ${import_chalk46.default.bold(project.projectName)}\u2026`));
       dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-      console.log(`  ${import_chalk43.default.green("\u2714")} API key: ${import_chalk43.default.dim(maskKey(dpKey))}`);
+      console.log(`  ${import_chalk46.default.green("\u2714")} API key: ${import_chalk46.default.dim(maskKey(dpKey))}`);
     }
   } else {
     consumerAuth = true;
@@ -7590,7 +8869,7 @@ async function openServerProxy(project) {
     // Reusing an owned proxy: logged-in apichat doors default to invite-only.
     access: "invite"
   };
-  const spinner = (0, import_ora21.default)("Preparing the chat\u2026").start();
+  const spinner = (0, import_ora23.default)("Preparing the chat\u2026").start();
   try {
     const raw = await admin({
       method: "GET",
@@ -7600,9 +8879,9 @@ async function openServerProxy(project) {
     const spec2 = raw && (raw.spec ?? raw);
     spinner.stop();
     if (!spec2 || !(spec2.paths || spec2.openapi)) {
-      console.log(import_chalk43.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk46.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     } else {
-      console.log(import_chalk43.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
+      console.log(import_chalk46.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -7658,7 +8937,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk43.default.bold(a.name)} ${import_chalk43.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk46.default.bold(a.name)} ${import_chalk46.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -7668,14 +8947,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk43.default.bold(pr.projectName)} ${import_chalk43.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk46.default.bold(pr.projectName)} ${import_chalk46.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk43.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk46.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -7778,36 +9057,36 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk43.default.cyan.bold("Chat with your API") + import_chalk43.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk43.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk46.default.cyan.bold("Chat with your API") + import_chalk46.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk46.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk43.default.dim(
+    import_chalk46.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk43.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk46.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk43.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk46.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk43.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       const justLoggedIn = !loadCredentials();
       if (justLoggedIn) {
-        console.log(import_chalk43.default.dim("  Logging in to claim your workspace\u2026"));
+        console.log(import_chalk46.default.dim("  Logging in to claim your workspace\u2026"));
         try {
           await runLogin();
         } catch (err) {
-          console.log(import_chalk43.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           continue;
         }
         if (!loadCredentials()) continue;
@@ -7818,30 +9097,30 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk43.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk46.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk43.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk46.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk43.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk46.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk43.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk46.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk43.default.dim("\nBye."));
+  console.log(import_chalk46.default.dim("\nBye."));
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk43.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk46.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -7854,7 +9133,7 @@ async function runApichat(opts) {
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk43.default.dim("Target:")} ${import_chalk43.default.bold(target)}`);
+  console.log(`  ${import_chalk46.default.dim("Target:")} ${import_chalk46.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -7863,7 +9142,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk43.default.dim("Proxy: ")} ${import_chalk43.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk46.default.dim("Proxy: ")} ${import_chalk46.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -7883,38 +9162,38 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk43.default.dim("  Target auth: none required."));
+    console.log(import_chalk46.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk43.default.green("\u2713")} proxy  ${import_chalk43.default.bold(p.proxyUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk46.default.green("\u2713")} proxy  ${import_chalk46.default.bold(p.proxyUrl)}`);
   if (mcpUrl) {
-    console.log(`  ${import_chalk43.default.green("\u2713")} mcp    ${import_chalk43.default.bold(mcpUrl)}`);
+    console.log(`  ${import_chalk46.default.green("\u2713")} mcp    ${import_chalk46.default.bold(mcpUrl)}`);
     if (p.access === "invite") {
-      console.log(import_chalk43.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
-      console.log(import_chalk43.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk46.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
     } else {
-      console.log(import_chalk43.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
     }
   }
   if (p.anon) {
-    console.log(import_chalk43.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
+    console.log(import_chalk46.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk44 = __toESM(require("chalk"));
-var import_ora22 = __toESM(require("ora"));
+var import_chalk47 = __toESM(require("chalk"));
+var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 var DEFAULT_SCOPE = "openid email profile offline_access";
-var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
+var APIKEYS_BASE2 = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
   const fresh = await validConsumerToken(creds) ?? creds;
-  const res = await fetch(`${APIKEYS_BASE}${suffix}`, {
+  const res = await fetch(`${APIKEYS_BASE2}${suffix}`, {
     ...init,
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${fresh.accessToken}`, ...init?.headers ?? {} }
   });
@@ -7928,7 +9207,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk44.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk47.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -7939,7 +9218,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk44.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk47.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -7951,24 +9230,24 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora22.default)("Finding the login app...").start();
+    const s2 = (0, import_ora24.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk44.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk47.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk44.default.cyan("\u2192")} Logging in to ${import_chalk44.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk47.default.cyan("\u2192")} Logging in to ${import_chalk47.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk44.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk44.default.bold(userCode)}
+  Open: ${import_chalk47.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk47.default.bold(userCode)}
 `);
