apiblaze 0.20.10 → 0.20.13

package/dist/index.js

@@ -137,8 +137,8 @@ async function createProxyAnonymous(body) {
   }
   return res.json();
 }
-async function apiFetch(path8, options = {}, auth) {
-  const url = `${DASHBOARD_BASE}${path8}`;
+async function apiFetch(path9, options = {}, auth) {
+  const url = `${DASHBOARD_BASE}${path9}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -164,12 +164,12 @@ async function apiFetch(path8, options = {}, auth) {
   }
   return res.json();
 }
-async function agentCall(path8, method, body) {
+async function agentCall(path9, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path8, method, body })
+    body: JSON.stringify({ path: path9, method, body })
   });
   let data = null;
   try {
@@ -1021,10 +1021,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk52 = __toESM(require("chalk"));
+var import_chalk53 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.20.10";
+var version = "0.20.13";
 
 // src/index.ts
 init_types();
@@ -1290,11 +1290,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path8) {
-  const q = path8.indexOf("?");
-  if (q < 0) return path8;
-  const base2 = path8.slice(0, q);
-  const query = path8.slice(q + 1);
+function maskPath(path9) {
+  const q = path9.indexOf("?");
+  if (q < 0) return path9;
+  const base2 = path9.slice(0, q);
+  const query = path9.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -2328,7 +2328,7 @@ async function runCreate(opts = {}) {
   }
   let openapiContent = null;
   if (opts.openapi !== void 0) {
-    if (opts.target !== void 0) fail("Provide only one of --target or --openapi.");
+    if (opts.target !== void 0) fail("Provide only one source (the smart --target covers servers, spec files and spec URLs).");
     openapiContent = await loadOpenapiSource(opts.openapi);
   }
   let targetUrl = "";
@@ -2352,7 +2352,7 @@ async function runCreate(opts = {}) {
       break;
     }
   } else {
-    fail("--target or --openapi is required in non-interactive mode.");
+    fail("--target is required in non-interactive mode (a server base URL, a local OpenAPI file, or a remote OpenAPI URL).");
   }
   if (interactive && !opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
@@ -3529,8 +3529,8 @@ function resolveRecipeName(raw, githubHandle, proxyName) {
 function normalizeName2(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-async function publicFetch(path8) {
-  const res = await fetch(`${RECIPES_BASE}/api/recipes${path8}`, {
+async function publicFetch(path9) {
+  const res = await fetch(`${RECIPES_BASE}/api/recipes${path9}`, {
     headers: { accept: "application/json" }
   }).catch((err) => {
     throw new Error(`Could not reach the recipe registry at ${RECIPES_BASE} \u2014 ${err.message}`);
@@ -3583,11 +3583,11 @@ async function fetchRecipeFile(ref, caller) {
        Private recipes are visible only to the publisher's team \u2014 run \`apiblaze login\` if you are on it.`
     );
   }
-  const path8 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
+  const path9 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
   try {
     return await producer(caller, {
       method: "GET",
-      path: path8,
+      path: path9,
       summary: `Read private recipe ${ref.name}${revision !== void 0 ? `@${revision}` : ""}`
     });
   } catch (err) {
@@ -4739,9 +4739,9 @@ function printEnvelopeViolations(violations) {
   console.log("bring-your-own-key case. Change the rules above, then publish again.");
   console.log();
 }
-async function askPromotion(path8) {
+async function askPromotion(path9) {
   const { default: inquirer3 } = await import("inquirer");
-  const suggestedId = path8.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
+  const suggestedId = path9.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
   const answers = await inquirer3.prompt([
     { type: "input", name: "prompt", message: "  prompt them with:", validate: (v) => v.trim() ? true : "Required." },
     { type: "input", name: "example", message: "  example:" },
@@ -4752,7 +4752,7 @@ async function askPromotion(path8) {
   const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
   console.log(import_chalk27.default.dim(`      \u2192 replaced with {{${id}}}`));
   return {
-    path: path8,
+    path: path9,
     id,
     prompt: String(answers.prompt).trim(),
     ...answers.example ? { example: String(answers.example).trim() } : {},
@@ -7802,11 +7802,11 @@ async function resolveTransport(opts) {
     const token = getAccessToken();
     return {
       tenant: tenant2,
-      call: async (path8, method = "GET", body) => {
+      call: async (path9, method = "GET", body) => {
         const res = await fetch(`${DASHBOARD_BASE6}/api/cli/iam`, {
           method: "POST",
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-          body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+          body: JSON.stringify({ tenant: tenant2, path: path9, method, body })
         });
         const data = await res.json().catch(() => ({}));
         if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -7824,8 +7824,8 @@ async function resolveTransport(opts) {
     return {
       tenant: fresh.tenant,
       selfEmail: fresh.email,
-      call: async (path8, method = "GET", body) => {
-        const res = await fetch(`${IAM_BASE}${path8}`, {
+      call: async (path9, method = "GET", body) => {
+        const res = await fetch(`${IAM_BASE}${path9}`, {
           method,
           headers: {
             "Content-Type": "application/json",
@@ -8177,12 +8177,12 @@ init_admin();
 init_resolve();
 init_types();
 var DASHBOARD_BASE7 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
-async function iamCall(tenant2, path8, method = "GET", body) {
+async function iamCall(tenant2, path9, method = "GET", body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE7}/api/cli/iam`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+    body: JSON.stringify({ tenant: tenant2, path: path9, method, body })
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -8269,10 +8269,10 @@ async function runPreapprove(who, opts) {
 }
 
 // src/commands/apichat.ts
-var fs10 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk46 = __toESM(require("chalk"));
+var import_chalk47 = __toESM(require("chalk"));
 var import_ora23 = __toESM(require("ora"));
 var import_yaml3 = require("yaml");
 init_auth();
@@ -8353,11 +8353,238 @@ async function runLlmClearKey() {
 
 // src/commands/apichat.ts
 init_trace();
+
+// src/lib/external-mcp.ts
+var fs10 = __toESM(require("fs"));
+var os4 = __toESM(require("os"));
+var path6 = __toESM(require("path"));
+var import_child_process2 = require("child_process");
+var import_chalk46 = __toESM(require("chalk"));
+var useShell = process.platform === "win32";
+var winQuote = (a) => /^[A-Za-z0-9_\-.:/\\=]+$/.test(a) ? a : `"${a.replace(/"/g, '""')}"`;
+var run = (cmd, args, opts = {}) => (0, import_child_process2.spawnSync)(cmd, useShell ? args.map(winQuote) : args, {
+  encoding: "utf-8",
+  stdio: opts.interactive ? ["inherit", "inherit", "inherit"] : opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+  timeout: opts.inherit || opts.interactive ? void 0 : 15e3,
+  shell: useShell
+});
+var detected = null;
+function detectExternalClis() {
+  if (detected) return detected;
+  const found = [];
+  for (const [kind, label3] of [["claude", "Claude CLI"], ["codex", "Codex CLI"]]) {
+    try {
+      const r = run(kind, ["--version"]);
+      if (r.status === 0) found.push({ kind, label: label3, version: (r.stdout || "").trim().split("\n")[0] || void 0 });
+    } catch {
+    }
+  }
+  detected = found;
+  return found;
+}
+var OURS = /\.mcp\.(abz\.run|tryabz\.run|apiblaze\.com)\b/;
+var mask = (k) => k.length > 14 ? `${k.slice(0, 10)}\u2026${k.slice(-4)}` : "\u2022\u2022\u2022";
+async function verifyMcpEndpoint(spec2) {
+  try {
+    const headers = { "Content-Type": "application/json" };
+    if (spec2.apiKey) headers["X-API-Key"] = spec2.apiKey;
+    if (spec2.endUserId) headers["X-End-User-Id"] = spec2.endUserId;
+    const res = await fetch(spec2.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return { ok: false, status: res.status, tools: 0 };
+    const body = await res.json().catch(() => null);
+    if (!spec2.apiKey) return { ok: true, status: res.status, tools: body?.result?.tools?.length ?? 0 };
+    if (body?.error) return { ok: false, status: res.status, tools: 0 };
+    return { ok: true, status: res.status, tools: body?.result?.tools?.length ?? 0 };
+  } catch {
+    return { ok: false, status: 0, tools: 0 };
+  }
+}
+function claudeInstallArgs(spec2, masked = false) {
+  const args = ["mcp", "add", "--transport", "http", spec2.name, spec2.url];
+  if (spec2.apiKey) args.push("--header", `X-API-Key: ${masked ? mask(spec2.apiKey) : spec2.apiKey}`);
+  if (spec2.endUserId) args.push("--header", `X-End-User-Id: ${spec2.endUserId}`);
+  return args;
+}
+function installIntoClaude(spec2) {
+  const existing = run("claude", ["mcp", "get", spec2.name]);
+  if (existing.status === 0) {
+    const desc = existing.stdout || "";
+    if (!OURS.test(desc)) {
+      return {
+        ok: false,
+        conflict: true,
+        error: `Claude CLI already has an MCP server named "${spec2.name}" that is not an APIblaze proxy \u2014 not touching it. Remove or rename it (claude mcp remove ${spec2.name}) and re-run.`
+      };
+    }
+    run("claude", ["mcp", "remove", spec2.name]);
+  }
+  const r = run("claude", claudeInstallArgs(spec2));
+  if (r.status === 0) return { ok: true };
+  return { ok: false, error: (r.stderr || r.stdout || `exit ${r.status}`).trim().slice(0, 400) };
+}
+function claudeOneShot(spec2, prompt) {
+  const argv = ["claude", "-p", prompt, "--allowedTools", `mcp__${spec2.name}__*`];
+  const r = run(argv[0], argv.slice(1), { inherit: true });
+  return { argv, status: r.status };
+}
+function codexConfigPath() {
+  return path6.join(process.env.CODEX_HOME || path6.join(os4.homedir(), ".codex"), "config.toml");
+}
+var tomlStr = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+function codexServerBlock(spec2) {
+  const lines = [`[mcp_servers.${tomlStr(spec2.name)}]`, `url = ${tomlStr(spec2.url)}`];
+  const headers = [];
+  if (spec2.apiKey) headers.push(`"X-API-Key" = ${tomlStr(spec2.apiKey)}`);
+  if (spec2.endUserId) headers.push(`"X-End-User-Id" = ${tomlStr(spec2.endUserId)}`);
+  if (headers.length) lines.push(`http_headers = { ${headers.join(", ")} }`);
+  return lines.join("\n") + "\n";
+}
+function codexSectionRanges(lines, name) {
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const header = new RegExp(`^\\[mcp_servers\\.(?:"${esc}"|${esc})\\]\\s*(#.*)?$`);
+  const anyHeader = /^\s*\[[^\]]+\]\s*(#.*)?$/;
+  const ranges = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!header.test(lines[i])) continue;
+    let end = lines.length;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (anyHeader.test(lines[j])) {
+        end = j;
+        break;
+      }
+    }
+    ranges.push({ start: i, end });
