apiblaze 0.20.9 → 0.20.11

package/dist/index.js

@@ -137,8 +137,8 @@ async function createProxyAnonymous(body) {
   }
   return res.json();
 }
-async function apiFetch(path8, options = {}, auth) {
-  const url = `${DASHBOARD_BASE}${path8}`;
+async function apiFetch(path9, options = {}, auth) {
+  const url = `${DASHBOARD_BASE}${path9}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -164,12 +164,12 @@ async function apiFetch(path8, options = {}, auth) {
   }
   return res.json();
 }
-async function agentCall(path8, method, body) {
+async function agentCall(path9, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path8, method, body })
+    body: JSON.stringify({ path: path9, method, body })
   });
   let data = null;
   try {
@@ -472,6 +472,98 @@ var init_admin = __esm({
   }
 });
 
+// src/lib/spec-or-target.ts
+var spec_or_target_exports = {};
+__export(spec_or_target_exports, {
+  classifyTargetInput: () => classifyTargetInput,
+  looksLikeSpecDoc: () => looksLikeSpecDoc
+});
+function looksLikeSpecDoc(text) {
+  const probe = (d) => !!d && typeof d === "object" && !Array.isArray(d) && (typeof d.openapi === "string" || typeof d.swagger === "string") && typeof d.paths === "object";
+  try {
+    if (probe(JSON.parse(text))) return true;
+  } catch {
+  }
+  try {
+    if (probe((0, import_yaml.parse)(text))) return true;
+  } catch {
+  }
+  return false;
+}
+function isHttpUrl(s) {
+  try {
+    const u = new URL(s);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function smellsLikeSpecUrl(u) {
+  try {
+    const { pathname } = new URL(u);
+    return /\.(ya?ml|json)$/i.test(pathname) || /openapi|swagger/i.test(pathname);
+  } catch {
+    return false;
+  }
+}
+async function fetchTextCapped(url, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      signal: controller.signal,
+      headers: { accept: "application/yaml, application/json, text/yaml, text/plain;q=0.8, */*;q=0.5" }
+    });
+    if (!res.ok) return null;
+    const text = await res.text();
+    return text.length > MAX_SPEC_BYTES ? null : text;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function classifyTargetInput(input, failFn) {
+  const t = (input ?? "").trim();
+  if (!isHttpUrl(t)) {
+    let isFile = false;
+    try {
+      isFile = fs4.existsSync(t) && fs4.statSync(t).isFile();
+    } catch {
+      isFile = false;
+    }
+    if (isFile) {
+      const text2 = fs4.readFileSync(t, "utf-8");
+      if (looksLikeSpecDoc(text2)) return { kind: "spec", specText: text2, source: t };
+      failFn(
+        `${t} exists but is not an OpenAPI/Swagger document (no openapi/swagger version field with paths).`,
+        "Pass a spec file, a spec URL, or a target server base URL."
+      );
+    }
+    return { kind: "server" };
+  }
+  if (smellsLikeSpecUrl(t)) {
+    const text2 = await fetchTextCapped(t, 2e4);
+    if (text2 && looksLikeSpecDoc(text2)) return { kind: "spec", specText: text2, source: t };
+    failFn(
+      `${t} looks like an OpenAPI file but did not return a valid OpenAPI/Swagger document.`,
+      text2 === null ? "The URL could not be fetched (or is over 5MB). Check it in a browser." : "The response parsed, but has no openapi/swagger version field with paths."
+    );
+  }
+  const text = await fetchTextCapped(t, 6e3);
+  if (text && looksLikeSpecDoc(text)) return { kind: "spec", specText: text, source: t };
+  return { kind: "server" };
+}
+var fs4, import_yaml, MAX_SPEC_BYTES;
+var init_spec_or_target = __esm({
+  "src/lib/spec-or-target.ts"() {
+    "use strict";
+    fs4 = __toESM(require("fs"));
+    import_yaml = require("yaml");
+    MAX_SPEC_BYTES = 5 * 1024 * 1024;
+  }
+});
+
 // src/lib/resolve.ts
 function requireAuth() {
   const creds = loadCredentials();
@@ -929,10 +1021,10 @@ var init_tenant_pick = __esm({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk52 = __toESM(require("chalk"));
+var import_chalk53 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.20.9";
+var version = "0.20.11";
 
 // src/index.ts
 init_types();
@@ -1198,11 +1290,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path8) {
-  const q = path8.indexOf("?");
-  if (q < 0) return path8;
-  const base2 = path8.slice(0, q);
-  const query = path8.slice(q + 1);
+function maskPath(path9) {
+  const q = path9.indexOf("?");
+  if (q < 0) return path9;
+  const base2 = path9.slice(0, q);
+  const query = path9.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -2007,7 +2099,7 @@ function suggestTenantName(projectSlug, taken) {
 }
 
 // src/commands/create.ts
-var import_yaml = require("yaml");
+var import_yaml2 = require("yaml");
 var import_chalk11 = __toESM(require("chalk"));
 var import_ora5 = __toESM(require("ora"));
 init_auth();
@@ -2015,7 +2107,7 @@ init_api();
 function normalizeName(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function isHttpUrl(s) {
+function isHttpUrl2(s) {
   try {
     const u = new URL((s || "").trim());
     return u.protocol === "http:" || u.protocol === "https:";
@@ -2025,7 +2117,7 @@ function isHttpUrl(s) {
 }
 async function loadOpenapiSource(ref) {
   let text;
-  if (isHttpUrl(ref)) {
+  if (isHttpUrl2(ref)) {
     const res = await fetch(ref.trim(), {
       headers: { accept: "application/json, application/yaml, text/yaml, */*" }
     }).catch((err) => fail(`Could not fetch the OpenAPI spec at ${ref} \u2014 ${err.message}`));
@@ -2041,7 +2133,7 @@ async function loadOpenapiSource(ref) {
   if (!text.trim()) fail(`The OpenAPI spec is empty: ${ref}`);
   let parsed;
   try {
-    parsed = text.trimStart().startsWith("{") ? JSON.parse(text) : (0, import_yaml.parse)(text);
+    parsed = text.trimStart().startsWith("{") ? JSON.parse(text) : (0, import_yaml2.parse)(text);
   } catch (err) {
     fail(`Could not parse the OpenAPI spec at ${ref} as JSON or YAML \u2014 ${err.message}`);
   }
@@ -2070,8 +2162,9 @@ function stripTenantFromPortal(devPortal) {
     return devPortal;
   }
 }
-function fail(message) {
+function fail(message, hint) {
   console.error(import_chalk11.default.red(`Error: ${message}`));
+  if (hint) console.error(import_chalk11.default.dim(hint));
   process.exit(1);
 }