-    console.log(import_chalk44.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk47.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -7983,7 +9262,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk44.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk47.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer2();
@@ -7996,29 +9275,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk44.default.cyan("Consumer")} ${import_chalk44.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk44.default.bold(fresh.tenant)}
+  console.log(`${import_chalk47.default.cyan("Consumer")} ${import_chalk47.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk47.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk44.default.bold("access_token")}  ${import_chalk44.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk47.default.bold("access_token")}  ${import_chalk47.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk44.default.bold("id_token")}      ${import_chalk44.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk47.default.bold("id_token")}      ${import_chalk47.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk44.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk47.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk44.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk47.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora22.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora24.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk44.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk44.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk47.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk47.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -8026,16 +9305,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk44.default.yellow("No API keys yet."));
+    console.log(import_chalk47.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk44.default.green(clear) : import_chalk44.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk44.default.dim(`exp ${k.expires_at}`) : import_chalk44.default.dim("no expiry");
-      console.log(`  ${import_chalk44.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk44.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk47.default.green(clear) : import_chalk47.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk47.default.dim(`exp ${k.expires_at}`) : import_chalk47.default.dim("no expiry");
+      console.log(`  ${import_chalk47.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk47.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk44.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk47.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -8049,7 +9328,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora22.default)("Creating key...").start();
+  const s2 = (0, import_ora24.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -8057,13 +9336,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk44.default.green(key)}  ${import_chalk44.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk44.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk47.default.green(key)}  ${import_chalk47.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk47.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk45 = __toESM(require("chalk"));
-var import_ora23 = __toESM(require("ora"));
+var import_chalk48 = __toESM(require("chalk"));
+var import_ora25 = __toESM(require("ora"));
 var fs10 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_admin();
@@ -8105,18 +9384,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk45.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk48.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs10.existsSync(path7.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora23.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora25.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk45.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk45.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk48.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk48.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -8255,7 +9534,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora23.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora25.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -8267,29 +9546,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk45.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk45.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk45.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk45.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk48.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk45.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk45.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk45.default.cyan("apiblaze login")}  then  ${import_chalk45.default.cyan("apiblaze claim")}   ${import_chalk45.default.dim("(no code needed here)")}`);
-  console.log(import_chalk45.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk48.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk48.default.cyan("apiblaze login")}  then  ${import_chalk48.default.cyan("apiblaze claim")}   ${import_chalk48.default.dim("(no code needed here)")}`);
+  console.log(import_chalk48.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path7.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk45.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk48.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -8300,10 +9579,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk45.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk48.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk45.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk48.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -8312,7 +9591,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora23.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora25.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -8326,39 +9605,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk45.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk48.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk45.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk45.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk45.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk45.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk45.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk45.default.bold("candidates")} \u2014 list them:  ${import_chalk45.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk45.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk48.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk48.default.bold("candidates")} \u2014 list them:  ${import_chalk48.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk45.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk45.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk48.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk48.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk45.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk45.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk45.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk48.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk48.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk48.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk45.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk45.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk48.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk48.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk46 = __toESM(require("chalk"));
-var import_ora24 = __toESM(require("ora"));
+var import_chalk49 = __toESM(require("chalk"));
+var import_ora26 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -8368,7 +9647,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk46.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk49.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -8386,30 +9665,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk46.default.bold(`