+    i = end - 1;
+  }
+  return ranges;
+}
+function installIntoCodex(spec2) {
+  const file = codexConfigPath();
+  try {
+    fs10.mkdirSync(path6.dirname(file), { recursive: true });
+    let text = "";
+    let existed = true;
+    try {
+      text = fs10.readFileSync(file, "utf-8");
+    } catch {
+      existed = false;
+    }
+    const lines = text.split("\n");
+    const ranges = codexSectionRanges(lines, spec2.name);
+    for (const r of ranges) {
+      const body = lines.slice(r.start, r.end).join("\n");
+      const url = body.match(/^\s*url\s*=\s*"([^"]*)"/m)?.[1];
+      if (url && !OURS.test(url) || !url && /^\s*command\s*=/m.test(body)) {
+        return {
+          ok: false,
+          conflict: true,
+          path: file,
+          error: `~/.codex/config.toml already has an MCP server named "${spec2.name}" that is not an APIblaze proxy \u2014 not touching it. Rename or remove that block and re-run.`
+        };
+      }
+    }
+    for (const r of [...ranges].reverse()) lines.splice(r.start, r.end - r.start);
+    let cleaned = lines.join("\n");
+    if (cleaned.length && !cleaned.endsWith("\n")) cleaned += "\n";
+    if (cleaned.length && !cleaned.endsWith("\n\n")) cleaned += "\n";
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs10.writeFileSync(tmp, cleaned + codexServerBlock(spec2), { encoding: "utf-8", mode: 384 });
+    fs10.renameSync(tmp, file);
+    if (!existed) {
+      try {
+        fs10.chmodSync(file, 384);
+      } catch {
+      }
+    }
+    return { ok: true, path: file };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err), path: file };
+  }
+}
+function codexOneShot(_spec, prompt) {
+  const argv = ["codex", "exec", prompt];
+  const r = run(argv[0], argv.slice(1), { inherit: true });
+  return { argv, status: r.status };
+}
+var shellQuote = (s) => `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
+function renderCommand(argv) {
+  return argv.map((a, i) => i === 0 || /^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : shellQuote(a)).join(" ");
+}
+function refreshInstall(cli, spec2) {
+  const r = cli === "claude" ? installIntoClaude(spec2) : installIntoCodex(spec2);
+  return r.ok;
+}
+async function installAndDemo(cli, spec2, getQuestion, log = console.log) {
+  if (cli.kind === "claude") {
+    log(`
+  ${import_chalk46.default.dim("$")} ${renderCommand(["claude", ...claudeInstallArgs(spec2, true)])}`);
+    const r = installIntoClaude(spec2);
+    if (!r.ok) {
+      log(import_chalk46.default.red(`  ${r.conflict ? "" : "Install failed: "}${r.error}`));
+      return false;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to Claude CLI (local scope \u2014 this directory).`);
+    if (spec2.apiKey) log(import_chalk46.default.dim("     The API key is stored in Claude's local MCP config for this directory."));
+  } else {
+    const r = installIntoCodex(spec2);
+    if (!r.ok) {
+      log(import_chalk46.default.red(`  ${r.conflict ? "" : `Could not write ${r.path}: `}${r.error}`));
+      return false;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to ${r.path}.`);
+  }
+  if (!spec2.apiKey) {
+    const loginArgv = cli.kind === "claude" ? ["claude", "mcp", "login", spec2.name] : ["codex", "mcp", "login", spec2.name];
+    log(`
+  ${import_chalk46.default.dim("This proxy authenticates by login \u2014 signing you in:")}`);
+    log(`  ${import_chalk46.default.dim("$")} ${renderCommand(loginArgv)}`);
+    const r = run(loginArgv[0], loginArgv.slice(1), { interactive: true });
+    if (r.status !== 0) {
+      log(import_chalk46.default.yellow(`  Sign-in didn't complete (exit ${r.status ?? "?"}). Run \`${renderCommand(loginArgv)}\` yourself, then chat away.`));
+      return true;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} Signed in.`);
+  }
+  const oneShot = cli.kind === "claude" ? claudeOneShot : codexOneShot;
+  const abilities = `What are the tool abilities of the MCP server "${spec2.name}"? List them briefly.`;
+  log(`
+  ${import_chalk46.default.dim("Checking what the API can do\u2026")}`);
+  log(`  ${import_chalk46.default.dim("$")} ${renderCommand(cli.kind === "claude" ? ["claude", "-p", abilities, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", abilities])}
+`);
+  const check = oneShot(spec2, abilities);
+  if (check.status !== 0) {
+    log(import_chalk46.default.yellow(`
+  ${cli.label} exited with ${check.status ?? "no status"} \u2014 the MCP is installed, but the demo call failed.`));
+    log(import_chalk46.default.yellow(`  Open ${cli.label} and try it there${cli.kind === "claude" ? " (use /mcp to inspect the connection)" : ""}.`));
+    return true;
+  }
+  const question = await getQuestion();
+  if (question) {
+    log(`
+  ${import_chalk46.default.dim("Your question, through " + cli.label + ":")}`);
+    const shown = cli.kind === "claude" ? ["claude", "-p", question, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", question];
+    log(`  ${import_chalk46.default.dim("$")} ${renderCommand(shown)}
+`);
+    const ans = oneShot(spec2, question);
+    if (ans.status !== 0) log(import_chalk46.default.yellow(`
+  ${cli.label} exited with ${ans.status ?? "no status"} on that one \u2014 the MCP stays installed.`));
+  }
+  log(`
+  ${import_chalk46.default.bold(`Your ${cli.label} is now able to talk to the ${spec2.projectLabel} API.`)}`);
+  return true;
+}
+
+// src/commands/apichat.ts
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk46.default.red(`
+  console.error(import_chalk47.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk46.default.dim(hint));
+  if (hint) console.error(import_chalk47.default.dim(hint));
   process.exit(1);
 }
 function normalizeName3(raw) {
@@ -8388,7 +8615,7 @@ function parseSpec(text) {
   }
   return parsed;
 }
-var GENERATOR_HINT = "Provide one with --openapispec <file|url>, or build one from real traffic:\n  apiblaze create --target <url>   then   apiblaze agent openapi <project>";
+var GENERATOR_HINT = "Pass --target <server-url | spec-file | spec-url>, or build a spec from real traffic:\n  apiblaze create --target <url>   then   apiblaze agent openapi <project>";
 async function fetchText(url) {
   try {
     const res = await fetch(url, { headers: { accept: "application/json, application/yaml, text/yaml, */*" } });
@@ -8421,7 +8648,7 @@ async function loadSpec(opts) {
     }
     let text;
     try {
-      text = fs10.readFileSync(opts.openapispec, "utf-8");
+      text = fs11.readFileSync(opts.openapispec, "utf-8");
     } catch {
       fail4(`Cannot read spec file: ${opts.openapispec}`);
     }
@@ -8435,7 +8662,7 @@ async function loadSpec(opts) {
     }
     return { spec: found.spec, sourceUrl: found.sourceUrl };
   }
-  fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
+  fail4("No spec source. Pass --target <server-url | openapi-file | openapi-url>.", GENERATOR_HINT);
 }
 function resolveTarget(spec2, opts, sourceUrl) {
   if (opts.target) {
@@ -8505,7 +8732,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk46.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk47.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -8579,7 +8806,7 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     const fresh = await validConsumerToken(existing);
     if (fresh) {
       if (fresh.accessToken !== existing.accessToken) saveConsumer({ ...fresh, resource });
-      console.log(import_chalk46.default.dim(`  Using your consumer session on ${import_chalk46.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      console.log(import_chalk47.default.dim(`  Using your consumer session on ${import_chalk47.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
       return fresh;
     }
   }
@@ -8598,13 +8825,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     );
   }
   const clientId = pick2.client_id ?? pick2.clientId;
-  console.log(`${import_chalk46.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk46.default.bold(tenant2)}...`);
+  console.log(`${import_chalk47.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk47.default.bold(tenant2)}...`);
   const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk46.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk46.default.bold(userCode)}
+  Open: ${import_chalk47.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk47.default.bold(userCode)}
 `);
-    console.log(import_chalk46.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk47.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, resource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -8620,16 +8847,16 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     resource
   };
   saveConsumer(creds);
-  console.log(`  ${import_chalk46.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk46.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  console.log(`  ${import_chalk47.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk47.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
-async function cpPost(anon, path8, body, summary) {
+async function cpPost(anon, path9, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
     if (!cred) throw new Error("Anonymous workspace credential missing.");
-    return cpFetch(cred.cp_key, path8, { method: "POST", body: JSON.stringify(body) });
+    return cpFetch(cred.cp_key, path9, { method: "POST", body: JSON.stringify(body) });
   }
-  return admin({ method: "POST", path: path8, body, summary });
+  return admin({ method: "POST", path: path9, body, summary });
 }
 async function provision(spec2, target, opts) {
   const loggedIn = !!loadCredentials();
@@ -8649,7 +8876,7 @@ async function provision(spec2, target, opts) {
   let name = opts.name ? base2 : `${base2}${salt()}`;
   const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
   if (anon && opts.access === "invite") {
-    console.log(import_chalk46.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+    console.log(import_chalk47.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
   }
   const DUAL_AUTH = {
     mode: "authenticate",
@@ -8748,7 +8975,7 @@ async function provision(spec2, target, opts) {
       try {
         await addPreapprovalRule(tenant2, email);
       } catch {
-        console.log(import_chalk46.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+        console.log(import_chalk47.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
       }
     }
   }
@@ -8792,7 +9019,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk46.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk47.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -8800,7 +9027,7 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk46.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk47.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
@@ -8842,9 +9069,9 @@ function billingLine(info) {
   if (typeof info.free_turns_remaining === "number") return null;
   const cents = info.charged_cents;
   const usd = (cents / 100).toFixed(Math.abs(cents - Math.round(cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk46.default.magenta(`  \u{1F4B3} $${usd}`);
