apiblaze 0.20.9 → 0.20.10

package/dist/index.js

@@ -472,6 +472,98 @@ var init_admin = __esm({
   }
 });
 
+// src/lib/spec-or-target.ts
+var spec_or_target_exports = {};
+__export(spec_or_target_exports, {
+  classifyTargetInput: () => classifyTargetInput,
+  looksLikeSpecDoc: () => looksLikeSpecDoc
+});
+function looksLikeSpecDoc(text) {
+  const probe = (d) => !!d && typeof d === "object" && !Array.isArray(d) && (typeof d.openapi === "string" || typeof d.swagger === "string") && typeof d.paths === "object";
+  try {
+    if (probe(JSON.parse(text))) return true;
+  } catch {
+  }
+  try {
+    if (probe((0, import_yaml.parse)(text))) return true;
+  } catch {
+  }
+  return false;
+}
+function isHttpUrl(s) {
+  try {
+    const u = new URL(s);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function smellsLikeSpecUrl(u) {
+  try {
+    const { pathname } = new URL(u);
+    return /\.(ya?ml|json)$/i.test(pathname) || /openapi|swagger/i.test(pathname);
+  } catch {
+    return false;
+  }
+}
+async function fetchTextCapped(url, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      signal: controller.signal,
+      headers: { accept: "application/yaml, application/json, text/yaml, text/plain;q=0.8, */*;q=0.5" }
+    });
+    if (!res.ok) return null;
+    const text = await res.text();
+    return text.length > MAX_SPEC_BYTES ? null : text;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function classifyTargetInput(input, failFn) {
+  const t = (input ?? "").trim();
+  if (!isHttpUrl(t)) {
+    let isFile = false;
+    try {
+      isFile = fs4.existsSync(t) && fs4.statSync(t).isFile();
+    } catch {
+      isFile = false;
+    }
+    if (isFile) {
+      const text2 = fs4.readFileSync(t, "utf-8");
+      if (looksLikeSpecDoc(text2)) return { kind: "spec", specText: text2, source: t };
+      failFn(
+        `${t} exists but is not an OpenAPI/Swagger document (no openapi/swagger version field with paths).`,
+        "Pass a spec file, a spec URL, or a target server base URL."
+      );
+    }
+    return { kind: "server" };
+  }
+  if (smellsLikeSpecUrl(t)) {
+    const text2 = await fetchTextCapped(t, 2e4);
+    if (text2 && looksLikeSpecDoc(text2)) return { kind: "spec", specText: text2, source: t };
+    failFn(
+      `${t} looks like an OpenAPI file but did not return a valid OpenAPI/Swagger document.`,
+      text2 === null ? "The URL could not be fetched (or is over 5MB). Check it in a browser." : "The response parsed, but has no openapi/swagger version field with paths."
+    );
+  }
+  const text = await fetchTextCapped(t, 6e3);
+  if (text && looksLikeSpecDoc(text)) return { kind: "spec", specText: text, source: t };
+  return { kind: "server" };
+}
+var fs4, import_yaml, MAX_SPEC_BYTES;
+var init_spec_or_target = __esm({
+  "src/lib/spec-or-target.ts"() {
+    "use strict";
+    fs4 = __toESM(require("fs"));
+    import_yaml = require("yaml");
+    MAX_SPEC_BYTES = 5 * 1024 * 1024;
+  }
+});
+
 // src/lib/resolve.ts
 function requireAuth() {
   const creds = loadCredentials();
@@ -932,7 +1024,7 @@ var import_commander = require("commander");
 var import_chalk52 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.20.9";
+var version = "0.20.10";
 
 // src/index.ts
 init_types();
@@ -2007,7 +2099,7 @@ function suggestTenantName(projectSlug, taken) {
 }
 
 // src/commands/create.ts
-var import_yaml = require("yaml");
+var import_yaml2 = require("yaml");
 var import_chalk11 = __toESM(require("chalk"));
 var import_ora5 = __toESM(require("ora"));
 init_auth();
@@ -2015,7 +2107,7 @@ init_api();
 function normalizeName(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function isHttpUrl(s) {
+function isHttpUrl2(s) {
   try {
     const u = new URL((s || "").trim());
     return u.protocol === "http:" || u.protocol === "https:";
@@ -2025,7 +2117,7 @@ function isHttpUrl(s) {
 }
 async function loadOpenapiSource(ref) {
   let text;
-  if (isHttpUrl(ref)) {
+  if (isHttpUrl2(ref)) {
     const res = await fetch(ref.trim(), {
       headers: { accept: "application/json, application/yaml, text/yaml, */*" }
     }).catch((err) => fail(`Could not fetch the OpenAPI spec at ${ref} \u2014 ${err.message}`));
@@ -2041,7 +2133,7 @@ async function loadOpenapiSource(ref) {
   if (!text.trim()) fail(`The OpenAPI spec is empty: ${ref}`);
   let parsed;
   try {
-    parsed = text.trimStart().startsWith("{") ? JSON.parse(text) : (0, import_yaml.parse)(text);
+    parsed = text.trimStart().startsWith("{") ? JSON.parse(text) : (0, import_yaml2.parse)(text);
   } catch (err) {
     fail(`Could not parse the OpenAPI spec at ${ref} as JSON or YAML \u2014 ${err.message}`);
   }
@@ -2070,8 +2162,9 @@ function stripTenantFromPortal(devPortal) {
     return devPortal;
   }
 }
-function fail(message) {
+function fail(message, hint) {
   console.error(import_chalk11.default.red(`Error: ${message}`));
+  if (hint) console.error(import_chalk11.default.dim(hint));
   process.exit(1);
 }
 function buildTryItCurl(url, authType, apiKey) {
@@ -2094,14 +2187,84 @@ function printCurlExample(url, authType, apiKey, devPortal) {
   }
 }
 var VALID_AUTH = ["api_key", "none", "oauth"];
+function parseOauthFlag(raw) {
+  if (raw === void 0 || raw === false) return null;
+  if (raw === true || typeof raw === "string" && raw.trim() === "") {
+    return {
+      auth: "oauth",
+      bodyPatch: { login: { providers: [{ type: "github", managed: true }] } },
+      summary: "APIblaze-hosted GitHub sign-in (managed)"
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(String(raw));
+  } catch {
+    fail(
+      `--oauth value is not valid JSON: ${raw}`,
+      `Shapes:
+  --oauth                                          APIblaze GitHub sign-in
+  --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'
+  --oauth '{"provider":"google","clientId":"\u2026","clientSecret":"\u2026"}'`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--oauth must be a JSON object (or bare).");
+  if (typeof parsed.iss === "string") {
+    const iss = parsed.iss.trim();
+    const aud = typeof parsed.aud === "string" ? parsed.aud.trim() : "";
+    const jwks = typeof parsed.jwks === "string" ? parsed.jwks.trim() : typeof parsed.jwks_url === "string" ? parsed.jwks_url.trim() : "";
+    if (!iss || !aud || !jwks) fail("--oauth issuer shape needs all three of: iss, aud, jwks (a JWKS URL).");
+    if (!isHttpUrl2(jwks)) fail("--oauth: jwks must be an http(s) JWKS URL.");
+    return {
+      auth: "oauth",
+      bodyPatch: {
+        requests_auth: {
+          mode: "authenticate",
+          methods: ["jwt"],
+          jwt: { allowed_pairs: [{ iss, aud, jwks_url: jwks }] }
+        }
+      },
+      summary: `your own hosted login \u2014 JWTs from ${iss} (aud ${aud})`