 function buildTryItCurl(url, authType, apiKey) {
@@ -2094,14 +2187,84 @@ function printCurlExample(url, authType, apiKey, devPortal) {
   }
 }
 var VALID_AUTH = ["api_key", "none", "oauth"];
+function parseOauthFlag(raw) {
+  if (raw === void 0 || raw === false) return null;
+  if (raw === true || typeof raw === "string" && raw.trim() === "") {
+    return {
+      auth: "oauth",
+      bodyPatch: { login: { providers: [{ type: "github", managed: true }] } },
+      summary: "APIblaze-hosted GitHub sign-in (managed)"
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(String(raw));
+  } catch {
+    fail(
+      `--oauth value is not valid JSON: ${raw}`,
+      `Shapes:
+  --oauth                                          APIblaze GitHub sign-in
+  --oauth '{"iss":"https://login.acme.com/","aud":"acme-api","jwks":"https://login.acme.com/.well-known/jwks.json"}'
+  --oauth '{"provider":"google","clientId":"\u2026","clientSecret":"\u2026"}'`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) fail("--oauth must be a JSON object (or bare).");
+  if (typeof parsed.iss === "string") {
+    const iss = parsed.iss.trim();
+    const aud = typeof parsed.aud === "string" ? parsed.aud.trim() : "";
+    const jwks = typeof parsed.jwks === "string" ? parsed.jwks.trim() : typeof parsed.jwks_url === "string" ? parsed.jwks_url.trim() : "";
+    if (!iss || !aud || !jwks) fail("--oauth issuer shape needs all three of: iss, aud, jwks (a JWKS URL).");
+    if (!isHttpUrl2(jwks)) fail("--oauth: jwks must be an http(s) JWKS URL.");
+    return {
+      auth: "oauth",
+      bodyPatch: {
+        requests_auth: {
+          mode: "authenticate",
+          methods: ["jwt"],
+          jwt: { allowed_pairs: [{ iss, aud, jwks_url: jwks }] }
+        }
+      },
+      summary: `your own hosted login \u2014 JWTs from ${iss} (aud ${aud})`
+    };
+  }
+  if (typeof parsed.provider === "string") {
+    const provider = parsed.provider.trim().toLowerCase();
+    const PROVIDERS2 = ["github", "google", "microsoft", "facebook", "auth0"];
+    if (!PROVIDERS2.includes(provider)) fail(`--oauth: unknown provider "${provider}". One of: ${PROVIDERS2.join(" \xB7 ")}.`);
+    const clientId = typeof parsed.clientId === "string" ? parsed.clientId.trim() : typeof parsed.client_id === "string" ? parsed.client_id.trim() : "";
+    const clientSecret = typeof parsed.clientSecret === "string" ? parsed.clientSecret.trim() : typeof parsed.client_secret === "string" ? parsed.client_secret.trim() : "";
+    if (!clientId || !clientSecret) fail("--oauth provider shape needs clientId and clientSecret (from your OAuth app).");
+    return {
+      auth: "oauth",
+      bodyPatch: {
+        login: {
+          providers: [{ type: provider, client_id: clientId, client_secret: clientSecret }]
+        }
+      },
+      summary: `APIblaze-hosted login page with your own ${provider} app`
+    };
+  }
+  fail('--oauth JSON must contain either "iss" (your JWT issuer) or "provider" (your OAuth app).');
+}
 async function runCreate(opts = {}) {
+  if (opts.target && opts.openapi === void 0) {
+    const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
+    const c = await classifyTargetInput2(opts.target, fail);
+    if (c.kind === "spec") {
+      console.log(import_chalk11.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 creating FROM the spec.`));
+      opts.openapi = opts.target;
+      opts.target = void 0;
+    }
+  }
   const creds = loadCredentials();
   if (!creds) {
     await runAnonymousCreate(opts);
     return;
   }
   const interactive = !!process.stdin.isTTY && !opts.json;
-  const auth = (opts.auth ?? "api_key").toLowerCase();
+  if (opts.apikey && opts.oauth !== void 0 && opts.oauth !== false) fail("Pass either --apikey or --oauth, not both.");
+  const oauthPlan = parseOauthFlag(opts.oauth);
+  const auth = (oauthPlan ? oauthPlan.auth : opts.apikey ? "api_key" : opts.auth ?? "api_key").toLowerCase();
   if (!VALID_AUTH.includes(auth)) {
     fail(`Invalid --auth "${auth}". Use one of: ${VALID_AUTH.join(", ")}.`);
   }
@@ -2165,13 +2328,13 @@ async function runCreate(opts = {}) {
   }
   let openapiContent = null;
   if (opts.openapi !== void 0) {
-    if (opts.target !== void 0) fail("Provide only one of --target or --openapi.");
+    if (opts.target !== void 0) fail("Provide only one source (the smart --target covers servers, spec files and spec URLs).");
     openapiContent = await loadOpenapiSource(opts.openapi);
   }
   let targetUrl = "";
   if (openapiContent) {
   } else if (opts.target !== void 0) {
-    if (!isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+    if (!isHttpUrl2(opts.target)) fail("--target must be a valid http(s) URL.");
     targetUrl = opts.target.trim();
   } else if (interactive) {
     const { default: inquirer3 } = await import("inquirer");
@@ -2181,7 +2344,7 @@ async function runCreate(opts = {}) {
         name: "url",
         message: "Target URL to forward requests to (e.g. https://httpbin.org):"
       }]);
-      if (!isHttpUrl(url)) {
+      if (!isHttpUrl2(url)) {
         console.log(import_chalk11.default.yellow("  Enter a valid http(s) URL.\n"));
         continue;
       }
@@ -2189,11 +2352,11 @@ async function runCreate(opts = {}) {
       break;
     }
   } else {
-    fail("--target or --openapi is required in non-interactive mode.");
+    fail("--target is required in non-interactive mode (a server base URL, a local OpenAPI file, or a remote OpenAPI URL).");
   }
   if (interactive && !opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
-    console.log(`${import_chalk11.default.cyan("\u2192")} Auth: ${import_chalk11.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : ""}`);
+    console.log(`${import_chalk11.default.cyan("\u2192")} Auth: ${import_chalk11.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : oauthPlan ? ` \u2014 ${oauthPlan.summary}` : ""}`);
     const { ok } = await inquirer3.prompt([{
       type: "confirm",
       name: "ok",
@@ -2218,6 +2381,7 @@ async function runCreate(opts = {}) {
       ...openapiContent ? { openapi: openapiContent } : { target_url: targetUrl },
       auth_type: auth,
       team_id: teamId,