+  let line = import_chalk47.default.magenta(`  \u{1F4B3} $${usd}`);
   if (typeof info.credits_remaining === "number") {
-    line += import_chalk46.default.dim(` \xB7 balance $${(info.credits_remaining / 100).toFixed(2)}`);
+    line += import_chalk47.default.dim(` \xB7 balance $${(info.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
@@ -8852,15 +9079,15 @@ function freeBudgetWarning(info, anon) {
   if (!anon || !info) return null;
   if (typeof info.free_turns_remaining === "number") {
     const left2 = info.free_turns_remaining;
-    if (left2 <= 0) return import_chalk46.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk46.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
+    if (left2 <= 0) return import_chalk47.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk47.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
   if (typeof info.free_remaining_cents !== "number") return null;
   const perTurn = Math.max(info.charged_cents || 0, 0.02);
   const left = Math.floor(info.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk46.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk46.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+  if (left <= 0) return import_chalk47.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk47.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
 async function readSse(body, onEvent) {
   const reader = body.getReader();
@@ -8905,7 +9132,7 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk46.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk47.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
     if ((res.headers.get("content-type") ?? "").includes("text/event-stream") && res.ok && res.body) break;
@@ -8928,12 +9155,12 @@ async function replTurn(p, messages, userText) {
         spinner.start("retrying on the " + (p.anon ? "trial" : "claimed") + " plane\u2026");
         continue;
       }
-      console.log(import_chalk46.default.red(`  No proxy named ${p.projectId} was found (tried both abz.run and tryabz.run).`));
+      console.log(import_chalk47.default.red(`  No proxy named ${p.projectId} was found (tried both abz.run and tryabz.run).`));
       return;
     }
     if (code === "identity_required" || /identif/i.test(msg) && !code) {
       if (!p.endUserId && tty) {
-        console.log(import_chalk46.default.yellow("  This API requires every call to say WHO is calling."));
+        console.log(import_chalk47.default.yellow("  This API requires every call to say WHO is calling."));
         const { default: inquirer3 } = await import("inquirer");
         const { id } = await inquirer3.prompt([{ type: "input", name: "id", message: "Your end-user id (usually your email):" }]);
         if (typeof id === "string" && id.trim()) {
@@ -8943,27 +9170,27 @@ async function replTurn(p, messages, userText) {
           continue;
         }
       }
-      console.log(import_chalk46.default.red("  This API requires an identified caller."));
-      console.log(import_chalk46.default.dim("  Re-run with --xenduserid <your id> (usually your email)."));
+      console.log(import_chalk47.default.red("  This API requires an identified caller."));
+      console.log(import_chalk47.default.dim("  Re-run with --xenduserid <your id> (usually your email)."));
       return;
     }
     if (code === "user_not_preapproved") {
-      console.log(import_chalk46.default.yellow(`  ${msg || "You are not pre-approved on this API."}`));
-      if (p.endUserId) console.log(import_chalk46.default.dim(`  Identity sent: ${p.endUserId}`));
+      console.log(import_chalk47.default.yellow(`  ${msg || "You are not pre-approved on this API."}`));
+      if (p.endUserId) console.log(import_chalk47.default.dim(`  Identity sent: ${p.endUserId}`));
       const accessUrl = errObj && errObj.request_access_url;
-      if (accessUrl) console.log(`  Request access: ${import_chalk46.default.bold(String(accessUrl))}`);
-      console.log(import_chalk46.default.dim("  Or ask the producer to pre-approve you: `apiblaze preapprove <your-email> --tenant <tenant>`."));
+      if (accessUrl) console.log(`  Request access: ${import_chalk47.default.bold(String(accessUrl))}`);
+      console.log(import_chalk47.default.dim("  Or ask the producer to pre-approve you: `apiblaze preapprove <your-email> --tenant <tenant>`."));
       return;
     }
     if (code === "user_frozen") {
-      console.log(import_chalk46.default.red(`  ${msg || "Your access to this API has been frozen by the producer."}`));
+      console.log(import_chalk47.default.red(`  ${msg || "Your access to this API has been frozen by the producer."}`));
       return;
     }
     const oauthWanted = /oauth token required|authorization: bearer/i.test(msg);
     const keyWanted = /api key required|x-api-key/i.test(msg);
     if (oauthWanted && !p.consumerAuth) {
       if (p.teamId && p.tenant && loadCredentials()) {
-        console.log(import_chalk46.default.dim("  This proxy signs consumers in with OAuth \u2014 starting the login\u2026"));
+        console.log(import_chalk47.default.dim("  This proxy signs consumers in with OAuth \u2014 starting the login\u2026"));
         try {
           await ensureConsumerLogin(p.teamId, p.tenant, p.version);
           p.consumerAuth = true;
@@ -8972,17 +9199,17 @@ async function replTurn(p, messages, userText) {
           spinner.start("retrying\u2026");
           continue;
         } catch (err) {
-          console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           return;
         }
       }
-      console.log(import_chalk46.default.red("  This proxy signs consumers in with OAuth (a login), not an API key."));
-      console.log(import_chalk46.default.dim("  Sign in with: `apiblaze consumer login --tenant <tenant> --client <app-client-id>`, then re-run apichat."));
+      console.log(import_chalk47.default.red("  This proxy signs consumers in with OAuth (a login), not an API key."));
+      console.log(import_chalk47.default.dim("  Sign in with: `apiblaze consumer login --tenant <tenant> --client <app-client-id>`, then re-run apichat."));
       return;
     }
     if (keyWanted) {
       if (tty) {
-        console.log(import_chalk46.default.yellow(`  ${msg || "This API requires an API key."}`));
+        console.log(import_chalk47.default.yellow(`  ${msg || "This API requires an API key."}`));
         const { default: inquirer3 } = await import("inquirer");
         const { key } = await inquirer3.prompt([{ type: "password", name: "key", mask: "*", message: "API key for this proxy:" }]);
         if (typeof key === "string" && key.trim()) {
@@ -8993,8 +9220,8 @@ async function replTurn(p, messages, userText) {
           continue;
         }
       }
-      console.log(import_chalk46.default.red(`  ${msg || "This API requires an API key."}`));
-      console.log(import_chalk46.default.dim("  Re-run with --apikey <key> (mint one from the producer's site or dev portal)."));
+      console.log(import_chalk47.default.red(`  ${msg || "This API requires an API key."}`));
+      console.log(import_chalk47.default.dim("  Re-run with --apikey <key> (mint one from the producer's site or dev portal)."));
       return;
     }
     if (res && (res.status === 402 || res.status === 403)) {
@@ -9002,16 +9229,16 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (res && res.status === 401) {
-      console.log(import_chalk46.default.red(`  The proxy rejected the request (401)${msg ? `: ${msg}` : "."}`));
-      console.log(import_chalk46.default.dim(p.consumerAuth ? "  Sent your consumer OAuth token. Run `apiblaze consumer login` again." : "  Sent an API key. Pass a different one with --apikey <key>."));
+      console.log(import_chalk47.default.red(`  The proxy rejected the request (401)${msg ? `: ${msg}` : "."}`));
+      console.log(import_chalk47.default.dim(p.consumerAuth ? "  Sent your consumer OAuth token. Run `apiblaze consumer login` again." : "  Sent an API key. Pass a different one with --apikey <key>."));
       return;
     }
-    console.log(import_chalk46.default.red(`  Chat error: ${msg || (res ? `HTTP ${res.status}` : "request failed")}`));
+    console.log(import_chalk47.default.red(`  Chat error: ${msg || (res ? `HTTP ${res.status}` : "request failed")}`));
     return;
   }
   if (!res || !res.body || !(res.headers.get("content-type") ?? "").includes("text/event-stream")) {
     spinner.stop();
-    console.log(import_chalk46.default.red("  Chat error: could not authenticate to this proxy after several attempts."));
+    console.log(import_chalk47.default.red("  Chat error: could not authenticate to this proxy after several attempts."));
     return;
   }
   let spinnerLive = true;
@@ -9052,7 +9279,7 @@ async function replTurn(p, messages, userText) {
           const name = String(ev.toolName ?? "tool");
           parts.push({ type: `tool-${name}`, toolCallId: String(ev.toolCallId ?? ""), state: "input-streaming" });
           toolMeta.set(String(ev.toolCallId ?? ""), { name, startedAt: Date.now(), partIdx: parts.length - 1 });
-          console.log(`  ${import_chalk46.default.cyan("\u2699")} ${import_chalk46.default.cyan(name)}${import_chalk46.default.dim("\u2026")}`);
+          console.log(`  ${import_chalk47.default.cyan("\u2699")} ${import_chalk47.default.cyan(name)}${import_chalk47.default.dim("\u2026")}`);
           break;
         }
         case "tool-input-available": {
@@ -9064,9 +9291,9 @@ async function replTurn(p, messages, userText) {
             Object.assign(parts[meta.partIdx], { state: "input-available", input });
           }
           if (isVerbose()) {
-            console.log(import_chalk46.default.dim(`      args ${JSON.stringify(input)}`));
+            console.log(import_chalk47.default.dim(`      args ${JSON.stringify(input)}`));
             const hint = credHint();
-            if (hint) console.log(import_chalk46.default.dim(`      auth ${hint}`) + (revealAuth ? "" : import_chalk46.default.yellow("  \u2190 /showauth reveals")));
+            if (hint) console.log(import_chalk47.default.dim(`      auth ${hint}`) + (revealAuth ? "" : import_chalk47.default.yellow("  \u2190 /showauth reveals")));
           }
           break;
         }
@@ -9077,8 +9304,8 @@ async function replTurn(p, messages, userText) {
           const meta = toolMeta.get(id);
           const ok = ev.type === "tool-output-available";
           const ms = meta ? Date.now() - meta.startedAt : void 0;
-          const mark = ok ? import_chalk46.default.green("\u2713") : import_chalk46.default.red("\u2717");
-          console.log(`  ${mark} ${import_chalk46.default.cyan(meta?.name ?? "tool")} ${import_chalk46.default.dim(`(${ok ? "ok" : "error"}${ms != null ? `, ${ms}ms` : ""})`)}`);
+          const mark = ok ? import_chalk47.default.green("\u2713") : import_chalk47.default.red("\u2717");
+          console.log(`  ${mark} ${import_chalk47.default.cyan(meta?.name ?? "tool")} ${import_chalk47.default.dim(`(${ok ? "ok" : "error"}${ms != null ? `, ${ms}ms` : ""})`)}`);