+    };
+  }
+  if (typeof parsed.provider === "string") {
+    const provider = parsed.provider.trim().toLowerCase();
+    const PROVIDERS2 = ["github", "google", "microsoft", "facebook", "auth0"];
+    if (!PROVIDERS2.includes(provider)) fail(`--oauth: unknown provider "${provider}". One of: ${PROVIDERS2.join(" \xB7 ")}.`);
+    const clientId = typeof parsed.clientId === "string" ? parsed.clientId.trim() : typeof parsed.client_id === "string" ? parsed.client_id.trim() : "";
+    const clientSecret = typeof parsed.clientSecret === "string" ? parsed.clientSecret.trim() : typeof parsed.client_secret === "string" ? parsed.client_secret.trim() : "";
+    if (!clientId || !clientSecret) fail("--oauth provider shape needs clientId and clientSecret (from your OAuth app).");
+    return {
+      auth: "oauth",
+      bodyPatch: {
+        login: {
+          providers: [{ type: provider, client_id: clientId, client_secret: clientSecret }]
+        }
+      },
+      summary: `APIblaze-hosted login page with your own ${provider} app`
+    };
+  }
+  fail('--oauth JSON must contain either "iss" (your JWT issuer) or "provider" (your OAuth app).');
+}
 async function runCreate(opts = {}) {
+  if (opts.target && opts.openapi === void 0) {
+    const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
+    const c = await classifyTargetInput2(opts.target, fail);
+    if (c.kind === "spec") {
+      console.log(import_chalk11.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 creating FROM the spec.`));
+      opts.openapi = opts.target;
+      opts.target = void 0;
+    }
+  }
   const creds = loadCredentials();
   if (!creds) {
     await runAnonymousCreate(opts);
     return;
   }
   const interactive = !!process.stdin.isTTY && !opts.json;
-  const auth = (opts.auth ?? "api_key").toLowerCase();
+  if (opts.apikey && opts.oauth !== void 0 && opts.oauth !== false) fail("Pass either --apikey or --oauth, not both.");
+  const oauthPlan = parseOauthFlag(opts.oauth);
+  const auth = (oauthPlan ? oauthPlan.auth : opts.apikey ? "api_key" : opts.auth ?? "api_key").toLowerCase();
   if (!VALID_AUTH.includes(auth)) {
     fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
   }
@@ -2171,7 +2334,7 @@ async function runCreate(opts = {}) {
   let targetUrl = "";
   if (openapiContent) {
   } else if (opts.target !== void 0) {
-    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+    if (!isHttpUrl2(opts.target)) fail("--target must be a valid http(s) URL.");
     targetUrl = opts.target.trim();
   } else if (interactive) {
     const { default: inquirer3 } = await import("inquirer");
@@ -2181,7 +2344,7 @@ async function runCreate(opts = {}) {
         name: "url",
         message: "Target URL to forward requests to (e.g. https://httpbin.org):"
       }]);
-      if (!isHttpUrl(url)) {
+      if (!isHttpUrl2(url)) {
         console.log(import_chalk11.default.yellow("  Enter a valid http(s) URL.\n"));
         continue;
       }
@@ -2193,7 +2356,7 @@ async function runCreate(opts = {}) {
   }
   if (interactive && !opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
-    console.log(`${import_chalk11.default.cyan("\u2192")} Auth: ${import_chalk11.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
+    console.log(`${import_chalk11.default.cyan("\u2192")} Auth: ${import_chalk11.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : oauthPlan ? ` \u2014 ${oauthPlan.summary}` : ""}`);
     const { ok } = await inquirer3.prompt([{
       type: "confirm",
       name: "ok",
@@ -2218,6 +2381,7 @@ async function runCreate(opts = {}) {
       ...openapiContent ? { openapi: openapiContent } : { target_url: targetUrl },
       auth_type: auth,
       team_id: teamId,
+      ...oauthPlan ? oauthPlan.bodyPatch : {},
       ...chosenTenant ? { tenant: chosenTenant } : {},
       ...opts.apiversion ? { api_version: opts.apiversion } : {}
     });
@@ -2298,7 +2462,7 @@ async function runAnonymousCreate(opts) {
   if (opts.openapi !== void 0) {
     body.openapi = await loadOpenapiSource(opts.openapi);
   }
-  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+  if (opts.target && !isHttpUrl2(opts.target)) fail("--target must be a valid http(s) URL.");
   let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
   const hasOtherSource = !!(body.openapi || body.github);
   if (!target && !hasOtherSource) {
@@ -2320,7 +2484,7 @@ async function runAnonymousCreate(opts) {
           name: "url",
           message: "Target URL to forward requests to (e.g. https://httpbin.org):"
         }]);
-        if (!isHttpUrl(url)) {
+        if (!isHttpUrl2(url)) {
           console.log(import_chalk11.default.yellow("  Enter a valid http(s) URL.\n"));
           continue;
         }
@@ -2344,7 +2508,15 @@ async function runAnonymousCreate(opts) {
   if (opts.product) body.product_slug = normalizeName(opts.product);
   if (opts.displayName) body.display_name = opts.displayName;
   if (opts.apiversion) body.api_version = opts.apiversion;
-  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
+  if (opts.apikey && opts.oauth !== void 0 && opts.oauth !== false) fail("Pass either --apikey or --oauth, not both.");
+  const oauthPlan = parseOauthFlag(opts.oauth);
+  if (oauthPlan) {
+    Object.assign(body, oauthPlan.bodyPatch);
+    if (oauthPlan.auth !== "api_key" && !("requests_auth" in oauthPlan.bodyPatch)) body.auth_type = oauthPlan.auth;
+    if (!opts.json) console.log(`${import_chalk11.default.cyan("\u2192")} Login: ${oauthPlan.summary}`);
+  } else if (opts.auth && opts.auth !== "api_key" && !opts.apikey) {
+    body.auth_type = opts.auth;
+  }
   const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
   const cred = loadAnonCred2();
@@ -2487,7 +2659,7 @@ var import_chalk13 = __toESM(require("chalk"));
 init_auth();
 
 // src/lib/consumer-auth.ts
-var fs5 = __toESM(require("fs"));
+var fs6 = __toESM(require("fs"));
 var os3 = __toESM(require("os"));
 var path3 = __toESM(require("path"));
 var crypto = __toESM(require("crypto"));
@@ -2498,19 +2670,19 @@ var CONSUMER_PATH = path3.join(APIBLAZE_DIR2, "consumer.json");
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function loadConsumer() {
   try {
-    return JSON.parse(fs5.readFileSync(CONSUMER_PATH, "utf-8"));
+    return JSON.parse(fs6.readFileSync(CONSUMER_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveConsumer(creds) {
-  fs5.mkdirSync(APIBLAZE_DIR2, { recursive: true });
-  fs5.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
-  fs5.chmodSync(CONSUMER_PATH, 384);
+  fs6.mkdirSync(APIBLAZE_DIR2, { recursive: true });
+  fs6.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
+  fs6.chmodSync(CONSUMER_PATH, 384);
 }
 function clearConsumer() {
   try {
-    fs5.unlinkSync(CONSUMER_PATH);