+      ...oauthPlan ? oauthPlan.bodyPatch : {},
       ...chosenTenant ? { tenant: chosenTenant } : {},
       ...opts.apiversion ? { api_version: opts.apiversion } : {}
     });
@@ -2298,7 +2462,7 @@ async function runAnonymousCreate(opts) {
   if (opts.openapi !== void 0) {
     body.openapi = await loadOpenapiSource(opts.openapi);
   }
-  if (opts.target && !isHttpUrl(opts.target)) fail("--target must be a valid http(s) URL.");
+  if (opts.target && !isHttpUrl2(opts.target)) fail("--target must be a valid http(s) URL.");
   let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
   const hasOtherSource = !!(body.openapi || body.github);
   if (!target && !hasOtherSource) {
@@ -2320,7 +2484,7 @@ async function runAnonymousCreate(opts) {
           name: "url",
           message: "Target URL to forward requests to (e.g. https://httpbin.org):"
         }]);
-        if (!isHttpUrl(url)) {
+        if (!isHttpUrl2(url)) {
           console.log(import_chalk11.default.yellow("  Enter a valid http(s) URL.\n"));
           continue;
         }
@@ -2344,7 +2508,15 @@ async function runAnonymousCreate(opts) {
   if (opts.product) body.product_slug = normalizeName(opts.product);
   if (opts.displayName) body.display_name = opts.displayName;
   if (opts.apiversion) body.api_version = opts.apiversion;
-  if (opts.auth && opts.auth !== "api_key") body.auth_type = opts.auth;
+  if (opts.apikey && opts.oauth !== void 0 && opts.oauth !== false) fail("Pass either --apikey or --oauth, not both.");
+  const oauthPlan = parseOauthFlag(opts.oauth);
+  if (oauthPlan) {
+    Object.assign(body, oauthPlan.bodyPatch);
+    if (oauthPlan.auth !== "api_key" && !("requests_auth" in oauthPlan.bodyPatch)) body.auth_type = oauthPlan.auth;
+    if (!opts.json) console.log(`${import_chalk11.default.cyan("\u2192")} Login: ${oauthPlan.summary}`);
+  } else if (opts.auth && opts.auth !== "api_key" && !opts.apikey) {
+    body.auth_type = opts.auth;
+  }
   const { loadAnonCred: loadAnonCred2, saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2, cpFetch: cpFetch2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
   const cred = loadAnonCred2();
@@ -2487,7 +2659,7 @@ var import_chalk13 = __toESM(require("chalk"));
 init_auth();
 
 // src/lib/consumer-auth.ts
-var fs5 = __toESM(require("fs"));
+var fs6 = __toESM(require("fs"));
 var os3 = __toESM(require("os"));
 var path3 = __toESM(require("path"));
 var crypto = __toESM(require("crypto"));
@@ -2498,19 +2670,19 @@ var CONSUMER_PATH = path3.join(APIBLAZE_DIR2, "consumer.json");
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function loadConsumer() {
   try {
-    return JSON.parse(fs5.readFileSync(CONSUMER_PATH, "utf-8"));
+    return JSON.parse(fs6.readFileSync(CONSUMER_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveConsumer(creds) {
-  fs5.mkdirSync(APIBLAZE_DIR2, { recursive: true });
-  fs5.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
-  fs5.chmodSync(CONSUMER_PATH, 384);
+  fs6.mkdirSync(APIBLAZE_DIR2, { recursive: true });
+  fs6.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
+  fs6.chmodSync(CONSUMER_PATH, 384);
 }
 function clearConsumer() {
   try {
-    fs5.unlinkSync(CONSUMER_PATH);
+    fs6.unlinkSync(CONSUMER_PATH);
     return true;
   } catch {
     return false;
@@ -2655,12 +2827,12 @@ async function runLogout(opts = {}) {
 
 // src/commands/flush.ts
 var import_chalk14 = __toESM(require("chalk"));
-var fs6 = __toESM(require("fs"));
+var fs7 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
 init_auth();
 async function runFlush(opts) {
   const dir = getApiblazeDir();
-  const entries2 = fs6.existsSync(dir) ? fs6.readdirSync(dir) : [];
+  const entries2 = fs7.existsSync(dir) ? fs7.readdirSync(dir) : [];
   if (!entries2.length) {
     console.log(import_chalk14.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
@@ -2684,7 +2856,7 @@ async function runFlush(opts) {
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs6.rmSync(path4.join(dir, e), { recursive: true, force: true });
+      fs7.rmSync(path4.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
       console.log(import_chalk14.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
@@ -3357,8 +3529,8 @@ function resolveRecipeName(raw, githubHandle, proxyName) {
 function normalizeName2(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-async function publicFetch(path8) {
-  const res = await fetch(`${RECIPES_BASE}/api/recipes${path8}`, {
+async function publicFetch(path9) {
+  const res = await fetch(`${RECIPES_BASE}/api/recipes${path9}`, {
     headers: { accept: "application/json" }
   }).catch((err) => {
     throw new Error(`Could not reach the recipe registry at ${RECIPES_BASE} \u2014 ${err.message}`);
@@ -3411,11 +3583,11 @@ async function fetchRecipeFile(ref, caller) {
        Private recipes are visible only to the publisher's team \u2014 run \`apiblaze login\` if you are on it.`
     );
   }
-  const path8 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
+  const path9 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
   try {
     return await producer(caller, {
       method: "GET",
-      path: path8,
+      path: path9,
       summary: `Read private recipe ${ref.name}${revision !== void 0 ? `@${revision}` : ""}`
     });
   } catch (err) {
@@ -4567,9 +4739,9 @@ function printEnvelopeViolations(violations) {
   console.log("bring-your-own-key case. Change the rules above, then publish again.");
   console.log();
 }
-async function askPromotion(path8) {
+async function askPromotion(path9) {
   const { default: inquirer3 } = await import("inquirer");
-  const suggestedId = path8.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
+  const suggestedId = path9.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
   const answers = await inquirer3.prompt([
     { type: "input", name: "prompt", message: "  prompt them with:", validate: (v) => v.trim() ? true : "Required." },
     { type: "input", name: "example", message: "  example:" },
@@ -4580,7 +4752,7 @@ async function askPromotion(path8) {
   const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