           const detail = ok ? String(ev.output ?? "") : String(ev.errorText ?? "Tool call failed.");
           if (meta) {
             Object.assign(parts[meta.partIdx], ok ? { state: "output-available", output: detail } : { state: "output-error", errorText: detail });
@@ -9093,9 +9320,9 @@ async function replTurn(p, messages, userText) {
             })();
             const lines = pretty.split("\n");
             const cap = ok ? 12 : 24;
-            console.log(import_chalk46.default.dim("      response:"));
-            for (const line of lines.slice(0, cap)) console.log(import_chalk46.default.dim(`        ${line}`));
-            if (lines.length > cap) console.log(import_chalk46.default.dim(`        \u2026${lines.length - cap} more lines`));
+            console.log(import_chalk47.default.dim("      response:"));
+            for (const line of lines.slice(0, cap)) console.log(import_chalk47.default.dim(`        ${line}`));
+            if (lines.length > cap) console.log(import_chalk47.default.dim(`        \u2026${lines.length - cap} more lines`));
           }
           break;
         }
@@ -9104,7 +9331,7 @@ async function replTurn(p, messages, userText) {
           parts.push({ type: "text", text: "" });
           openTextIdx = parts.length - 1;
           if (!assistantOpen) {
-            process.stdout.write("\n" + import_chalk46.default.green("assistant \u203A "));
+            process.stdout.write("\n" + import_chalk47.default.green("assistant \u203A "));
             assistantOpen = true;
           }
           break;
@@ -9135,12 +9362,12 @@ async function replTurn(p, messages, userText) {
     });
   } catch (err) {
     stopSpinner();
-    console.log(import_chalk46.default.red(`  Stream error: ${err instanceof Error ? err.message : String(err)}`));
+    console.log(import_chalk47.default.red(`  Stream error: ${err instanceof Error ? err.message : String(err)}`));
   }
   stopSpinner();
   if (assistantOpen) process.stdout.write("\n\n");
   if (parts.length) messages.push({ id: messageId, role: "assistant", parts });
-  if (errorText) console.log(import_chalk46.default.red(`  ${errorText}`));
+  if (errorText) console.log(import_chalk47.default.red(`  ${errorText}`));
   if (upsell) {
     renderUpsell(p, upsell, { messageAlreadyShown: true });
   }
@@ -9152,39 +9379,39 @@ async function replTurn(p, messages, userText) {
 function renderUpsell(p, upsell, opts = {}) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk46.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk46.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk47.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk47.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
   if (!opts.messageAlreadyShown) {
-    console.log("\n" + import_chalk46.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+    console.log("\n" + import_chalk47.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
   }
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "QUOTA" || upsell.reason === "PROXY_CAP" || upsell.reason === "PAUSED" || upsell.reason === "BYO_REQUIRED") {
     if (!loggedIn) {
-      console.log(import_chalk46.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk47.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk46.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk47.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk46.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk47.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
-var apichatsPath = () => path6.join(getApiblazeDir(), "apichats.json");
+var apichatsPath = () => path7.join(getApiblazeDir(), "apichats.json");
 function loadApichats() {
   try {
-    const list = JSON.parse(fs10.readFileSync(apichatsPath(), "utf-8"));
+    const list = JSON.parse(fs11.readFileSync(apichatsPath(), "utf-8"));
     return Array.isArray(list) ? list : [];
   } catch {
     return [];
   }
 }
 function writeApichats(list) {
-  fs10.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs10.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
+  fs11.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs11.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
   try {
-    fs10.chmodSync(apichatsPath(), 384);
+    fs11.chmodSync(apichatsPath(), 384);
   } catch {
   }
 }
@@ -9290,8 +9517,8 @@ async function openDirectProject(projectId, opts) {
       else p.consumerAuth = true;
     }
   }
-  console.log(`  ${import_chalk46.default.dim("Proxy:")} ${import_chalk46.default.bold(p.proxyUrl)}`);
-  if (p.endUserId) console.log(`  ${import_chalk46.default.dim("Acting as:")} ${import_chalk46.default.bold(p.endUserId)}`);
+  console.log(`  ${import_chalk47.default.dim("Proxy:")} ${import_chalk47.default.bold(p.proxyUrl)}`);
+  if (p.endUserId) console.log(`  ${import_chalk47.default.dim("Acting as:")} ${import_chalk47.default.bold(p.endUserId)}`);
   upsertApichat({
     name: projectId,
     target: p.proxyUrl,
@@ -9321,9 +9548,9 @@ async function openServerProxy(project) {
   let consumerAuth = false;
   if (acceptsApiKey) {
     if (!dpKey) {
-      console.log(import_chalk46.default.dim(`  Minting an API key for tenant ${import_chalk46.default.bold(tenant2)} to query project ${import_chalk46.default.bold(project.projectName)}\u2026`));
+      console.log(import_chalk47.default.dim(`  Minting an API key for tenant ${import_chalk47.default.bold(tenant2)} to query project ${import_chalk47.default.bold(project.projectName)}\u2026`));
       dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-      console.log(`  ${import_chalk46.default.green("\u2714")} API key: ${import_chalk46.default.dim(maskKey(dpKey))}`);
+      console.log(`  ${import_chalk47.default.green("\u2714")} API key: ${import_chalk47.default.dim(maskKey(dpKey))}`);
     }
   } else {
     consumerAuth = true;
@@ -9352,9 +9579,9 @@ async function openServerProxy(project) {
     const spec2 = raw && (raw.spec ?? raw);
     spinner.stop();
     if (!spec2 || !(spec2.paths || spec2.openapi)) {
-      console.log(import_chalk46.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk47.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     } else {
-      console.log(import_chalk46.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
+      console.log(import_chalk47.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -9386,15 +9613,15 @@ function discoverLocalSpecs() {
   const found = [];
   for (const n of known) {
     try {
-      if (fs10.statSync(path6.join(cwd, n)).isFile()) found.push(n);
+      if (fs11.statSync(path7.join(cwd, n)).isFile()) found.push(n);
     } catch {
     }
   }
   try {
-    const files = fs10.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
+    const files = fs11.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
     for (const f of files.slice(0, 60)) {
       try {
-        const head = fs10.readFileSync(path6.join(cwd, f), "utf-8").slice(0, 4e3);
+        const head = fs11.readFileSync(path7.join(cwd, f), "utf-8").slice(0, 4e3);
         if (/["']?openapi["']?\s*:/i.test(head) || /["']?swagger["']?\s*:/i.test(head) || /^\s*paths\s*:/im.test(head) || /"paths"\s*:/.test(head)) {
           found.push(f);
         }
@@ -9410,7 +9637,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk46.default.bold(a.name)} ${import_chalk46.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk47.default.bold(a.name)} ${import_chalk47.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -9420,14 +9647,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk46.default.bold(pr.projectName)} ${import_chalk46.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk47.default.bold(pr.projectName)} ${import_chalk47.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk46.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk47.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -9530,36 +9757,36 @@ async function noArgsMenu(opts) {
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
   const messages = (initialMessages ?? []).filter((m) => Array.isArray(m.parts));
-  console.log("\n" + import_chalk46.default.cyan.bold("Chat with your API") + import_chalk46.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk46.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  console.log("\n" + import_chalk47.default.cyan.bold("Chat with your API") + import_chalk47.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk47.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk46.default.dim(
+    import_chalk47.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk46.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk47.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk46.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk47.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       const justLoggedIn = !loadCredentials();
       if (justLoggedIn) {
-        console.log(import_chalk46.default.dim("  Logging in to claim your workspace\u2026"));
+        console.log(import_chalk47.default.dim("  Logging in to claim your workspace\u2026"));
         try {
           await runLogin();
         } catch (err) {
-          console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           continue;
         }
         if (!loadCredentials()) continue;
@@ -9570,57 +9797,217 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk46.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk47.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          const entry = loadApichats().find((a) => apichatKey(a) === apichatKey(p));
+          for (const [cli, state] of Object.entries(entry?.cliOffer ?? {})) {
+            if (state === "installed" && (cli === "claude" || cli === "codex")) {
+              if (refreshInstall(cli, buildInstallSpec(p))) {
+                console.log(import_chalk47.default.dim(`  ${cli === "claude" ? "Claude" : "Codex"} CLI's MCP entry updated to the new host.`));
+              }
+            }
+          }
         }
       } catch (err) {
-        console.log(import_chalk46.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk47.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk46.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk47.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk46.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk47.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk46.default.dim("\nBye."));
+  console.log(import_chalk47.default.dim("\nBye."));
+}
+function offerKey(p) {
+  return apichatKey(p);
+}
+function rememberCliOffer(p, cli, state) {
+  const list = loadApichats();
+  const i = list.findIndex((a) => apichatKey(a) === offerKey(p));
+  if (i < 0) return;
+  list[i].cliOffer = { ...list[i].cliOffer ?? {}, [cli]: state };
+  list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeApichats(list);
+}
+function buildInstallSpec(p) {
+  return {
+    name: p.projectId,
+    url: `https://${p.mcpHost}/${p.version}/${p.environment}`,
+    // consumerAuth means the door is a login — install bare, the CLI signs in.