+    fs6.unlinkSync(CONSUMER_PATH);
     return true;
   } catch {
     return false;
@@ -2655,12 +2827,12 @@ async function runLogout(opts = {}) {
 
 // src/commands/flush.ts
 var import_chalk14 = __toESM(require("chalk"));
-var fs6 = __toESM(require("fs"));
+var fs7 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
 init_auth();
 async function runFlush(opts) {
   const dir = getApiblazeDir();
-  const entries2 = fs6.existsSync(dir) ? fs6.readdirSync(dir) : [];
+  const entries2 = fs7.existsSync(dir) ? fs7.readdirSync(dir) : [];
   if (!entries2.length) {
     console.log(import_chalk14.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
@@ -2684,7 +2856,7 @@ async function runFlush(opts) {
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs6.rmSync(path4.join(dir, e), { recursive: true, force: true });
+      fs7.rmSync(path4.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
       console.log(import_chalk14.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
@@ -6310,7 +6482,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs7 = __toESM(require("fs"));
+var fs8 = __toESM(require("fs"));
 var import_chalk37 = __toESM(require("chalk"));
 var import_ora16 = __toESM(require("ora"));
 init_admin();
@@ -6333,7 +6505,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs7.readFileSync(opts.file, "utf-8");
+    specContent = fs8.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk37.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -6862,6 +7034,15 @@ var SETTINGS = [
     read: (cfg) => cfg.chat_sponsorship?.max_chars_per_message ?? 2e3,
     toPatch: (v) => ({ chat_sponsorship: { max_chars_per_message: v } })
   },
+  {
+    key: "chat_prompt_addendum",
+    label: "AI chat: steering notes",
+    group: "Portal & MCP",
+    type: "string",
+    desc: `Notes the chat assistant follows on this API \u2014 tone, suggestions, house rules ("always suggest the daily special"). Injected beneath the assistant's safety rules, so it can steer style but never override them. Max 1000 chars; empty clears`,
+    read: (cfg) => cfg.chat_prompt_addendum ?? "",
+    toPatch: (v) => ({ chat_prompt_addendum: typeof v === "string" && v.trim() ? v.trim() : null })
+  },
   // ── Advanced (specs/missing.md): all optional, default-off; null clears ────
   {
     key: "ip_access.mode",
@@ -8088,19 +8269,19 @@ async function runPreapprove(who, opts) {
 }
 
 // src/commands/apichat.ts
-var fs9 = __toESM(require("fs"));
+var fs10 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
 var import_chalk46 = __toESM(require("chalk"));
 var import_ora23 = __toESM(require("ora"));
-var import_yaml2 = require("yaml");
+var import_yaml3 = require("yaml");
 init_auth();
 init_anon_cred();
 init_api();
 init_admin();
 
 // src/commands/llm.ts
-var fs8 = __toESM(require("fs"));
+var fs9 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
 var import_chalk45 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
@@ -8116,15 +8297,15 @@ function detectProvider(key) {
 }
 function loadLlmConfig() {
   try {
-    return JSON.parse(fs8.readFileSync(LLM_PATH, "utf-8"));
+    return JSON.parse(fs9.readFileSync(LLM_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveLlmConfig(cfg) {
-  fs8.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs8.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
-  fs8.chmodSync(LLM_PATH, 384);
+  fs9.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs9.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
+  fs9.chmodSync(LLM_PATH, 384);
 }
 async function runLlmSetKey(keyArg, opts) {
   let key = keyArg?.trim();
@@ -8163,7 +8344,7 @@ async function runLlmShow() {
 }
 async function runLlmClearKey() {
   try {
-    fs8.unlinkSync(LLM_PATH);
+    fs9.unlinkSync(LLM_PATH);
     console.log(`${import_chalk45.default.green("\u2713")} Removed local LLM key.`);
   } catch {
     console.log(import_chalk45.default.gray("No LLM key was set."));
@@ -8182,7 +8363,7 @@ Error: ${message}`));
 function normalizeName3(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function isHttpUrl2(s) {
+function isHttpUrl3(s) {
   try {
     const u = new URL((s || "").trim());
     return u.protocol === "http:" || u.protocol === "https:";
@@ -8196,7 +8377,7 @@ function parseSpec(text) {
     parsed = JSON.parse(text);
   } catch {
     try {
-      parsed = (0, import_yaml2.parse)(text);
+      parsed = (0, import_yaml3.parse)(text);
     } catch {
       fail4("Could not parse the spec as JSON or YAML.");
     }
@@ -8233,21 +8414,21 @@ async function discoverSpec(target) {
 }
 async function loadSpec(opts) {
   if (opts.openapispec) {
-    if (isHttpUrl2(opts.openapispec)) {
+    if (isHttpUrl3(opts.openapispec)) {
       const text2 = await fetchText(opts.openapispec);
       if (!text2) fail4(`Could not fetch the spec at ${opts.openapispec}.`);
       return { spec: parseSpec(text2), sourceUrl: opts.openapispec };
     }
     let text;
     try {
-      text = fs9.readFileSync(opts.openapispec, "utf-8");
+      text = fs10.readFileSync(opts.openapispec, "utf-8");
     } catch {
       fail4(`Cannot read spec file: ${opts.openapispec}`);
     }
     return { spec: parseSpec(text) };
   }
   if (opts.target) {
-    if (!isHttpUrl2(opts.target)) fail4("--target must be a valid http(s) URL.");
+    if (!isHttpUrl3(opts.target)) fail4("--target must be a valid http(s) URL.");
     const found = await discoverSpec(opts.target);
     if (!found) {
       fail4(`No OpenAPI spec found at ${opts.target} (tried /openapi.json, /openapi.yaml, /swagger.json).`, GENERATOR_HINT);
@@ -8258,7 +8439,7 @@ async function loadSpec(opts) {
 }
 function resolveTarget(spec2, opts, sourceUrl) {
   if (opts.target) {
-    if (!isHttpUrl2(opts.target)) fail4("--target must be a valid http(s) URL.");
+    if (!isHttpUrl3(opts.target)) fail4("--target must be a valid http(s) URL.");
     return opts.target.trim();
   }
   const servers = Array.isArray(spec2.servers) ? spec2.servers : [];
@@ -8268,7 +8449,7 @@ function resolveTarget(spec2, opts, sourceUrl) {
   }
   try {
     const resolved = sourceUrl ? new URL(raw, sourceUrl).toString() : raw;
-    if (!isHttpUrl2(resolved)) {
+    if (!isHttpUrl3(resolved)) {
       fail4(`servers[0].url ("${raw}") is not an absolute URL and could not be resolved.`, "Re-run with --target <upstream base URL>.");
     }
     return resolved;
@@ -8378,9 +8559,10 @@ async function captureTargetSecret(auth, opts) {
   return secret;
 }
 async function dataPlaneAuth(p) {
+  const idHeader = p.endUserId ? { "X-End-User-Id": p.endUserId } : {};
   if (!p.consumerAuth) {
-    if (!p.dpKey) throw new Error("No API key for this proxy.");
-    return { "X-API-Key": p.dpKey };
+    if (!p.dpKey) return idHeader;