+  console.log(import_chalk49.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk46.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk46.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk46.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk46.default.bold(`
+  if (!routed.length) console.log(import_chalk49.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk49.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk49.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk49.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk46.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk49.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk46.default.yellow("\u25CB")} ${c.origin}  ${import_chalk46.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk49.default.yellow("\u25CB")} ${c.origin}  ${import_chalk49.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk46.default.dim(`
+    console.log(import_chalk49.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk46.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk49.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk46.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk49.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora24.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora26.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -8420,7 +9699,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora24.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora26.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -8437,7 +9716,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora24.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora26.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -8448,7 +9727,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora24.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora26.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -8459,7 +9738,7 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk47 = __toESM(require("chalk"));
+var import_chalk50 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
@@ -8492,82 +9771,82 @@ function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk47.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk47.default.bold("\n  Upstash"));
+  console.log(import_chalk50.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk50.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk47.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk47.default.yellow(o.key)} ${import_chalk47.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk47.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk50.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk50.default.yellow(o.key)} ${import_chalk50.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk50.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk47.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk50.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk47.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk50.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk47.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk47.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
-  console.log(import_chalk47.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk50.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk50.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk50.default.red(`    error: ${e}`));
+  console.log(import_chalk50.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk47.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk50.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk47.default.yellow(s.store_id)} ${import_chalk47.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk50.default.yellow(s.store_id)} ${import_chalk50.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk47.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk50.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk47.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk50.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk47.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk50.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk47.default.yellow(s.store_id)} ${import_chalk47.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk50.default.yellow(s.store_id)} ${import_chalk50.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk47.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk50.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk47.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk50.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
-  console.log(import_chalk47.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk50.default.red(`    error: ${e}`));
+  console.log(import_chalk50.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk47.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk47.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk47.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk50.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk50.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk50.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk47.default.green(`    no ghost tuples ${import_chalk47.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk50.default.green(`    no ghost tuples ${import_chalk50.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk47.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk50.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk47.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk50.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk47.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk50.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk47.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk50.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk47.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk50.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk47.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk50.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk47.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk47.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk47.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk47.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk47.default.cyan("apiblaze op credits")}        list credit wallets`);
-      console.log(import_chalk47.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
+      console.log(import_chalk50.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk50.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk50.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk50.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk50.default.cyan("apiblaze op credits")}        list credit wallets`);
+      console.log(import_chalk50.default.dim(`  (to prune all non-CP data: run scripts/nuke-but-cp.sh --apply --sweep in the repo)
 `));
       return;
     }
@@ -8586,17 +9865,17 @@ async function runOp(sub, opts = {}) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk47.default.green("Nothing to sweep."));
+        console.log(import_chalk50.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline3 = await import("readline/promises");