+    apiKey: p.consumerAuth ? void 0 : p.dpKey,
+    endUserId: p.endUserId,
+    projectLabel: p.projectId
+  };
+}
+async function verifyAndHealMcpHost(p) {
+  const ok = (await verifyMcpEndpoint(buildInstallSpec(p))).ok;
+  if (ok) return true;
+  const flipped = p.mcpHost.includes(".mcp.tryabz.run") ? p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run") : p.mcpHost.replace(".mcp.abz.run", ".mcp.tryabz.run");
+  if (flipped === p.mcpHost) return false;
+  const prev = p.mcpHost;
+  p.mcpHost = flipped;
+  if ((await verifyMcpEndpoint(buildInstallSpec(p))).ok) {
+    const list = loadApichats();
+    const i = list.findIndex((a) => apichatKey(a) === offerKey(p));
+    if (i >= 0) {
+      list[i].mcpHost = flipped;
+      list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      writeApichats(list);
+    }
+    return true;
+  }
+  p.mcpHost = prev;
+  return false;
+}
+async function maybeInstallExternalCli(p, opts) {
+  const forced = (opts.installMcp ?? "").toLowerCase();
+  if (forced && forced !== "claude" && forced !== "codex") {
+    fail4(`--install-mcp takes "claude" or "codex", not "${opts.installMcp}".`);
+  }
+  if (!forced && !process.stdin.isTTY) return false;
+  const offer = loadApichats().find((a) => apichatKey(a) === offerKey(p))?.cliOffer ?? {};
+  if (forced) {
+    const cli = detectExternalClis().find((c) => c.kind === forced);
+    if (!cli) fail4(
+      `${forced === "claude" ? "Claude" : "Codex"} CLI not found on this machine.`,
+      forced === "claude" ? "Install it: npm install -g @anthropic-ai/claude-code" : "Install it: npm install -g @openai/codex"
+    );
+    if (!await ensureInstallableDoor(p, opts)) return false;
+    if (!await verifyAndHealMcpHost(p)) {
+      fail4(`The MCP endpoint https://${p.mcpHost}/${p.version}/${p.environment} is not answering \u2014 not installing it into ${cli.label}.`);
+    }
+    const ran2 = await installAndDemo(cli, buildInstallSpec(p), () => resolveQuestion(opts));
+    if (ran2) rememberCliOffer(p, cli.kind, "installed");
+    return ran2;
+  }
+  const clis = detectExternalClis();
+  if (clis.length === 0) return false;
+  for (const c of clis) {
+    if (offer[c.kind] === "installed" && await verifyAndHealMcpHost(p)) {
+      refreshInstall(c.kind, buildInstallSpec(p));
+    }
+  }
+  const fresh = clis.filter((c) => !offer[c.kind]);
+  if (fresh.length === 0) return false;
+  const { default: inquirer3 } = await import("inquirer");
+  const names = fresh.map((c) => c.label).join(" and ");
+  const targetName = fresh.length > 1 ? "one of them" : fresh[0].label;
+  const { pick: pick2 } = await inquirer3.prompt([{
+    type: "list",
+    name: "pick",
+    message: `I see ${names} ${fresh.length > 1 ? "are" : "is"} installed on this computer. Do you want to add the MCP for this proxy to ${targetName} so you can chat with your API from there directly, or chat here directly?`,
+    choices: [
+      ...fresh.map((c) => ({ name: c.label, value: c })),
+      { name: "Chat here directly", value: "here" }
+    ]
+  }]);
+  if (pick2 === "here") {
+    for (const c of fresh) rememberCliOffer(p, c.kind, "declined");
+    if (p.consumerAuth && p.teamId && p.tenant) {
+      try {
+        await ensureConsumerLogin(p.teamId, p.tenant, p.version);
+      } catch (err) {
+        console.log(import_chalk47.default.yellow(`  Sign-in didn't complete (${err instanceof Error ? err.message : String(err)}) \u2014 the first chat turn will retry it.`));
+      }
+    }
+    return false;
+  }
+  if (!await ensureInstallableDoor(p, opts)) return false;
+  if (!await verifyAndHealMcpHost(p)) {
+    console.log(import_chalk47.default.red(`  The MCP endpoint https://${p.mcpHost}/${p.version}/${p.environment} is not answering \u2014 not installing it into ${pick2.label}. Chat here instead.`));
+    return false;
+  }
+  const ran = await installAndDemo(pick2, buildInstallSpec(p), () => resolveQuestion(opts));
+  if (ran) {
+    rememberCliOffer(p, pick2.kind, "installed");
+    if (p.anon) {
+      console.log(import_chalk47.default.dim(`  Anonymous workspace \u2014 run \`apiblaze apichat ${p.projectId}\` and /claim to keep it (and this MCP) beyond 30 days.`));
+    }
+  }
+  return ran;
+}
+async function ensureInstallableDoor(p, opts) {
+  if (p.dpKey || p.consumerAuth) return true;
+  if (!process.stdin.isTTY) {
+    fail4(
+      `Can't tell how "${p.projectId}" authenticates (no key on file).`,
+      "Pass --apikey <key> for a key-door proxy, or open it interactively once first."
+    );
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  const { key } = await inquirer3.prompt([{
+    type: "password",
+    name: "key",
+    mask: "*",
+    message: `API key for ${p.projectId} (leave empty if it uses a login):`
+  }]);
+  if (typeof key === "string" && key.trim()) p.dpKey = key.trim();
+  else p.consumerAuth = true;
+  void opts;
+  return true;
+}
+async function resolveQuestion(opts) {
+  if (opts.prompt) return opts.prompt;
+  if (!process.stdin.isTTY) return void 0;
+  const { default: inquirer3 } = await import("inquirer");
+  const { q } = await inquirer3.prompt([{
+    type: "input",
+    name: "q",
+    message: "What question do you have for this API?"
+  }]);
+  const t = (q ?? "").trim();
+  return t || void 0;
+}
+async function startChat(p, messages, opts) {
+  if (opts.prompt) {
+    await replTurn(p, messages, opts.prompt);
+    saveTranscript(p, messages);
+    if (!process.stdin.isTTY) return;
+  } else if (!process.stdin.isTTY) {
+    fail4('Interactive chat needs a terminal. Pass -p "<question>" for a one-shot answer.');
+  }
+  await runRepl(p, messages);
 }
 async function runApichat(opts) {
-  setVerbose(opts.verbose !== false);
-  console.log(import_chalk46.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  setVerbose(opts.verbose === true);
+  console.log(import_chalk47.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (opts.target && !opts.openapispec) {
     const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
     const c = await classifyTargetInput2(opts.target, fail4);
     if (c.kind === "spec") {
-      console.log(import_chalk46.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 using it as the spec.`));
+      console.log(import_chalk47.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 using it as the spec.`));
       opts.openapispec = opts.target;
       opts.target = void 0;
     }
   }
   if (opts.project) {
     const opened = await openDirectProject(opts.project, opts);
-    await runRepl(opened.p, opened.messages);
+    if (await maybeInstallExternalCli(opened.p, opts)) return;
+    await startChat(opened.p, opened.messages, opts);
     return;
   }
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
-      fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
+      fail4("No spec source. Pass --target <server-url | openapi-file | openapi-url>.", GENERATOR_HINT);
     }
     const resumed = await noArgsMenu(opts);
     if (resumed) {
-      await runRepl(resumed.p, resumed.messages);
+      if (await maybeInstallExternalCli(resumed.p, opts)) return;
+      await startChat(resumed.p, resumed.messages, opts);
       return;
     }
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk46.default.dim("Target:")} ${import_chalk46.default.bold(target)}`);
+  console.log(`  ${import_chalk47.default.dim("Target:")} ${import_chalk47.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -9629,7 +10016,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk46.default.dim("Proxy: ")} ${import_chalk46.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk47.default.dim("Proxy: ")} ${import_chalk47.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -9649,30 +10036,31 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk46.default.dim("  Target auth: none required."));
+    console.log(import_chalk47.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk46.default.green("\u2713")} proxy  ${import_chalk46.default.bold(p.proxyUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk47.default.green("\u2713")} proxy  ${import_chalk47.default.bold(p.proxyUrl)}`);
   if (mcpUrl) {
-    console.log(`  ${import_chalk46.default.green("\u2713")} mcp    ${import_chalk46.default.bold(mcpUrl)}`);
+    console.log(`  ${import_chalk47.default.green("\u2713")} mcp    ${import_chalk47.default.bold(mcpUrl)}`);
     if (p.access === "invite") {
-      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
-      console.log(import_chalk46.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+      console.log(import_chalk47.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk47.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
     } else {
-      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+      console.log(import_chalk47.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
     }
   }
   if (p.anon) {
-    console.log(import_chalk46.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
+    console.log(import_chalk47.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
-  await runRepl(p);
+  if (mcpUrl && await maybeInstallExternalCli(p, opts)) return;
+  await startChat(p, [], opts);
 }
 
 // src/commands/consumer.ts
-var import_chalk47 = __toESM(require("chalk"));
+var import_chalk48 = __toESM(require("chalk"));
 var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -9694,7 +10082,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk47.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk48.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -9705,7 +10093,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk47.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk48.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -9723,18 +10111,18 @@ async function runConsumerLogin(opts) {
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk47.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk48.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk47.default.cyan("\u2192")} Logging in to ${import_chalk47.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk48.default.cyan("\u2192")} Logging in to ${import_chalk48.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk47.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk47.default.bold(userCode)}
+  Open: ${import_chalk48.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk48.default.bold(userCode)}
 `);
-    console.log(import_chalk47.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk48.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -9749,7 +10137,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk47.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk48.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer2();
@@ -9762,18 +10150,18 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk47.default.cyan("Consumer")} ${import_chalk47.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk47.default.bold(fresh.tenant)}
+  console.log(`${import_chalk48.default.cyan("Consumer")} ${import_chalk48.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk48.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk47.default.bold("access_token")}  ${import_chalk47.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk48.default.bold("access_token")}  ${import_chalk48.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk47.default.bold("id_token")}      ${import_chalk47.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk48.default.bold("id_token")}      ${import_chalk48.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk47.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk48.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk47.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk48.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
@@ -9783,8 +10171,8 @@ async function runConsumerApikeys(opts) {
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk47.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk47.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk48.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk48.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -9792,16 +10180,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk47.default.yellow("No API keys yet."));
+    console.log(import_chalk48.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk47.default.green(clear) : import_chalk47.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk47.default.dim(`exp ${k.expires_at}`) : import_chalk47.default.dim("no expiry");
-      console.log(`  ${import_chalk47.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk47.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk48.default.green(clear) : import_chalk48.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk48.default.dim(`exp ${k.expires_at}`) : import_chalk48.default.dim("no expiry");
+      console.log(`  ${import_chalk48.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk48.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk47.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk48.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -9823,35 +10211,35 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk47.default.green(key)}  ${import_chalk47.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk47.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk48.default.green(key)}  ${import_chalk48.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk48.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk48 = __toESM(require("chalk"));
+var import_chalk49 = __toESM(require("chalk"));