+    return { "X-API-Key": p.dpKey, ...idHeader };
   }
   const stored = loadConsumer();
   if (!stored) {
@@ -8388,7 +8570,7 @@ async function dataPlaneAuth(p) {
   }
   const fresh = await validConsumerToken(stored) ?? stored;
   if (fresh.accessToken !== stored.accessToken) saveConsumer(fresh);
-  return { Authorization: `Bearer ${fresh.accessToken}` };
+  return { Authorization: `Bearer ${fresh.accessToken}`, ...idHeader };
 }
 async function ensureConsumerLogin(teamId, tenant2, version2) {
   const resource = `https://${tenant2}.portal.apiblaze.com/${version2}`;
@@ -8648,7 +8830,6 @@ async function publishMcp(p, spec2) {
     return null;
   }
 }
-var CLIENT_ROUND_CAP = 12;
 function chatUrl(p) {
   return `https://${p.mcpHost}/${p.version}/${p.environment}/runtime-chat`;
 }
@@ -8656,91 +8837,66 @@ function maskKey(k) {
   return k.length <= 8 ? "****" : `${k.slice(0, 4)}\u2026${k.slice(-4)}`;
 }
 var revealAuth = false;
-function renderToolEvents(events, cred) {
-  for (const e of events ?? []) {
-    const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk46.default.green("\u2713") : import_chalk46.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk46.default.cyan(e.name)} ${import_chalk46.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
-    if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk46.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
-      if (cred) {
-        const shown = revealAuth ? cred.value : maskKey(cred.value);
-        const keyLine = `        -H '${cred.header}: ${shown}'`;
-        const hint = revealAuth ? "" : import_chalk46.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk46.default.dim(keyLine) + hint);
-      }
-    }
-  }
-}
-function renderToolResults(delta, events) {
-  const anyFailed = (events ?? []).some((e) => e.status === "error");
-  if (!anyFailed && !isVerbose()) return;
-  const cap = anyFailed ? 24 : 12;
-  for (const m of delta ?? []) {
-    if (!m || m.role !== "tool" || typeof m.content !== "string") continue;
-    const body = m.content.trim();
-    if (!body) continue;
-    const pretty = (() => {
-      try {
-        return JSON.stringify(JSON.parse(body), null, 2);
-      } catch {
-        return body;
-      }
-    })();
-    const lines = pretty.split("\n");
-    console.log(import_chalk46.default.dim("      response:"));
-    for (const line of lines.slice(0, cap)) {
-      console.log(import_chalk46.default.dim(`        ${line}`));
-    }
-    if (lines.length > cap) console.log(import_chalk46.default.dim(`        \u2026${lines.length - cap} more lines`));
-  }
-}
-function billingLine(billing) {
-  if (!billing || typeof billing.cents !== "number") return null;
-  if (typeof billing.free_turns_remaining === "number") return null;
-  const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk46.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk46.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
-  if (typeof billing.credits_remaining === "number") {
-    line += import_chalk46.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+function billingLine(info) {
+  if (!info || typeof info.charged_cents !== "number" || info.charged_cents <= 0) return null;
+  if (typeof info.free_turns_remaining === "number") return null;
+  const cents = info.charged_cents;
+  const usd = (cents / 100).toFixed(Math.abs(cents - Math.round(cents)) < 1e-9 ? 2 : 4);
+  let line = import_chalk46.default.magenta(`  \u{1F4B3} $${usd}`);
+  if (typeof info.credits_remaining === "number") {
+    line += import_chalk46.default.dim(` \xB7 balance $${(info.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
-function freeBudgetWarning(billing, anon) {
-  if (!anon || !billing) return null;
-  if (typeof billing.free_turns_remaining === "number") {
-    const left2 = billing.free_turns_remaining;
+function freeBudgetWarning(info, anon) {
+  if (!anon || !info) return null;
+  if (typeof info.free_turns_remaining === "number") {
+    const left2 = info.free_turns_remaining;
     if (left2 <= 0) return import_chalk46.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
     return import_chalk46.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
-  if (typeof billing.free_remaining_cents !== "number") return null;
-  const perTurn = Math.max(billing.cents || 0, 0.02);
-  const left = Math.floor(billing.free_remaining_cents / perTurn);
+  if (typeof info.free_remaining_cents !== "number") return null;
+  const perTurn = Math.max(info.charged_cents || 0, 0.02);
+  const left = Math.floor(info.free_remaining_cents / perTurn);
   if (left > 8) return null;
   if (left <= 0) return import_chalk46.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
   return import_chalk46.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
 }
-function printAssistant(delta) {
-  for (let i = delta.length - 1; i >= 0; i--) {
-    const m = delta[i];
-    if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk46.default.green("assistant \u203A ") + m.content + "\n");
-      return;
+async function readSse(body, onEvent) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buf = "";
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    for (; ; ) {
+      const at = buf.indexOf("\n\n");
+      if (at === -1) break;
+      const rawEvent = buf.slice(0, at);
+      buf = buf.slice(at + 2);
+      const data = rawEvent.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
+      if (!data || data === "[DONE]") continue;
+      try {
+        onEvent(JSON.parse(data));
+      } catch {
+      }
     }
   }
 }
 async function replTurn(p, messages, userText) {
-  messages.push({ role: "user", content: userText });
+  messages.push({ id: crypto2.randomUUID(), role: "user", parts: [{ type: "text", text: userText }] });
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
-  for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora23.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
-    const body = {
-      turn_id: turnId,
-      messages,
-      environment: p.environment,
-      ...llm2 ? { llm_api_key: llm2.key, llm_provider: llm2.provider } : {}
-    };
-    let res;
+  const spinner = (0, import_ora23.default)({ text: "thinking...", color: "magenta" }).start();
+  const body = {
+    turn_id: turnId,
+    messages,
+    environment: p.environment,
+    ...llm2 ? { llm_api_key: llm2.key, llm_provider: llm2.provider } : {}
+  };
+  let res = null;
+  for (let attempt = 0; attempt < 3; attempt++) {
     try {
       res = await fetch(chatUrl(p), {
         method: "POST",
@@ -8752,57 +8908,248 @@ async function replTurn(p, messages, userText) {
       console.log(import_chalk46.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
+    if ((res.headers.get("content-type") ?? "").includes("text/event-stream") && res.ok && res.body) break;