   console.log(import_chalk27.default.dim(`      \u2192 replaced with {{${id}}}`));
   return {
-    path: path8,
+    path: path9,
     id,
     prompt: String(answers.prompt).trim(),
     ...answers.example ? { example: String(answers.example).trim() } : {},
@@ -6310,7 +6482,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs7 = __toESM(require("fs"));
+var fs8 = __toESM(require("fs"));
 var import_chalk37 = __toESM(require("chalk"));
 var import_ora16 = __toESM(require("ora"));
 init_admin();
@@ -6333,7 +6505,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs7.readFileSync(opts.file, "utf-8");
+    specContent = fs8.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk37.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -6862,6 +7034,15 @@ var SETTINGS = [
     read: (cfg) => cfg.chat_sponsorship?.max_chars_per_message ?? 2e3,
     toPatch: (v) => ({ chat_sponsorship: { max_chars_per_message: v } })
   },
+  {
+    key: "chat_prompt_addendum",
+    label: "AI chat: steering notes",
+    group: "Portal & MCP",
+    type: "string",
+    desc: `Notes the chat assistant follows on this API \u2014 tone, suggestions, house rules ("always suggest the daily special"). Injected beneath the assistant's safety rules, so it can steer style but never override them. Max 1000 chars; empty clears`,
+    read: (cfg) => cfg.chat_prompt_addendum ?? "",
+    toPatch: (v) => ({ chat_prompt_addendum: typeof v === "string" && v.trim() ? v.trim() : null })
+  },
   // ── Advanced (specs/missing.md): all optional, default-off; null clears ────
   {
     key: "ip_access.mode",
@@ -7621,11 +7802,11 @@ async function resolveTransport(opts) {
     const token = getAccessToken();
     return {
       tenant: tenant2,
-      call: async (path8, method = "GET", body) => {
+      call: async (path9, method = "GET", body) => {
         const res = await fetch(`${DASHBOARD_BASE6}/api/cli/iam`, {
           method: "POST",
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-          body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+          body: JSON.stringify({ tenant: tenant2, path: path9, method, body })
         });
         const data = await res.json().catch(() => ({}));
         if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -7643,8 +7824,8 @@ async function resolveTransport(opts) {
     return {
       tenant: fresh.tenant,
       selfEmail: fresh.email,
-      call: async (path8, method = "GET", body) => {
-        const res = await fetch(`${IAM_BASE}${path8}`, {
+      call: async (path9, method = "GET", body) => {
+        const res = await fetch(`${IAM_BASE}${path9}`, {
           method,
           headers: {
             "Content-Type": "application/json",
@@ -7996,12 +8177,12 @@ init_admin();
 init_resolve();
 init_types();
 var DASHBOARD_BASE7 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
-async function iamCall(tenant2, path8, method = "GET", body) {
+async function iamCall(tenant2, path9, method = "GET", body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE7}/api/cli/iam`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ tenant: tenant2, path: path8, method, body })
+    body: JSON.stringify({ tenant: tenant2, path: path9, method, body })
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -8088,19 +8269,19 @@ async function runPreapprove(who, opts) {
 }
 
 // src/commands/apichat.ts
-var fs9 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
 var crypto2 = __toESM(require("crypto"));
-var import_chalk46 = __toESM(require("chalk"));
+var import_chalk47 = __toESM(require("chalk"));
 var import_ora23 = __toESM(require("ora"));
-var import_yaml2 = require("yaml");
+var import_yaml3 = require("yaml");
 init_auth();
 init_anon_cred();
 init_api();
 init_admin();
 
 // src/commands/llm.ts
-var fs8 = __toESM(require("fs"));
+var fs9 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
 var import_chalk45 = __toESM(require("chalk"));
 var import_inquirer2 = __toESM(require("inquirer"));
@@ -8116,15 +8297,15 @@ function detectProvider(key) {
 }
 function loadLlmConfig() {
   try {
-    return JSON.parse(fs8.readFileSync(LLM_PATH, "utf-8"));
+    return JSON.parse(fs9.readFileSync(LLM_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveLlmConfig(cfg) {
-  fs8.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs8.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
-  fs8.chmodSync(LLM_PATH, 384);
+  fs9.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs9.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
+  fs9.chmodSync(LLM_PATH, 384);
 }
 async function runLlmSetKey(keyArg, opts) {
   let key = keyArg?.trim();
@@ -8163,7 +8344,7 @@ async function runLlmShow() {
 }
 async function runLlmClearKey() {
   try {
-    fs8.unlinkSync(LLM_PATH);
+    fs9.unlinkSync(LLM_PATH);
     console.log(`${import_chalk45.default.green("\u2713")} Removed local LLM key.`);
   } catch {
     console.log(import_chalk45.default.gray("No LLM key was set."));
@@ -8172,17 +8353,140 @@ async function runLlmClearKey() {
 
 // src/commands/apichat.ts
 init_trace();
+
+// src/lib/external-mcp.ts
+var fs10 = __toESM(require("fs"));
+var os4 = __toESM(require("os"));
+var path6 = __toESM(require("path"));
+var import_child_process2 = require("child_process");
+var import_chalk46 = __toESM(require("chalk"));
+var run = (cmd, args, opts = {}) => (0, import_child_process2.spawnSync)(cmd, args, {
+  encoding: "utf-8",
+  stdio: opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+  timeout: opts.inherit ? void 0 : 15e3,
+  shell: process.platform === "win32"
+  // .cmd shims on Windows
+});
+function detectExternalClis() {
+  const found = [];
+  for (const [kind, label3] of [["claude", "Claude CLI"], ["codex", "Codex CLI"]]) {
+    try {
+      const r = run(kind, ["--version"]);
+      if (r.status === 0) found.push({ kind, label: label3, version: (r.stdout || "").trim().split("\n")[0] || void 0 });
+    } catch {
+    }
+  }
+  return found;
+}
+function claudeInstallArgs(spec2) {
+  const args = ["mcp", "add", "--transport", "http", spec2.name, spec2.url];
+  if (spec2.apiKey) args.push("--header", `X-API-Key: ${spec2.apiKey}`);
+  return args;
+}
+function installIntoClaude(spec2) {