 var import_ora25 = __toESM(require("ora"));
-var fs11 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var fs12 = __toESM(require("fs"));
+var path8 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs11.existsSync(path7.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs12.existsSync(path8.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs11.readFileSync(path7.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs12.readFileSync(path8.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs11.existsSync(path7.join(root, "app")) || fs11.existsSync(path7.join(root, "src", "app"));
-  const pagesDir = fs11.existsSync(path7.join(root, "pages")) || fs11.existsSync(path7.join(root, "src", "pages"));
+  const appDir = fs12.existsSync(path8.join(root, "app")) || fs12.existsSync(path8.join(root, "src", "app"));
+  const pagesDir = fs12.existsSync(path8.join(root, "pages")) || fs12.existsSync(path8.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
-  const p = path7.join(root, ".env.local");
+  const p = path8.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs11.readFileSync(p, "utf8");
+    existing = fs12.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -9866,15 +10254,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs11.writeFileSync(p, next);
+  fs12.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs11.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk48.default.green("\u2713")} apiblaze package already installed`);
+  if (fs12.existsSync(path8.join(root, "node_modules", "apiblaze", "package.json"))) {
+    console.log(`  ${import_chalk49.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f) => fs11.existsSync(path7.join(root, f));
+  const has = (f) => fs12.existsSync(path8.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora25.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -9882,12 +10270,12 @@ function installSidecarPackage(root) {
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk48.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk48.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk49.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk49.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
   try {
-    const s = fs11.readFileSync(path7.join(root, ".env.local"), "utf8");
+    const s = fs12.readFileSync(path8.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -9895,16 +10283,16 @@ function readEnvKey(root) {
   }
 }
 function ensureGitignored(root) {
-  const p = path7.join(root, ".gitignore");
+  const p = path8.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs11.readFileSync(p, "utf8");
+    c = fs12.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs11.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs12.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path7.join("src", "instrumentation.ts")].map((c) => path7.join(root, c)).find((f) => fs11.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path8.join("src", "instrumentation.ts")].map((c) => path8.join(root, c)).find((f) => fs12.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -9912,18 +10300,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs11.writeFileSync(path7.join(root, "instrumentation.ts"), body);
+    fs12.writeFileSync(path8.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs11.readFileSync(existing, "utf8");
+  const cur = fs12.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs11.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs12.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs11.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs12.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -10002,17 +10390,17 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs11.existsSync(path7.join(root, "src", "pages")) ? path7.join(root, "src", "pages") : path7.join(root, "pages");
-      const f2 = path7.join(dir2, "abz-inspector.tsx");
-      fs11.writeFileSync(f2, INSPECTOR_PAGE);
-      return path7.relative(root, f2);
-    }
-    const base2 = fs11.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
-    const dir = path7.join(base2, "abz-inspector");
-    fs11.mkdirSync(dir, { recursive: true });
-    const f = path7.join(dir, "page.tsx");
-    fs11.writeFileSync(f, INSPECTOR_PAGE);
-    return path7.relative(root, f);
+      const dir2 = fs12.existsSync(path8.join(root, "src", "pages")) ? path8.join(root, "src", "pages") : path8.join(root, "pages");
+      const f2 = path8.join(dir2, "abz-inspector.tsx");
+      fs12.writeFileSync(f2, INSPECTOR_PAGE);
+      return path8.relative(root, f2);
+    }
+    const base2 = fs12.existsSync(path8.join(root, "src", "app")) ? path8.join(root, "src", "app") : path8.join(root, "app");
+    const dir = path8.join(base2, "abz-inspector");
+    fs12.mkdirSync(dir, { recursive: true });
+    const f = path8.join(dir, "page.tsx");
+    fs12.writeFileSync(f, INSPECTOR_PAGE);
+    return path8.relative(root, f);
   } catch {
     return null;
   }
@@ -10033,43 +10421,43 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk49.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk48.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk49.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk49.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk49.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk48.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk48.default.cyan("apiblaze login")}  then  ${import_chalk48.default.cyan("apiblaze claim")}   ${import_chalk48.default.dim("(no code needed here)")}`);
-  console.log(import_chalk48.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk49.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk49.default.cyan("apiblaze login")}  then  ${import_chalk49.default.cyan("apiblaze claim")}   ${import_chalk49.default.dim("(no code needed here)")}`);
+  console.log(import_chalk49.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
-  const root = path7.resolve(opts.dir ?? process.cwd());
-  const detected = detectNextProject(root);
-  if (!detected.found) {
-    console.log(import_chalk48.default.yellow(`No Next.js project detected in ${root}.`));
+  const root = path8.resolve(opts.dir ?? process.cwd());
+  const detected2 = detectNextProject(root);
+  if (!detected2.found) {
+    console.log(import_chalk49.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
   if (!loadCredentials() && !readEnvKey(root)) {
-    await runAnonymousInit(root, detected.router, opts);
+    await runAnonymousInit(root, detected2.router, opts);
     return;
   }
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk48.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk49.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk48.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk49.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -10092,38 +10480,38 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk48.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk49.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
-    inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
+    inspectorPath = generateInspector(root, detected2.router);
+    if (inspectorPath) console.log(`  ${import_chalk49.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk48.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk48.default.bold("candidates")} \u2014 list them:  ${import_chalk48.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk49.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk49.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk49.default.bold("candidates")} \u2014 list them:  ${import_chalk49.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk49.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk48.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk48.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk49.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path8.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk49.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk48.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk48.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk48.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk49.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk49.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk49.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk48.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk48.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk49.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk49.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk49 = __toESM(require("chalk"));
+var import_chalk50 = __toESM(require("chalk"));
 var import_ora26 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -10134,7 +10522,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk49.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk50.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -10152,27 +10540,27 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk49.default.bold(`
+  console.log(import_chalk50.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk49.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk49.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk49.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk49.default.bold(`
+  if (!routed.length) console.log(import_chalk50.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk50.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk50.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk50.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk49.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk50.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk49.default.yellow("\u25CB")} ${c.origin}  ${import_chalk49.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk50.default.yellow("\u25CB")} ${c.origin}  ${import_chalk50.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk49.default.dim(`
+    console.log(import_chalk50.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk49.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk50.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk49.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk50.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
     const spinner2 = (0, import_ora26.default)(`Approving ${origin} (anonymous)...`).start();
@@ -10225,13 +10613,13 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk51 = __toESM(require("chalk"));
+var import_chalk52 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
 
 // src/commands/op-billing.ts
-var import_chalk50 = __toESM(require("chalk"));
+var import_chalk51 = __toESM(require("chalk"));
 init_admin();
 var SANDBOX = {
   teamId: "team_1782844865835_zujrf",
@@ -10290,7 +10678,7 @@ async function rowsForRays(project, version2, tenant2, rays) {
 }
 function printDoors(data) {
   const checks = [];
-  console.log(import_chalk50.default.bold("\n  Doors \u2014 is every way in metered?\n"));
+  console.log(import_chalk51.default.bold("\n  Doors \u2014 is every way in metered?\n"));
   const doors = data?.doors ?? [];
   const metered = doors.filter((d) => d.verdict === "metered");
   const allowed = doors.filter((d) => d.verdict === "allowed-free");
@@ -10299,29 +10687,29 @@ function printDoors(data) {
   const errs = data?.errors ?? [];
   const routeAuditBroke = errs.some((e) => e.startsWith("zone "));
   const devAuditBroke = errs.some((e) => e.startsWith("workers.dev audit"));
-  console.log(import_chalk50.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
-  for (const d of metered) console.log(import_chalk50.default.green(`      \u2713 ${d.pattern}`));
-  console.log(import_chalk50.default.dim(`
+  console.log(import_chalk51.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
+  for (const d of metered) console.log(import_chalk51.default.green(`      \u2713 ${d.pattern}`));
+  console.log(import_chalk51.default.dim(`
     ${allowed.length} route(s) free ON PURPOSE`));
   for (const d of allowed) {
-    console.log(import_chalk50.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-    console.log(import_chalk50.default.dim(`        ${d.why}`));
+    console.log(import_chalk51.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+    console.log(import_chalk51.default.dim(`        ${d.why}`));
   }
   if (known.length) {
-    console.log(import_chalk50.default.yellow(`
+    console.log(import_chalk51.default.yellow(`
     ${known.length} route(s) KNOWN OPEN \u2014 unmetered, not yet closed`));
     for (const d of known) {
-      console.log(import_chalk50.default.yellow(`      ! ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk50.default.dim(`        ${d.why}`));
+      console.log(import_chalk51.default.yellow(`      ! ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk51.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no known-open doors", status: "KNOWN", detail: `${known.length} unmetered route(s) still open \u2014 see above` });
   }
   if (stray.length) {
-    console.log(import_chalk50.default.red(`
+    console.log(import_chalk51.default.red(`
     ${stray.length} STRAY route(s) \u2014 not main-proxy, not on the allowlist`));
     for (const d of stray) {
-      console.log(import_chalk50.default.red(`      \u2717 ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk50.default.dim(`        ${d.why}`));
+      console.log(import_chalk51.default.red(`      \u2717 ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk51.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no stray routes", status: "FAIL", detail: `${stray.length}: ${stray.map((s) => s.pattern).join(", ")}` });