+    spinner.stop();
     let data = null;
     try {
       data = await res.json();
     } catch {
     }
-    spinner.stop();
-    if (data && data.upsell) {
-      renderUpsell(p, data.upsell);
+    const errObj = data && typeof data.error === "object" ? data.error : null;
+    const code = errObj && errObj.code || null;
+    const msg = String(errObj && errObj.message || data && (data.error || data.message) || "");
+    const tty = !!process.stdin.isTTY;
+    if (res.status === 404 && /project not found/i.test(msg)) {
+      const flipped = p.mcpHost.includes(".tryabz.run") ? p.mcpHost.replace(".tryabz.run", ".abz.run") : p.mcpHost.replace(".abz.run", ".tryabz.run");
+      if (flipped !== p.mcpHost && attempt === 0) {
+        p.mcpHost = flipped;
+        p.proxyUrl = p.proxyUrl?.includes("tryabz.run") ? p.proxyUrl.replace("tryabz.run", "abz.run") : p.proxyUrl?.replace("abz.run", "tryabz.run");
+        p.anon = flipped.includes(".tryabz.run");
+        spinner.start("retrying on the " + (p.anon ? "trial" : "claimed") + " plane\u2026");
+        continue;
+      }
+      console.log(import_chalk46.default.red(`  No proxy named ${p.projectId} was found (tried both abz.run and tryabz.run).`));
       return;
     }
-    if (res.status === 402 || res.status === 403) {
-      renderUpsell(p, { reason: "PAUSED", message: data && data.error || "This turn is not available on your current plan." });
+    if (code === "identity_required" || /identif/i.test(msg) && !code) {
+      if (!p.endUserId && tty) {
+        console.log(import_chalk46.default.yellow("  This API requires every call to say WHO is calling."));
+        const { default: inquirer3 } = await import("inquirer");
+        const { id } = await inquirer3.prompt([{ type: "input", name: "id", message: "Your end-user id (usually your email):" }]);
+        if (typeof id === "string" && id.trim()) {
+          p.endUserId = id.trim();
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        }
+      }
+      console.log(import_chalk46.default.red("  This API requires an identified caller."));
+      console.log(import_chalk46.default.dim("  Re-run with --xenduserid <your id> (usually your email)."));
       return;
     }
-    if (res.status === 401) {
-      const reason = data && (data.error || data.message) || null;
-      const usingKey = !p.consumerAuth;
-      console.log(import_chalk46.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
-      console.log(
-        import_chalk46.default.dim(
-          usingKey ? "  Sent an API key. If the key was revoked, re-run `apiblaze apichat` to re-provision." : "  Sent your consumer OAuth token. Re-run `apiblaze apichat` to sign in again."
-        )
-      );
+    if (code === "user_not_preapproved") {
+      console.log(import_chalk46.default.yellow(`  ${msg || "You are not pre-approved on this API."}`));
+      if (p.endUserId) console.log(import_chalk46.default.dim(`  Identity sent: ${p.endUserId}`));
+      const accessUrl = errObj && errObj.request_access_url;
+      if (accessUrl) console.log(`  Request access: ${import_chalk46.default.bold(String(accessUrl))}`);
+      console.log(import_chalk46.default.dim("  Or ask the producer to pre-approve you: `apiblaze preapprove <your-email> --tenant <tenant>`."));
       return;
     }
-    if (!res.ok || !data) {
-      const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk46.default.red(`  Chat error: ${err}`));
+    if (code === "user_frozen") {
+      console.log(import_chalk46.default.red(`  ${msg || "Your access to this API has been frozen by the producer."}`));
       return;
     }
-    if (Array.isArray(data.delta)) {
-      renderToolEvents(
-        data.tool_events,
-        p.consumerAuth ? (() => {
-          const t = loadConsumer()?.accessToken;
-          return t ? { header: "Authorization", value: `Bearer ${t}` } : void 0;
-        })() : p.dpKey ? { header: "X-API-Key", value: p.dpKey } : void 0
-      );
-      renderToolResults(data.delta, data.tool_events);
-      for (const m of data.delta) messages.push(m);
-      printAssistant(data.delta);
+    const oauthWanted = /oauth token required|authorization: bearer/i.test(msg);
+    const keyWanted = /api key required|x-api-key/i.test(msg);
+    if (oauthWanted && !p.consumerAuth) {
+      if (p.teamId && p.tenant && loadCredentials()) {
+        console.log(import_chalk46.default.dim("  This proxy signs consumers in with OAuth \u2014 starting the login\u2026"));
+        try {
+          await ensureConsumerLogin(p.teamId, p.tenant, p.version);
+          p.consumerAuth = true;
+          p.dpKey = void 0;
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        } catch (err) {
+          console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          return;
+        }
+      }
+      console.log(import_chalk46.default.red("  This proxy signs consumers in with OAuth (a login), not an API key."));
+      console.log(import_chalk46.default.dim("  Sign in with: `apiblaze consumer login --tenant <tenant> --client <app-client-id>`, then re-run apichat."));
+      return;
     }
-    const bl = billingLine(data.billing);
-    if (bl) console.log(bl);
-    const warn = freeBudgetWarning(data.billing, p.anon);
-    if (warn) console.log(warn);
-    if (!data.continue) return;
+    if (keyWanted) {
+      if (tty) {
+        console.log(import_chalk46.default.yellow(`  ${msg || "This API requires an API key."}`));
+        const { default: inquirer3 } = await import("inquirer");
+        const { key } = await inquirer3.prompt([{ type: "password", name: "key", mask: "*", message: "API key for this proxy:" }]);
+        if (typeof key === "string" && key.trim()) {
+          p.dpKey = key.trim();
+          p.consumerAuth = false;
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        }
+      }
+      console.log(import_chalk46.default.red(`  ${msg || "This API requires an API key."}`));
+      console.log(import_chalk46.default.dim("  Re-run with --apikey <key> (mint one from the producer's site or dev portal)."));
+      return;
+    }
+    if (res && (res.status === 402 || res.status === 403)) {
+      renderUpsell(p, { reason: "PAUSED", message: msg || "This turn is not available on your current plan." });
+      return;
+    }
+    if (res && res.status === 401) {
+      console.log(import_chalk46.default.red(`  The proxy rejected the request (401)${msg ? `: ${msg}` : "."}`));
+      console.log(import_chalk46.default.dim(p.consumerAuth ? "  Sent your consumer OAuth token. Run `apiblaze consumer login` again." : "  Sent an API key. Pass a different one with --apikey <key>."));
+      return;
+    }