+  run("claude", ["mcp", "remove", spec2.name]);
+  const r = run("claude", claudeInstallArgs(spec2));
+  if (r.status === 0) return { ok: true };
+  return { ok: false, error: (r.stderr || r.stdout || `exit ${r.status}`).trim().slice(0, 400) };
+}
+function claudeOneShot(spec2, prompt) {
+  const argv = ["claude", "-p", prompt, "--allowedTools", `mcp__${spec2.name}__*`];
+  const r = run(argv[0], argv.slice(1), { inherit: true });
+  return { argv, status: r.status };
+}
+function codexConfigPath() {
+  return path6.join(process.env.CODEX_HOME || path6.join(os4.homedir(), ".codex"), "config.toml");
+}
+var tomlStr = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+function codexServerBlock(spec2) {
+  const lines = [`[mcp_servers.${tomlStr(spec2.name)}]`, `url = ${tomlStr(spec2.url)}`];
+  if (spec2.apiKey) lines.push(`http_headers = { "X-API-Key" = ${tomlStr(spec2.apiKey)} }`);
+  return lines.join("\n") + "\n";
+}
+function installIntoCodex(spec2) {
+  const file = codexConfigPath();
+  try {
+    fs10.mkdirSync(path6.dirname(file), { recursive: true });
+    let text = "";
+    try {
+      text = fs10.readFileSync(file, "utf-8");
+    } catch {
+    }
+    const esc = spec2.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const section = new RegExp(`(^|\\n)\\[mcp_servers\\.(?:"${esc}"|${esc})\\][^\\[]*`, "g");
+    const cleaned = text.replace(section, "$1");
+    const sep = cleaned.length && !cleaned.endsWith("\n\n") ? cleaned.endsWith("\n") ? "\n" : "\n\n" : "";
+    fs10.writeFileSync(file, cleaned + sep + codexServerBlock(spec2), "utf-8");
+    return { ok: true, path: file };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err), path: file };
+  }
+}
+function codexOneShot(_spec, prompt) {
+  const argv = ["codex", "exec", prompt];
+  const r = run(argv[0], argv.slice(1), { inherit: true });
+  return { argv, status: r.status };
+}
+var shellQuote = (s) => `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
+function renderCommand(argv) {
+  return argv.map((a, i) => i === 0 || /^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : shellQuote(a)).join(" ");
+}
+function installAndDemo(cli, spec2, question, log = console.log) {
+  if (cli.kind === "claude") {
+    log(`
+  ${import_chalk46.default.dim("$")} ${renderCommand(["claude", ...claudeInstallArgs(spec2)])}`);
+    const r = installIntoClaude(spec2);
+    if (!r.ok) {
+      log(import_chalk46.default.red(`  Install failed: ${r.error}`));
+      return false;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to Claude CLI (local scope \u2014 this directory).`);
+  } else {
+    const r = installIntoCodex(spec2);
+    if (!r.ok) {
+      log(import_chalk46.default.red(`  Could not write ${r.path}: ${r.error}`));
+      return false;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to ${r.path}.`);
+  }
+  if (!spec2.apiKey) {
+    log(import_chalk46.default.dim(`  This proxy authenticates by login: the first call from ${cli.label} will open its sign-in.`));
+    log(`
+  ${import_chalk46.default.bold(`Your ${cli.label} is now able to talk to the ${spec2.projectLabel} API.`)}`);
+    return true;
+  }
+  const oneShot = cli.kind === "claude" ? claudeOneShot : codexOneShot;
+  const abilities = `What are the tool abilities of the MCP server "${spec2.name}"? List them briefly.`;
+  log(`
+  ${import_chalk46.default.dim("Checking what the MCP exposes\u2026")}`);
+  log(`  ${import_chalk46.default.dim("$")} ${renderCommand(cli.kind === "claude" ? ["claude", "-p", abilities, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", abilities])}
+`);
+  oneShot(spec2, abilities);
+  if (question) {
+    log(`
+  ${import_chalk46.default.dim("Your question, through " + cli.label + ":")}`);
+    const shown = cli.kind === "claude" ? ["claude", "-p", question, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", question];
+    log(`  ${import_chalk46.default.dim("$")} ${renderCommand(shown)}
+`);
+    oneShot(spec2, question);
+  }
+  log(`
+  ${import_chalk46.default.bold(`Your ${cli.label} is now able to talk to the ${spec2.projectLabel} API.`)}`);
+  return true;
+}
+
+// src/commands/apichat.ts
 init_types();
 function fail4(message, hint) {
-  console.error(import_chalk46.default.red(`
+  console.error(import_chalk47.default.red(`
 Error: ${message}`));
-  if (hint) console.error(import_chalk46.default.dim(hint));
+  if (hint) console.error(import_chalk47.default.dim(hint));
   process.exit(1);
 }
 function normalizeName3(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function isHttpUrl2(s) {
+function isHttpUrl3(s) {
   try {
     const u = new URL((s || "").trim());
     return u.protocol === "http:" || u.protocol === "https:";
@@ -8196,7 +8500,7 @@ function parseSpec(text) {
     parsed = JSON.parse(text);
   } catch {
     try {
-      parsed = (0, import_yaml2.parse)(text);
+      parsed = (0, import_yaml3.parse)(text);
     } catch {
       fail4("Could not parse the spec as JSON or YAML.");
     }
@@ -8207,7 +8511,7 @@ function parseSpec(text) {
   }
   return parsed;
 }
-var GENERATOR_HINT = "Provide one with --openapispec <file|url>, or build one from real traffic:\n  apiblaze create --target <url>   then   apiblaze agent openapi <project>";
+var GENERATOR_HINT = "Pass --target <server-url | spec-file | spec-url>, or build a spec from real traffic:\n  apiblaze create --target <url>   then   apiblaze agent openapi <project>";
 async function fetchText(url) {
   try {
     const res = await fetch(url, { headers: { accept: "application/json, application/yaml, text/yaml, */*" } });
@@ -8233,32 +8537,32 @@ async function discoverSpec(target) {
 }
 async function loadSpec(opts) {
   if (opts.openapispec) {
-    if (isHttpUrl2(opts.openapispec)) {
+    if (isHttpUrl3(opts.openapispec)) {
       const text2 = await fetchText(opts.openapispec);
       if (!text2) fail4(`Could not fetch the spec at ${opts.openapispec}.`);
       return { spec: parseSpec(text2), sourceUrl: opts.openapispec };
     }
     let text;
     try {
-      text = fs9.readFileSync(opts.openapispec, "utf-8");
+      text = fs11.readFileSync(opts.openapispec, "utf-8");
     } catch {