         const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk47.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk50.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk47.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk50.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -8607,15 +9886,15 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk47.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk50.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk47.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk47.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk47.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk50.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk50.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk50.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk47.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk50.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -8678,7 +9957,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk48.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk51.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile, newSession: opts.newSession });
@@ -8727,6 +10006,11 @@ program.command("projects").description("List the projects in your team").action
     process.exit(1);
   }
 });
+program.command("search").description("Find a published recipe \u2014 a whole working proxy someone else set up").argument("[query]", "Words to match against a recipe name or summary").option("--limit <n>", "Maximum results (default 25)").option("--json", "Output machine-readable JSON").action(action((query, opts) => runRecipeSearch(query, opts)));
+program.command("show").description("Read a recipe before you install it (upstreams, questions, transforms, spec)").argument("<recipe>", "Recipe name, e.g. @julien/gmail or @julien/gmail@2").option("--settings", "Print the settings section").option("--auth", "Print the auth section (login provider, key types)").option("--transforms", "Print the transform rules and mapping tables").option("--openapi", "Print the OpenAPI document").option("--json", "Output machine-readable JSON").action(action((recipe, opts) => runRecipeShow(recipe, opts)));
+program.command("install").description("Create a proxy from a recipe, with your own credentials").argument("<recipe>", "Recipe name, e.g. @julien/gmail or @julien/gmail@2 to pin a revision").option("--as <name>", "Proxy name (skips the name prompt)").option("--into <proxy>", "Reinstall over an existing proxy \u2014 replaces its settings, transforms and spec").option("--team <id|name>", "Team the proxy is created in (you are asked when you belong to several)").option("--apiversion <v>", "API version of the proxy named by --into").option("-y, --yes", "Skip the routine prompts (installs WITHOUT anything needing consent)").action(action((recipe, opts) => runRecipeInstall(recipe, opts)));
+program.command("publish").description("Publish one of your proxies as a recipe others can install").argument("<project>", "Project name or id (see `apiblaze projects`)").option("--as <name>", "Recipe name. Defaults to your GitHub handle + the proxy name; pass `pokedex` for just the name, or `@acme/pokedex` to set both").option("--private", "Only your team can see or install it (default is public)").option("--tenant <slug>", "Which tenant's auth setup the recipe carries (asked when a proxy has several)").option("--display-name <text>", "Human-readable title").option("--summary <text>", "One-line description shown in search").option("--license <id>", "Licence identifier, e.g. MIT").option("--team <id|name>", "Team the project is in (defaults to active team)").option("--apiversion <v>", "API version to publish (defaults to the first match)").option("-y, --yes", "Skip routine confirmations (never accepts scanner findings)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRecipePublish(project, opts)));
+program.command("withdraw").description("Permanently delete one published recipe revision").argument("<recipe>", "Recipe revision, e.g. @julien/gmail@3").option("--team <id|name>", "Team that published it (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((recipe, opts) => runRecipeWithdraw(recipe, opts)));
 program.command("delete").description("Delete a proxy and everything under it (asks first)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--team <id|name>", "Team the project is in (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").option("--json", "Output machine-readable JSON").action(action((project, version2, opts) => runDelete(project, version2, opts)));
 program.command("export").description("Export config and data for migration out of APIblaze (Kong, ...)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--kong", "Produce a runnable Kong OSS bundle (decK config + plugins + docker-compose)").option("--data", "Plain data export (default)").option("--secrets", "Include decrypted producer-supplied secrets (member role; audit-logged)").option("--keys <mode>", "API-key export: hashes (default, consumers keep keys) | mint | none").option("--no-consumers", "Skip the end-user lane (users, groups, keys)").option("-o, --out <file>", "Output zip path").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, opts) => runExport(project, version2, { ...opts, noConsumers: opts.consumers === false })));
 var logs = program.command("logs").description("API Producer view \u2014 stream this proxy's requests from EVERY caller live (see `apiblaze logs list` to browse past days)").argument("<project>", "Project name or id (see `apiblaze projects`)").argument("[version]", "API version (defaults to the first match)").option("--tenant <slug>", "Tenant to tail (auto when one is attached; prompted otherwise)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit raw NDJSON rows (pipe into jq)").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, opts) => runLogsTail(project, version2, opts)));
@@ -8782,6 +10066,7 @@ spec.command("delete-rule").description("Delete the saved rules for a route (e.g
 var HELP_GROUPS = [
   { title: "Chat", commands: ["apichat", "agent"] },
   { title: "Setup", commands: ["login", "create", "init", "sidecar", "dev", "claim", "team", "whoami", "logout"] },
+  { title: "Recipes \u2014 install a working setup, or publish yours", commands: ["search", "show", "install", "publish", "withdraw"] },
   { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
@@ -8802,7 +10087,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk48.default.bold(g.title)}
+    return `${import_chalk51.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -8826,6 +10111,9 @@ Examples:
   $ npx apiblaze agent                                   # just chat
   $ npx apiblaze create --target https://api.example.com # one-line API
   $ npx apiblaze create --openapi https://pokeapi.co/openapi.yaml  # build it from a spec URL
+  $ npx apiblaze search gmail                            # find a recipe (no login needed)
+  $ npx apiblaze install @julien/gmail                   # someone's whole working setup, your credentials
+  $ npx apiblaze publish mygmail                         # share yours back, as @yourgithubhandle/mygmail
   $ npx apiblaze dev 3000                                # localhost \u2192 public URL
   $ npx apiblaze throttle myapi --rate 50 --verbose      # configure + show the API call
   $ npx apiblaze consumer login                          # act as a consumer of your API
@@ -8837,14 +10125,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk48.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk51.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk48.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk48.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk51.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk51.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -8852,16 +10140,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk48.default.red(`
+    console.error(import_chalk51.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk48.default.red(`
+    console.error(import_chalk51.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk48.default.red("\nUnknown error"));
+    console.error(import_chalk51.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);