+    console.log(import_chalk46.default.red(`  Chat error: ${msg || (res ? `HTTP ${res.status}` : "request failed")}`));
+    return;
   }
-  console.log(import_chalk46.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
-}
-function renderUpsell(p, upsell) {
+  if (!res || !res.body || !(res.headers.get("content-type") ?? "").includes("text/event-stream")) {
+    spinner.stop();
+    console.log(import_chalk46.default.red("  Chat error: could not authenticate to this proxy after several attempts."));
+    return;
+  }
+  let spinnerLive = true;
+  const stopSpinner = () => {
+    if (spinnerLive) {
+      spinner.stop();
+      spinnerLive = false;
+    }
+  };
+  const parts = [];
+  let openTextIdx = -1;
+  let assistantOpen = false;
+  const toolMeta = /* @__PURE__ */ new Map();
+  let upsell = null;
+  let turnInfo = null;
+  let errorText = null;
+  let messageId = `msg_${Date.now()}`;
+  const credHint = () => {
+    if (!isVerbose()) return null;
+    if (p.consumerAuth) {
+      const t = loadConsumer()?.accessToken;
+      return t ? `Authorization: Bearer ${revealAuth ? t : maskKey(t)}` : null;
+    }
+    return p.dpKey ? `X-API-Key: ${revealAuth ? p.dpKey : maskKey(p.dpKey)}` : null;
+  };
+  try {
+    await readSse(res.body, (ev) => {
+      switch (ev?.type) {
+        case "start":
+          if (typeof ev.messageId === "string") messageId = ev.messageId;
+          break;
+        case "tool-input-start": {
+          stopSpinner();
+          if (assistantOpen) {
+            process.stdout.write("\n");
+            assistantOpen = false;
+          }
+          const name = String(ev.toolName ?? "tool");
+          parts.push({ type: `tool-${name}`, toolCallId: String(ev.toolCallId ?? ""), state: "input-streaming" });
+          toolMeta.set(String(ev.toolCallId ?? ""), { name, startedAt: Date.now(), partIdx: parts.length - 1 });
+          console.log(`  ${import_chalk46.default.cyan("\u2699")} ${import_chalk46.default.cyan(name)}${import_chalk46.default.dim("\u2026")}`);
+          break;
+        }
+        case "tool-input-available": {
+          const id = String(ev.toolCallId ?? "");
+          const meta = toolMeta.get(id);
+          const input = ev.input && typeof ev.input === "object" ? ev.input : {};
+          if (meta) {
+            meta.input = input;
+            Object.assign(parts[meta.partIdx], { state: "input-available", input });
+          }
+          if (isVerbose()) {
+            console.log(import_chalk46.default.dim(`      args ${JSON.stringify(input)}`));
+            const hint = credHint();
+            if (hint) console.log(import_chalk46.default.dim(`      auth ${hint}`) + (revealAuth ? "" : import_chalk46.default.yellow("  \u2190 /showauth reveals")));
+          }
+          break;
+        }
+        case "tool-output-available":
+        case "tool-output-error": {
+          stopSpinner();
+          const id = String(ev.toolCallId ?? "");
+          const meta = toolMeta.get(id);
+          const ok = ev.type === "tool-output-available";
+          const ms = meta ? Date.now() - meta.startedAt : void 0;
+          const mark = ok ? import_chalk46.default.green("\u2713") : import_chalk46.default.red("\u2717");
+          console.log(`  ${mark} ${import_chalk46.default.cyan(meta?.name ?? "tool")} ${import_chalk46.default.dim(`(${ok ? "ok" : "error"}${ms != null ? `, ${ms}ms` : ""})`)}`);
+          const detail = ok ? String(ev.output ?? "") : String(ev.errorText ?? "Tool call failed.");
+          if (meta) {
+            Object.assign(parts[meta.partIdx], ok ? { state: "output-available", output: detail } : { state: "output-error", errorText: detail });
+          }
+          if (!ok || isVerbose()) {
+            const pretty = (() => {
+              try {
+                return JSON.stringify(JSON.parse(detail), null, 2);
+              } catch {
+                return detail;
+              }
+            })();
+            const lines = pretty.split("\n");
+            const cap = ok ? 12 : 24;
+            console.log(import_chalk46.default.dim("      response:"));
+            for (const line of lines.slice(0, cap)) console.log(import_chalk46.default.dim(`        ${line}`));
+            if (lines.length > cap) console.log(import_chalk46.default.dim(`        \u2026${lines.length - cap} more lines`));
+          }
+          break;
+        }
+        case "text-start":
+          stopSpinner();
+          parts.push({ type: "text", text: "" });
+          openTextIdx = parts.length - 1;
+          if (!assistantOpen) {
+            process.stdout.write("\n" + import_chalk46.default.green("assistant \u203A "));
+            assistantOpen = true;
+          }
+          break;
+        case "text-delta": {
+          const delta = String(ev.delta ?? "");
+          if (openTextIdx >= 0) parts[openTextIdx].text = String(parts[openTextIdx].text ?? "") + delta;
+          process.stdout.write(delta);
+          break;
+        }
+        case "text-end":
+          openTextIdx = -1;
+          break;
+        case "data-apiblaze-upsell": {
+          const d = ev.data ?? {};
+          upsell = { reason: String(d.reason ?? ""), message: String(d.message ?? "") };
+          break;
+        }
+        case "data-apiblaze-turn":
+          turnInfo = ev.data ?? {};
+          break;
+        case "error":
+          stopSpinner();
+          errorText = String(ev.errorText ?? "Something went wrong.");
+          break;
+        default:
+          break;
+      }
+    });
+  } catch (err) {
+    stopSpinner();
+    console.log(import_chalk46.default.red(`  Stream error: ${err instanceof Error ? err.message : String(err)}`));
+  }
+  stopSpinner();
+  if (assistantOpen) process.stdout.write("\n\n");
+  if (parts.length) messages.push({ id: messageId, role: "assistant", parts });
+  if (errorText) console.log(import_chalk46.default.red(`  ${errorText}`));
+  if (upsell) {
+    renderUpsell(p, upsell, { messageAlreadyShown: true });
+  }
+  const bl = billingLine(turnInfo);
+  if (bl) console.log(bl);
+  const warn = freeBudgetWarning(turnInfo, p.anon);
+  if (warn) console.log(warn);
+}
+function renderUpsell(p, upsell, opts = {}) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
     console.log("\n" + import_chalk46.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
@@ -8810,7 +9157,9 @@ function renderUpsell(p, upsell) {
     console.log();
     return;
   }
-  console.log("\n" + import_chalk46.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  if (!opts.messageAlreadyShown) {
+    console.log("\n" + import_chalk46.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  }
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "QUOTA" || upsell.reason === "PROXY_CAP" || upsell.reason === "PAUSED" || upsell.reason === "BYO_REQUIRED") {