       fail4(`Cannot read spec file: ${opts.openapispec}`);
     }
     return { spec: parseSpec(text) };
   }
   if (opts.target) {
-    if (!isHttpUrl2(opts.target)) fail4("--target must be a valid http(s) URL.");
+    if (!isHttpUrl3(opts.target)) fail4("--target must be a valid http(s) URL.");
     const found = await discoverSpec(opts.target);
     if (!found) {
       fail4(`No OpenAPI spec found at ${opts.target} (tried /openapi.json, /openapi.yaml, /swagger.json).`, GENERATOR_HINT);
     }
     return { spec: found.spec, sourceUrl: found.sourceUrl };
   }
-  fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
+  fail4("No spec source. Pass --target <server-url | openapi-file | openapi-url>.", GENERATOR_HINT);
 }
 function resolveTarget(spec2, opts, sourceUrl) {
   if (opts.target) {
-    if (!isHttpUrl2(opts.target)) fail4("--target must be a valid http(s) URL.");
+    if (!isHttpUrl3(opts.target)) fail4("--target must be a valid http(s) URL.");
     return opts.target.trim();
   }
   const servers = Array.isArray(spec2.servers) ? spec2.servers : [];
@@ -8268,7 +8572,7 @@ function resolveTarget(spec2, opts, sourceUrl) {
   }
   try {
     const resolved = sourceUrl ? new URL(raw, sourceUrl).toString() : raw;
-    if (!isHttpUrl2(resolved)) {
+    if (!isHttpUrl3(resolved)) {
       fail4(`servers[0].url ("${raw}") is not an absolute URL and could not be resolved.`, "Re-run with --target <upstream base URL>.");
     }
     return resolved;
@@ -8324,7 +8628,7 @@ async function resolveTargetAuth(spec2, opts) {
         "Re-run with --force to provision anyway (configure target auth later with `apiblaze config`),\nor use an api_key / bearer / basic scheme."
       );
     }
-    if (sawOAuth) console.log(import_chalk46.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
+    if (sawOAuth) console.log(import_chalk47.default.yellow("  --force: skipping OAuth target auth \u2014 configure it later with `apiblaze config`."));
     return null;
   }
   if (candidates.length === 1 && !noneAllowed) return candidates[0];
@@ -8378,9 +8682,10 @@ async function captureTargetSecret(auth, opts) {
   return secret;
 }
 async function dataPlaneAuth(p) {
+  const idHeader = p.endUserId ? { "X-End-User-Id": p.endUserId } : {};
   if (!p.consumerAuth) {
-    if (!p.dpKey) throw new Error("No API key for this proxy.");
-    return { "X-API-Key": p.dpKey };
+    if (!p.dpKey) return idHeader;
+    return { "X-API-Key": p.dpKey, ...idHeader };
   }
   const stored = loadConsumer();
   if (!stored) {
@@ -8388,7 +8693,7 @@ async function dataPlaneAuth(p) {
   }
   const fresh = await validConsumerToken(stored) ?? stored;
   if (fresh.accessToken !== stored.accessToken) saveConsumer(fresh);
-  return { Authorization: `Bearer ${fresh.accessToken}` };
+  return { Authorization: `Bearer ${fresh.accessToken}`, ...idHeader };
 }
 async function ensureConsumerLogin(teamId, tenant2, version2) {
   const resource = `https://${tenant2}.portal.apiblaze.com/${version2}`;
@@ -8397,7 +8702,7 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     const fresh = await validConsumerToken(existing);
     if (fresh) {
       if (fresh.accessToken !== existing.accessToken) saveConsumer({ ...fresh, resource });
-      console.log(import_chalk46.default.dim(`  Using your consumer session on ${import_chalk46.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      console.log(import_chalk47.default.dim(`  Using your consumer session on ${import_chalk47.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
       return fresh;
     }
   }
@@ -8416,13 +8721,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     );
   }
   const clientId = pick2.client_id ?? pick2.clientId;
-  console.log(`${import_chalk46.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk46.default.bold(tenant2)}...`);
+  console.log(`${import_chalk47.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk47.default.bold(tenant2)}...`);
   const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk46.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk46.default.bold(userCode)}
+  Open: ${import_chalk47.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk47.default.bold(userCode)}
 `);
-    console.log(import_chalk46.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk47.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, resource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -8438,16 +8743,16 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
     resource
   };
   saveConsumer(creds);
-  console.log(`  ${import_chalk46.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk46.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  console.log(`  ${import_chalk47.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk47.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
-async function cpPost(anon, path8, body, summary) {
+async function cpPost(anon, path9, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
     if (!cred) throw new Error("Anonymous workspace credential missing.");
-    return cpFetch(cred.cp_key, path8, { method: "POST", body: JSON.stringify(body) });
+    return cpFetch(cred.cp_key, path9, { method: "POST", body: JSON.stringify(body) });
   }
-  return admin({ method: "POST", path: path8, body, summary });
+  return admin({ method: "POST", path: path9, body, summary });
 }
 async function provision(spec2, target, opts) {
   const loggedIn = !!loadCredentials();
@@ -8467,7 +8772,7 @@ async function provision(spec2, target, opts) {
   let name = opts.name ? base2 : `${base2}${salt()}`;
   const access = anon ? "open" : opts.access === "open" ? "open" : "invite";
   if (anon && opts.access === "invite") {
-    console.log(import_chalk46.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
+    console.log(import_chalk47.default.dim("  Note: --access invite needs an account to pre-approve people. Staying open for this anonymous proxy \u2014 run `apiblaze login`, then `apiblaze apichat --access invite`."));
   }
   const DUAL_AUTH = {
     mode: "authenticate",
@@ -8566,7 +8871,7 @@ async function provision(spec2, target, opts) {
       try {
         await addPreapprovalRule(tenant2, email);