   } else if (routeAuditBroke) {
@@ -10332,22 +10720,22 @@ function printDoors(data) {
   const wd = data?.workers_dev ?? {};
   const open = wd.enabled ?? [];
   if (open.length) {
-    console.log(import_chalk50.default.red(`
+    console.log(import_chalk51.default.red(`
     ${open.length} of ${wd.total} worker(s) reachable on *.workers.dev`));
-    for (const s of open) console.log(import_chalk50.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk50.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
-    console.log(import_chalk50.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
+    for (const s of open) console.log(import_chalk51.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk51.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
+    console.log(import_chalk51.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
     checks.push({ name: "no workers.dev doors", status: "FAIL", detail: `${open.length} script(s) publicly reachable: ${open.map((s) => s.script).join(", ")}` });
   } else if (devAuditBroke || !wd.total) {
     checks.push({ name: "no workers.dev doors", status: "SKIP", detail: "script enumeration failed \u2014 NOT a pass, no subdomain was ever read. Needs a CF token with Workers Scripts:Read." });
   } else {
-    console.log(import_chalk50.default.green(`
+    console.log(import_chalk51.default.green(`
     \u2713 0 of ${wd.total} workers reachable on *.workers.dev`));
     checks.push({ name: "no workers.dev doors", status: "PASS", detail: `all ${wd.total} scripts have workers.dev + previews disabled` });
   }
-  if (data?.how_to_fix) console.log(import_chalk50.default.yellow(`
-    ${data.reason}`) + import_chalk50.default.dim(`
+  if (data?.how_to_fix) console.log(import_chalk51.default.yellow(`
+    ${data.reason}`) + import_chalk51.default.dim(`
     ${data.how_to_fix}`));
-  else for (const e of errs) console.log(import_chalk50.default.red(`
+  else for (const e of errs) console.log(import_chalk51.default.red(`
     audit error: ${e}`));
   if (errs.length) {
     checks.push({ name: "audit completeness", status: "FAIL", detail: `${errs.length} part(s) of the audit could not run \u2014 coverage is INCOMPLETE, and the checks they would have covered are SKIP above` });
@@ -10357,9 +10745,9 @@ function printDoors(data) {
 async function runMeter(readLedger, opts) {
   const checks = [];
   const N = Math.max(1, Math.min(10, opts.count ?? 3));
-  console.log(import_chalk50.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
+  console.log(import_chalk51.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
   const snap = await readLedger();
-  console.log(import_chalk50.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
+  console.log(import_chalk51.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
 `));
   const url = `https://${dpHost}/${SANDBOX.version}/${SANDBOX.environment}/`;
   const headers = opts.key ? { "X-API-Key": opts.key } : {};
@@ -10441,22 +10829,22 @@ async function runMeter(readLedger, opts) {
   return checks;
 }
 function printChecks(checks) {
-  console.log(import_chalk50.default.bold("\n  Results\n"));
-  const mark = { PASS: import_chalk50.default.green("  PASS"), FAIL: import_chalk50.default.red("  FAIL"), SKIP: import_chalk50.default.dim("  SKIP"), KNOWN: import_chalk50.default.yellow(" KNOWN") };
+  console.log(import_chalk51.default.bold("\n  Results\n"));
+  const mark = { PASS: import_chalk51.default.green("  PASS"), FAIL: import_chalk51.default.red("  FAIL"), SKIP: import_chalk51.default.dim("  SKIP"), KNOWN: import_chalk51.default.yellow(" KNOWN") };
   for (const ch of checks) {
-    console.log(`  ${mark[ch.status]}  ${import_chalk50.default.bold(ch.name)}`);
-    console.log(import_chalk50.default.dim(`          ${ch.detail}`));
+    console.log(`  ${mark[ch.status]}  ${import_chalk51.default.bold(ch.name)}`);
+    console.log(import_chalk51.default.dim(`          ${ch.detail}`));
   }
   const fails = checks.filter((c) => c.status === "FAIL").length;
   const skips = checks.filter((c) => c.status === "SKIP").length;
   const known = checks.filter((c) => c.status === "KNOWN").length;
   console.log("");
   const passes = checks.filter((c) => c.status === "PASS").length;
-  if (fails) console.log(import_chalk50.default.red(`  ${fails} check(s) FAILED.`));
-  else if (passes) console.log(import_chalk50.default.green(`  ${passes} check(s) passed, 0 failed.`));
-  else console.log(import_chalk50.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
-  if (known) console.log(import_chalk50.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
-  if (skips) console.log(import_chalk50.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
+  if (fails) console.log(import_chalk51.default.red(`  ${fails} check(s) FAILED.`));
+  else if (passes) console.log(import_chalk51.default.green(`  ${passes} check(s) passed, 0 failed.`));
+  else console.log(import_chalk51.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
+  if (known) console.log(import_chalk51.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
+  if (skips) console.log(import_chalk51.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
   console.log("");
 }
 
@@ -10503,93 +10891,93 @@ var OP_COMMANDS = [
 function renderOpCommands() {
   const width = Math.max(...OP_COMMANDS.map((c) => c.cmd.length)) + 10;
   const lines = OP_COMMANDS.map((c) => {
-    const left = `  ${import_chalk51.default.cyan(`apiblaze ${c.cmd}`)}`;
+    const left = `  ${import_chalk52.default.cyan(`apiblaze ${c.cmd}`)}`;
     const pad = " ".repeat(Math.max(1, width - c.cmd.length));
-    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk51.default.dim(`(${c.extra})`) : ""}`;
+    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk52.default.dim(`(${c.extra})`) : ""}`;
   });
   return [
-    import_chalk51.default.bold("Operator commands"),
+    import_chalk52.default.bold("Operator commands"),
     ...lines,
     "",
-    import_chalk51.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
-    import_chalk51.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
-    import_chalk51.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
+    import_chalk52.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
+    import_chalk52.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
+    import_chalk52.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
     "",
-    import_chalk51.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
-    import_chalk51.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
-    import_chalk51.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
+    import_chalk52.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
+    import_chalk52.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
+    import_chalk52.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
   ].join("\n");
 }
 function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk51.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk51.default.bold("\n  Upstash"));
+  console.log(import_chalk52.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk52.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk51.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk51.default.yellow(o.key)} ${import_chalk51.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk51.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk52.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk52.default.yellow(o.key)} ${import_chalk52.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk52.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk51.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk52.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk51.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk52.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk51.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk51.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
-  console.log(import_chalk51.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk52.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk52.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
+  console.log(import_chalk52.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk51.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk52.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk51.default.yellow(s.store_id)} ${import_chalk51.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk52.default.yellow(s.store_id)} ${import_chalk52.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk51.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk52.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk51.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk52.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk51.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk52.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk51.default.yellow(s.store_id)} ${import_chalk51.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk52.default.yellow(s.store_id)} ${import_chalk52.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk51.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk52.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk51.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk52.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
-  console.log(import_chalk51.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
+  console.log(import_chalk52.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk51.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk51.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk51.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk52.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk52.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk52.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk51.default.green(`    no ghost tuples ${import_chalk51.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk52.default.green(`    no ghost tuples ${import_chalk52.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk51.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk52.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk51.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk52.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk51.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk52.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}, view) {
   if (!loadCredentials()) {
-    console.log(import_chalk51.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk52.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk51.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk52.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
@@ -10615,17 +11003,17 @@ async function runOp(sub, opts = {}, view) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk51.default.green("Nothing to sweep."));
+        console.log(import_chalk52.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline3 = await import("readline/promises");
         const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk51.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk52.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk51.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk52.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -10635,25 +11023,25 @@ async function runOp(sub, opts = {}, view) {
     case "mark": {
       const label3 = (view ?? "").trim();
       if (!label3) {
-        console.log(import_chalk51.default.red("Give the change a name:") + import_chalk51.default.cyan(' apiblaze op mark "cached tenant count"'));
+        console.log(import_chalk52.default.red("Give the change a name:") + import_chalk52.default.cyan(' apiblaze op mark "cached tenant count"'));
         return;
       }
       const res = await opCall({ method: "POST", path: "/operator/latency/mark", body: { label: label3 }, summary: "record change marker" });
       const ts = new Date(res?.marker?.ts ?? Date.now()).toISOString();
-      console.log(import_chalk51.default.green(`
-  Marked: `) + import_chalk51.default.bold(label3));
-      console.log(import_chalk51.default.dim(`  ${ts}`));
-      console.log(import_chalk51.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk51.default.cyan("apiblaze op latency compare") + "\n");
+      console.log(import_chalk52.default.green(`
+  Marked: `) + import_chalk52.default.bold(label3));
+      console.log(import_chalk52.default.dim(`  ${ts}`));
+      console.log(import_chalk52.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk52.default.cyan("apiblaze op latency compare") + "\n");
       return;
     }
     case "credits": {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk51.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk52.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk51.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk51.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk51.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk52.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk52.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk52.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
@@ -10664,7 +11052,7 @@ async function runOp(sub, opts = {}, view) {
     case "billing": {
       const which = (view ?? "").trim().toLowerCase();
       if (which && which !== "doors" && which !== "meter") {
-        return void console.log(import_chalk51.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