     if (!loggedIn) {
       console.log(import_chalk46.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
@@ -8825,17 +9174,17 @@ function renderUpsell(p, upsell) {
 var apichatsPath = () => path6.join(getApiblazeDir(), "apichats.json");
 function loadApichats() {
   try {
-    const list = JSON.parse(fs9.readFileSync(apichatsPath(), "utf-8"));
+    const list = JSON.parse(fs10.readFileSync(apichatsPath(), "utf-8"));
     return Array.isArray(list) ? list : [];
   } catch {
     return [];
   }
 }
 function writeApichats(list) {
-  fs9.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs9.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
+  fs10.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs10.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
   try {
-    fs9.chmodSync(apichatsPath(), 384);
+    fs10.chmodSync(apichatsPath(), 384);
   } catch {
   }
 }
@@ -8849,6 +9198,16 @@ function upsertApichat(entry) {
   else list.unshift(entry);
   writeApichats(list.slice(0, 30));
 }
+function persistAuthState(p) {
+  const list = loadApichats();
+  const i = list.findIndex((a) => a.projectId === p.projectId && a.version === p.version);
+  if (i < 0) return;
+  list[i].dpKey = p.dpKey;
+  list[i].consumerAuth = p.consumerAuth;
+  list[i].endUserId = p.endUserId;
+  list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeApichats(list);
+}
 function saveTranscript(p, messages) {
   const list = loadApichats();
   const i = list.findIndex((a) => apichatKey(a) === apichatKey(p));
@@ -8898,6 +9257,57 @@ async function fetchProxyDoor(teamId, projectId, apiVersion) {
     return { methods: null };
   }
 }
+async function openDirectProject(projectId, opts) {
+  const saved = loadApichats().find((a) => a.projectId === projectId);
+  const version2 = opts.apiversion || saved?.version || "1.0.0";
+  const environment = opts.environment || saved?.environment || "prod";
+  const anon = saved?.anon ?? !loadCredentials();
+  const mcpHost = saved?.mcpHost || `${projectId}.mcp.${anon ? "tryabz" : "abz"}.run`;
+  const p = {
+    projectId,
+    version: version2,
+    environment,
+    dpKey: opts.apikey ?? saved?.dpKey,
+    consumerAuth: opts.apikey ? false : saved?.consumerAuth,
+    mcpHost,
+    proxyUrl: `https://${projectId}.${anon ? "tryabz" : "abz"}.run/${version2}/${environment}`,
+    anon,
+    access: "invite",
+    tenant: saved?.tenant,
+    teamId: saved?.teamId,
+    endUserId: opts.xenduserid ?? saved?.endUserId
+  };
+  if (!p.dpKey && !p.consumerAuth) {
+    if (process.stdin.isTTY) {
+      const { default: inquirer3 } = await import("inquirer");
+      const { key } = await inquirer3.prompt([{
+        type: "password",
+        name: "key",
+        mask: "*",
+        message: `API key for ${projectId} (leave empty if it uses a login):`
+      }]);
+      if (typeof key === "string" && key.trim()) p.dpKey = key.trim();
+      else p.consumerAuth = true;
+    }
+  }
+  console.log(`  ${import_chalk46.default.dim("Proxy:")} ${import_chalk46.default.bold(p.proxyUrl)}`);
+  if (p.endUserId) console.log(`  ${import_chalk46.default.dim("Acting as:")} ${import_chalk46.default.bold(p.endUserId)}`);
+  upsertApichat({
+    name: projectId,
+    target: p.proxyUrl,
+    projectId,
+    version: version2,
+    environment,
+    mcpHost,
+    teamId: p.teamId,
+    tenant: p.tenant,
+    dpKey: p.dpKey,
+    consumerAuth: p.consumerAuth,
+    anon,
+    endUserId: p.endUserId
+  });
+  return { p, messages: saved?.messages?.filter((m) => Array.isArray(m.parts)) ?? [] };
+}
 async function openServerProxy(project) {
   const version2 = project.apiVersion || "1.0.0";
   const environment = "prod";
@@ -8976,15 +9386,15 @@ function discoverLocalSpecs() {
   const found = [];
   for (const n of known) {
     try {
-      if (fs9.statSync(path6.join(cwd, n)).isFile()) found.push(n);
+      if (fs10.statSync(path6.join(cwd, n)).isFile()) found.push(n);
     } catch {
     }
   }
   try {
-    const files = fs9.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
+    const files = fs10.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
     for (const f of files.slice(0, 60)) {
       try {
-        const head = fs9.readFileSync(path6.join(cwd, f), "utf-8").slice(0, 4e3);
+        const head = fs10.readFileSync(path6.join(cwd, f), "utf-8").slice(0, 4e3);
         if (/["']?openapi["']?\s*:/i.test(head) || /["']?swagger["']?\s*:/i.test(head) || /^\s*paths\s*:/im.test(head) || /"paths"\s*:/.test(head)) {
           found.push(f);
         }
@@ -9119,7 +9529,7 @@ async function noArgsMenu(opts) {
 }
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
-  const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
+  const messages = (initialMessages ?? []).filter((m) => Array.isArray(m.parts));
   console.log("\n" + import_chalk46.default.cyan.bold("Chat with your API") + import_chalk46.default.dim(`  \xB7 ${p.mcpHost}`));
   if (messages.length) console.log(import_chalk46.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
@@ -9184,6 +9594,20 @@ async function runRepl(p, initialMessages) {
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
   console.log(import_chalk46.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  if (opts.target && !opts.openapispec) {
+    const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
+    const c = await classifyTargetInput2(opts.target, fail4);
+    if (c.kind === "spec") {
+      console.log(import_chalk46.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 using it as the spec.`));
+      opts.openapispec = opts.target;
+      opts.target = void 0;
+    }
+  }
+  if (opts.project) {
+    const opened = await openDirectProject(opts.project, opts);
+    await runRepl(opened.p, opened.messages);
+    return;
+  }
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
       fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
@@ -9406,28 +9830,28 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk48 = __toESM(require("chalk"));
 var import_ora25 = __toESM(require("ora"));
-var fs10 = __toESM(require("fs"));
+var fs11 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs10.existsSync(path7.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs11.existsSync(path7.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs10.readFileSync(path7.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs11.readFileSync(path7.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs10.existsSync(path7.join(root, "app")) || fs10.existsSync(path7.join(root, "src", "app"));
-  const pagesDir = fs10.existsSync(path7.join(root, "pages")) || fs10.existsSync(path7.join(root, "src", "pages"));
+  const appDir = fs11.existsSync(path7.join(root, "app")) || fs11.existsSync(path7.join(root, "src", "app"));