       } catch {
-        console.log(import_chalk46.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
+        console.log(import_chalk47.default.dim(`  (Could not auto-approve your email for sign-in \u2014 add it later: apiblaze preapprove ${email})`));
       }
     }
   }
@@ -8610,7 +8915,7 @@ async function uploadSpec(p, specText, opts) {
     throw err;
   }
   if (out && out.reused === true) {
-    console.log(import_chalk46.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
+    console.log(import_chalk47.default.dim("  Spec unchanged since the last provision \u2014 reusing the existing configuration."));
   } else if (out && out.changed === true && out.previous_spec_hash) {
     const interactive = !!process.stdin.isTTY && !opts.yes;
     if (interactive) {
@@ -8618,7 +8923,7 @@ async function uploadSpec(p, specText, opts) {
       const { go } = await inquirer3.prompt([
         { type: "confirm", name: "go", message: "The spec changed since the last provision \u2014 re-publish the MCP catalogue?", default: true }
       ]);
-      if (!go) console.log(import_chalk46.default.dim("  Keeping the existing MCP catalogue."));
+      if (!go) console.log(import_chalk47.default.dim("  Keeping the existing MCP catalogue."));
     }
   }
 }
@@ -8648,7 +8953,6 @@ async function publishMcp(p, spec2) {
     return null;
   }
 }
-var CLIENT_ROUND_CAP = 12;
 function chatUrl(p) {
   return `https://${p.mcpHost}/${p.version}/${p.environment}/runtime-chat`;
 }
@@ -8656,91 +8960,66 @@ function maskKey(k) {
   return k.length <= 8 ? "****" : `${k.slice(0, 4)}\u2026${k.slice(-4)}`;
 }
 var revealAuth = false;
-function renderToolEvents(events, cred) {
-  for (const e of events ?? []) {
-    const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
-    const mark = ok ? import_chalk46.default.green("\u2713") : import_chalk46.default.red("\u2717");
-    console.log(`  ${mark} ${import_chalk46.default.cyan(e.name)} ${import_chalk46.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
-    if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk46.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
-      if (cred) {
-        const shown = revealAuth ? cred.value : maskKey(cred.value);
-        const keyLine = `        -H '${cred.header}: ${shown}'`;
-        const hint = revealAuth ? "" : import_chalk46.default.yellow("  \u2190 /showauth will reveal this");
-        console.log(import_chalk46.default.dim(keyLine) + hint);
-      }
-    }
-  }
-}
-function renderToolResults(delta, events) {
-  const anyFailed = (events ?? []).some((e) => e.status === "error");
-  if (!anyFailed && !isVerbose()) return;
-  const cap = anyFailed ? 24 : 12;
-  for (const m of delta ?? []) {
-    if (!m || m.role !== "tool" || typeof m.content !== "string") continue;
-    const body = m.content.trim();
-    if (!body) continue;
-    const pretty = (() => {
-      try {
-        return JSON.stringify(JSON.parse(body), null, 2);
-      } catch {
-        return body;
-      }
-    })();
-    const lines = pretty.split("\n");
-    console.log(import_chalk46.default.dim("      response:"));
-    for (const line of lines.slice(0, cap)) {
-      console.log(import_chalk46.default.dim(`        ${line}`));
-    }
-    if (lines.length > cap) console.log(import_chalk46.default.dim(`        \u2026${lines.length - cap} more lines`));
-  }
-}
-function billingLine(billing) {
-  if (!billing || typeof billing.cents !== "number") return null;
-  if (typeof billing.free_turns_remaining === "number") return null;
-  const usd = (billing.cents / 100).toFixed(Math.abs(billing.cents - Math.round(billing.cents)) < 1e-9 ? 2 : 4);
-  let line = import_chalk46.default.magenta(`  \u{1F4B3} $${usd}`) + import_chalk46.default.dim(billing.model ? ` \xB7 ${billing.model}` : "");
-  if (typeof billing.credits_remaining === "number") {
-    line += import_chalk46.default.dim(` \xB7 balance $${(billing.credits_remaining / 100).toFixed(2)}`);
+function billingLine(info) {
+  if (!info || typeof info.charged_cents !== "number" || info.charged_cents <= 0) return null;
+  if (typeof info.free_turns_remaining === "number") return null;
+  const cents = info.charged_cents;
+  const usd = (cents / 100).toFixed(Math.abs(cents - Math.round(cents)) < 1e-9 ? 2 : 4);
+  let line = import_chalk47.default.magenta(`  \u{1F4B3} $${usd}`);
+  if (typeof info.credits_remaining === "number") {
+    line += import_chalk47.default.dim(` \xB7 balance $${(info.credits_remaining / 100).toFixed(2)}`);
   }
   return line;
 }
-function freeBudgetWarning(billing, anon) {
-  if (!anon || !billing) return null;
-  if (typeof billing.free_turns_remaining === "number") {
-    const left2 = billing.free_turns_remaining;
-    if (left2 <= 0) return import_chalk46.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
-    return import_chalk46.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
+function freeBudgetWarning(info, anon) {
+  if (!anon || !info) return null;
+  if (typeof info.free_turns_remaining === "number") {
+    const left2 = info.free_turns_remaining;
+    if (left2 <= 0) return import_chalk47.default.yellow("  Free chats used up \u2014 `npx apiblaze login` (free) to keep going.");
+    return import_chalk47.default.dim(`  ${left2} free chat${left2 === 1 ? "" : "s"} left \xB7 /login to get more`);
   }
-  if (typeof billing.free_remaining_cents !== "number") return null;
-  const perTurn = Math.max(billing.cents || 0, 0.02);
-  const left = Math.floor(billing.free_remaining_cents / perTurn);
+  if (typeof info.free_remaining_cents !== "number") return null;
+  const perTurn = Math.max(info.charged_cents || 0, 0.02);
+  const left = Math.floor(info.free_remaining_cents / perTurn);
   if (left > 8) return null;
-  if (left <= 0) return import_chalk46.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
-  return import_chalk46.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
-}
-function printAssistant(delta) {
-  for (let i = delta.length - 1; i >= 0; i--) {
-    const m = delta[i];
-    if (m && m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      console.log("\n" + import_chalk46.default.green("assistant \u203A ") + m.content + "\n");