+        return void console.log(import_chalk52.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
       }
       const checks = [];
       let doorsData = null;
@@ -10725,29 +11113,29 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/grades${q}`, summary: "latency grades" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const t = data.thresholds_ms;
-        console.log(import_chalk51.default.bold("\nHow good was apiblaze itself?") + import_chalk51.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
-        console.log(import_chalk51.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
+        console.log(import_chalk52.default.bold("\nHow good was apiblaze itself?") + import_chalk52.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
+        console.log(import_chalk52.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
 `));
-        console.log(import_chalk51.default.dim("  date         reqs   excellent      okay       bad  terrible"));
+        console.log(import_chalk52.default.dim("  date         reqs   excellent      okay       bad  terrible"));
         for (const d of data.days ?? []) {
           const p = d.pct;
-          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk51.default.dim(`${String(v).padStart(5)}%`);
+          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk52.default.dim(`${String(v).padStart(5)}%`);
           console.log(
-            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk51.default.green)}  ${cell(p.okay, import_chalk51.default.cyan)}  ${cell(p.bad, import_chalk51.default.yellow)}  ${cell(p.terrible, import_chalk51.default.red)}`
+            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk52.default.green)}  ${cell(p.okay, import_chalk52.default.cyan)}  ${cell(p.bad, import_chalk52.default.yellow)}  ${cell(p.terrible, import_chalk52.default.red)}`
           );
         }
         const cul = data.culprits ?? [];
         if (cul.length) {
-          console.log(import_chalk51.default.bold("\n  Who caused the bad and terrible ones\n"));
-          console.log(import_chalk51.default.dim("     bad  terrible  feature \u2192 dependency"));
+          console.log(import_chalk52.default.bold("\n  Who caused the bad and terrible ones\n"));
+          console.log(import_chalk52.default.dim("     bad  terrible  feature \u2192 dependency"));
           for (const r of cul.slice(0, 12)) {
             if (!r.bad && !r.terrible) continue;
             console.log(
-              `  ${String(r.bad).padStart(6)}  ${import_chalk51.default.red(String(r.terrible).padStart(8))}  ${import_chalk51.default.yellow(r.feature)} ${import_chalk51.default.dim("\u2192")} ${import_chalk51.default.cyan(r.dep)}`
+              `  ${String(r.bad).padStart(6)}  ${import_chalk52.default.red(String(r.terrible).padStart(8))}  ${import_chalk52.default.yellow(r.feature)} ${import_chalk52.default.dim("\u2192")} ${import_chalk52.default.cyan(r.dep)}`
             );
           }
         }
-        if (data.caveat) console.log(import_chalk51.default.dim(`
+        if (data.caveat) console.log(import_chalk52.default.dim(`
   \u26A0 ${data.caveat}
 `));
         return;
@@ -10756,24 +11144,24 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/compare${q}`, summary: "latency before/after" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const b = data.before, a = data.after, d = data.delta;
-        console.log(import_chalk51.default.bold(`
-Before vs after: `) + import_chalk51.default.cyan(data.marker.label));
-        console.log(import_chalk51.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
+        console.log(import_chalk52.default.bold(`
+Before vs after: `) + import_chalk52.default.cyan(data.marker.label));
+        console.log(import_chalk52.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
 `));
         const row = (name, before, after, delta) => {
           const arrow = delta === 0 ? "=" : delta < 0 ? "\u2193" : "\u2191";
           const txt = `${String(before).padStart(6)}ms  \u2192${String(after).padStart(7)}ms   ${arrow}${Math.abs(delta)}ms`;
-          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk51.default.green(txt) : import_chalk51.default.red(txt) : import_chalk51.default.dim(txt)}`);
+          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk52.default.green(txt) : import_chalk52.default.red(txt) : import_chalk52.default.dim(txt)}`);
         };
-        console.log(import_chalk51.default.dim("  metric                 before        after      change"));
+        console.log(import_chalk52.default.dim("  metric                 before        after      change"));
         row("total p50", b.total_p50, a.total_p50, d.total_p50);
         row("total p95", b.total_p95, a.total_p95, d.total_p95);
         row("apiblaze overhead p50", b.gw_p50, a.gw_p50, d.gw_p50);
         row("apiblaze overhead p95", b.gw_p95, a.gw_p95, d.gw_p95);
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   requests: ${b.requests} before \xB7 ${a.requests} after`));
         for (const w of data.warnings ?? []) {
-          console.log((data.trustworthy ? import_chalk51.default.dim : import_chalk51.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
+          console.log((data.trustworthy ? import_chalk52.default.dim : import_chalk52.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
         }
         console.log("");
         return;
@@ -10782,19 +11170,19 @@ Before vs after: `) + import_chalk51.default.cyan(data.marker.label));
         const data = await opCall({ method: "GET", path: `/operator/latency/slow${q}`, summary: "slowest requests" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk51.default.dim("No requests over the threshold in that window."));
-        console.log(import_chalk51.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk52.default.dim("No requests over the threshold in that window."));
+        console.log(import_chalk52.default.bold(`
 Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
 `));
-        console.log(import_chalk51.default.dim("  total   ours   theirs  blame                 request id"));
+        console.log(import_chalk52.default.dim("  total   ours   theirs  blame                 request id"));
         for (const r of rows2.slice(0, 30)) {
           console.log(
-            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk51.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk51.default.dim(r.request_id || "")}`
+            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk52.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk52.default.dim(r.request_id || "")}`
           );
         }
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   The last column is the request id (Cloudflare calls it a "cf-ray"). Look one up with`));
-        console.log(import_chalk51.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
+        console.log(import_chalk52.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
 `));
         return;
       }
@@ -10802,18 +11190,18 @@ Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
         const data = await opCall({ method: "GET", path: `/operator/latency/llm${q}`, summary: "llm latency" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk51.default.dim("No LLM traffic in that window."));
-        console.log(import_chalk51.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk52.default.dim("No LLM traffic in that window."));
+        console.log(import_chalk52.default.bold(`
 LLM timing \u2014 last ${data.window_hours}h
 `));
-        console.log(import_chalk51.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
+        console.log(import_chalk52.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
         for (const r of rows2) {
           const n = r.turns ?? r.requests ?? 0;
           console.log(
             `  ${String(Math.round(n)).padStart(8)}   ${String(Math.round(r.turn_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.ttfc_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.gen_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms ?? 0)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95 ?? 0)).padStart(6)}/${String(Math.round(r.output_tokens_p95 ?? 0)).padEnd(6)}   ${r.model || "-"}`
           );
         }
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   ${data.note}
 `));
         return;
@@ -10824,26 +11212,26 @@ LLM timing \u2014 last ${data.window_hours}h
       ]);
       if (opts.json) return void console.log(JSON.stringify({ blame, summary }, null, 2));
       const ov = summary?.apiblaze_overhead_ms ?? {};
-      console.log(import_chalk51.default.bold(`
+      console.log(import_chalk52.default.bold(`
 Latency \u2014 last ${summary?.window_hours ?? "?"}h, ${Number(summary?.requests ?? 0).toLocaleString()} requests
 `));
-      console.log(`  ${import_chalk51.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk51.default.dim("\u2190 ours")}`);
-      console.log(`  ${import_chalk51.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk51.default.dim("\u2190 theirs")}`);
-      console.log(import_chalk51.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
+      console.log(`  ${import_chalk52.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk52.default.dim("\u2190 ours")}`);
+      console.log(`  ${import_chalk52.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk52.default.dim("\u2190 theirs")}`);
+      console.log(import_chalk52.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
 `));
       const rows = blame?.blame ?? [];
-      if (!rows.length) return void console.log(import_chalk51.default.dim("No latency rows in that window."));
-      console.log(import_chalk51.default.bold("  Which feature ate the time, and what inside it\n"));
-      console.log(import_chalk51.default.dim("   share   p95      feature \u2192 dependency"));
+      if (!rows.length) return void console.log(import_chalk52.default.dim("No latency rows in that window."));
+      console.log(import_chalk52.default.bold("  Which feature ate the time, and what inside it\n"));
+      console.log(import_chalk52.default.dim("   share   p95      feature \u2192 dependency"));
       for (const r of rows.slice(0, 15)) {
         const share = `${(r.share * 100).toFixed(1)}%`;
-        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk51.default.yellow(r.feature)} ${import_chalk51.default.dim("\u2192")} ${import_chalk51.default.cyan(r.dep)}`);
+        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk52.default.yellow(r.feature)} ${import_chalk52.default.dim("\u2192")} ${import_chalk52.default.cyan(r.dep)}`);
       }
       console.log("");
       return;
     }
     default:
-      console.log(import_chalk51.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk52.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -10876,7 +11264,7 @@ program.command("login").description("Authenticate with APIblaze").option("--tea
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--openapi <file|url>", "Create FROM an OpenAPI spec instead of --target \u2014 a local file or a URL (e.g. https://pokeapi.co/openapi.yaml). Routes, API version and environments (one per `servers` entry) all come from the spec").option("--openapispec <file|url>", "Alias for --openapi").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -10889,7 +11277,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Author an object-level access rule in plain English, in one shot (billed per turn)").argument("<rule>", 'The rule in plain English, e.g. "users see only their own rows"').argument("<project>", "Project name or id").option("--enforce", "Turn enforcement on immediately (default: shadow-publish only)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((rule, project, opts) => runRule(rule, project, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--openapi <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--openapispec <file|url>", "Alias for --openapi").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapi is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
+program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
 llm.command("show").description("Show the locally stored LLM key (masked)").action(action(() => runLlmShow()));
@@ -10906,7 +11294,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk52.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk53.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile, newSession: opts.newSession });
@@ -11038,7 +11426,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk52.default.bold(g.title)}
+    return `${import_chalk53.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -11076,14 +11464,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk52.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk53.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk52.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk52.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk53.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk53.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -11091,16 +11479,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk52.default.red(`
+    console.error(import_chalk53.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk52.default.red(`
+    console.error(import_chalk53.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk52.default.red("\nUnknown error"));
+    console.error(import_chalk53.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);