+  const pagesDir = fs11.existsSync(path7.join(root, "pages")) || fs11.existsSync(path7.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
   const p = path7.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs10.readFileSync(p, "utf8");
+    existing = fs11.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -9442,15 +9866,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs10.writeFileSync(p, next);
+  fs11.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
+  if (fs11.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
     console.log(`  ${import_chalk48.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f) => fs10.existsSync(path7.join(root, f));
+  const has = (f) => fs11.existsSync(path7.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora25.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -9463,7 +9887,7 @@ function installSidecarPackage(root) {
 }
 function readEnvKey(root) {
   try {
-    const s = fs10.readFileSync(path7.join(root, ".env.local"), "utf8");
+    const s = fs11.readFileSync(path7.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -9474,13 +9898,13 @@ function ensureGitignored(root) {
   const p = path7.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs10.readFileSync(p, "utf8");
+    c = fs11.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs10.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs11.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path7.join("src", "instrumentation.ts")].map((c) => path7.join(root, c)).find((f) => fs10.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path7.join("src", "instrumentation.ts")].map((c) => path7.join(root, c)).find((f) => fs11.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -9488,18 +9912,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs10.writeFileSync(path7.join(root, "instrumentation.ts"), body);
+    fs11.writeFileSync(path7.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs10.readFileSync(existing, "utf8");
+  const cur = fs11.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs10.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs11.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs10.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs11.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -9578,16 +10002,16 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs10.existsSync(path7.join(root, "src", "pages")) ? path7.join(root, "src", "pages") : path7.join(root, "pages");
+      const dir2 = fs11.existsSync(path7.join(root, "src", "pages")) ? path7.join(root, "src", "pages") : path7.join(root, "pages");
       const f2 = path7.join(dir2, "abz-inspector.tsx");
-      fs10.writeFileSync(f2, INSPECTOR_PAGE);
+      fs11.writeFileSync(f2, INSPECTOR_PAGE);
       return path7.relative(root, f2);
     }
-    const base2 = fs10.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
+    const base2 = fs11.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
     const dir = path7.join(base2, "abz-inspector");
-    fs10.mkdirSync(dir, { recursive: true });
+    fs11.mkdirSync(dir, { recursive: true });
     const f = path7.join(dir, "page.tsx");
-    fs10.writeFileSync(f, INSPECTOR_PAGE);
+    fs11.writeFileSync(f, INSPECTOR_PAGE);
     return path7.relative(root, f);
   } catch {
     return null;
@@ -10382,10 +10806,11 @@ Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
         console.log(import_chalk51.default.bold(`
 LLM timing \u2014 last ${data.window_hours}h
 `));
-        console.log(import_chalk51.default.dim("  requests   gen p95   reserve p95   in/out tokens p95   model"));
+        console.log(import_chalk51.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
         for (const r of rows2) {
+          const n = r.turns ?? r.requests ?? 0;
           console.log(
-            `  ${String(Math.round(r.requests)).padStart(8)}   ${String(Math.round(r.gen_p95_ms)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95)).padStart(6)}/${String(Math.round(r.output_tokens_p95)).padEnd(6)}   ${r.model || "-"}`
+            `  ${String(Math.round(n)).padStart(8)}   ${String(Math.round(r.turn_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.ttfc_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.gen_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms ?? 0)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95 ?? 0)).padStart(6)}/${String(Math.round(r.output_tokens_p95 ?? 0)).padEnd(6)}   ${r.model || "-"}`
           );
         }
         console.log(import_chalk51.default.dim(`
@@ -10451,7 +10876,7 @@ program.command("login").description("Authenticate with APIblaze").option("--tea
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--openapi <file|url>", "Create FROM an OpenAPI spec instead of --target \u2014 a local file or a URL (e.g. https://pokeapi.co/openapi.yaml). Routes, API version and environments (one per `servers` entry) all come from the spec").option("--openapispec <file|url>", "Alias for --openapi").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--openapi <file|url>", "Create FROM an OpenAPI spec instead of --target \u2014 a local file or a URL (e.g. https://pokeapi.co/openapi.yaml). Routes, API version and environments (one per `servers` entry) all come from the spec").option("--openapispec <file|url>", "Alias for --openapi").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -10464,7 +10889,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Author an object-level access rule in plain English, in one shot (billed per turn)").argument("<rule>", 'The rule in plain English, e.g. "users see only their own rows"').argument("<project>", "Project name or id").option("--enforce", "Turn enforcement on immediately (default: shadow-publish only)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((rule, project, opts) => runRule(rule, project, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("apichat").description("Turn any API into a chat: point at an OpenAPI spec and start asking questions (no login needed)").option("--openapi <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--openapispec <file|url>", "Alias for --openapi").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapi is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((opts) => runApichat({ ...opts, openapispec: opts.openapispec ?? opts.openapi })));
+program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--openapi <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--openapispec <file|url>", "Alias for --openapi").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapi is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
 llm.command("show").description("Show the locally stored LLM key (masked)").action(action(() => runLlmShow()));