-      return;
+  if (left <= 0) return import_chalk47.default.yellow("  Free messages used up \u2014 `npx apiblaze login` (free) to keep chatting.");
+  return import_chalk47.default.yellow(`  \u26A0 About ${left} free message${left === 1 ? "" : "s"} left \u2014 \`npx apiblaze login\` (free) for more.`);
+}
+async function readSse(body, onEvent) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buf = "";
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    for (; ; ) {
+      const at = buf.indexOf("\n\n");
+      if (at === -1) break;
+      const rawEvent = buf.slice(0, at);
+      buf = buf.slice(at + 2);
+      const data = rawEvent.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
+      if (!data || data === "[DONE]") continue;
+      try {
+        onEvent(JSON.parse(data));
+      } catch {
+      }
     }
   }
 }
 async function replTurn(p, messages, userText) {
-  messages.push({ role: "user", content: userText });
+  messages.push({ id: crypto2.randomUUID(), role: "user", parts: [{ type: "text", text: userText }] });
   const llm2 = loadLlmConfig();
   const turnId = crypto2.randomUUID();
-  for (let round = 0; round < CLIENT_ROUND_CAP; round++) {
-    const spinner = (0, import_ora23.default)({ text: round === 0 ? "thinking..." : "working...", color: "magenta" }).start();
-    const body = {
-      turn_id: turnId,
-      messages,
-      environment: p.environment,
-      ...llm2 ? { llm_api_key: llm2.key, llm_provider: llm2.provider } : {}
-    };
-    let res;
+  const spinner = (0, import_ora23.default)({ text: "thinking...", color: "magenta" }).start();
+  const body = {
+    turn_id: turnId,
+    messages,
+    environment: p.environment,
+    ...llm2 ? { llm_api_key: llm2.key, llm_provider: llm2.provider } : {}
+  };
+  let res = null;
+  for (let attempt = 0; attempt < 3; attempt++) {
     try {
       res = await fetch(chatUrl(p), {
         method: "POST",
@@ -8749,93 +9028,286 @@ async function replTurn(p, messages, userText) {
       });
     } catch (err) {
       spinner.fail("Network error.");
-      console.log(import_chalk46.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
+      console.log(import_chalk47.default.red(`  Could not reach ${p.mcpHost}: ${err instanceof Error ? err.message : String(err)}`));
       return;
     }
+    if ((res.headers.get("content-type") ?? "").includes("text/event-stream") && res.ok && res.body) break;
+    spinner.stop();
     let data = null;
     try {
       data = await res.json();
     } catch {
     }
-    spinner.stop();
-    if (data && data.upsell) {
-      renderUpsell(p, data.upsell);
+    const errObj = data && typeof data.error === "object" ? data.error : null;
+    const code = errObj && errObj.code || null;
+    const msg = String(errObj && errObj.message || data && (data.error || data.message) || "");
+    const tty = !!process.stdin.isTTY;
+    if (res.status === 404 && /project not found/i.test(msg)) {
+      const flipped = p.mcpHost.includes(".tryabz.run") ? p.mcpHost.replace(".tryabz.run", ".abz.run") : p.mcpHost.replace(".abz.run", ".tryabz.run");
+      if (flipped !== p.mcpHost && attempt === 0) {
+        p.mcpHost = flipped;
+        p.proxyUrl = p.proxyUrl?.includes("tryabz.run") ? p.proxyUrl.replace("tryabz.run", "abz.run") : p.proxyUrl?.replace("abz.run", "tryabz.run");
+        p.anon = flipped.includes(".tryabz.run");
+        spinner.start("retrying on the " + (p.anon ? "trial" : "claimed") + " plane\u2026");
+        continue;
+      }
+      console.log(import_chalk47.default.red(`  No proxy named ${p.projectId} was found (tried both abz.run and tryabz.run).`));
+      return;
+    }
+    if (code === "identity_required" || /identif/i.test(msg) && !code) {
+      if (!p.endUserId && tty) {
+        console.log(import_chalk47.default.yellow("  This API requires every call to say WHO is calling."));
+        const { default: inquirer3 } = await import("inquirer");
+        const { id } = await inquirer3.prompt([{ type: "input", name: "id", message: "Your end-user id (usually your email):" }]);
+        if (typeof id === "string" && id.trim()) {
+          p.endUserId = id.trim();
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        }
+      }
+      console.log(import_chalk47.default.red("  This API requires an identified caller."));
+      console.log(import_chalk47.default.dim("  Re-run with --xenduserid <your id> (usually your email)."));
       return;
     }
-    if (res.status === 402 || res.status === 403) {
-      renderUpsell(p, { reason: "PAUSED", message: data && data.error || "This turn is not available on your current plan." });
+    if (code === "user_not_preapproved") {
+      console.log(import_chalk47.default.yellow(`  ${msg || "You are not pre-approved on this API."}`));
+      if (p.endUserId) console.log(import_chalk47.default.dim(`  Identity sent: ${p.endUserId}`));
+      const accessUrl = errObj && errObj.request_access_url;
+      if (accessUrl) console.log(`  Request access: ${import_chalk47.default.bold(String(accessUrl))}`);
+      console.log(import_chalk47.default.dim("  Or ask the producer to pre-approve you: `apiblaze preapprove <your-email> --tenant <tenant>`."));
       return;
     }
-    if (res.status === 401) {
-      const reason = data && (data.error || data.message) || null;
-      const usingKey = !p.consumerAuth;
-      console.log(import_chalk46.default.red(`  The proxy rejected the request (401)${reason ? `: ${reason}` : "."}`));
-      console.log(
-        import_chalk46.default.dim(
-          usingKey ? "  Sent an API key. If the key was revoked, re-run `apiblaze apichat` to re-provision." : "  Sent your consumer OAuth token. Re-run `apiblaze apichat` to sign in again."
-        )
-      );
+    if (code === "user_frozen") {
+      console.log(import_chalk47.default.red(`  ${msg || "Your access to this API has been frozen by the producer."}`));
       return;
     }
-    if (!res.ok || !data) {
-      const err = data && data.error || `HTTP ${res.status}`;
-      console.log(import_chalk46.default.red(`  Chat error: ${err}`));
+    const oauthWanted = /oauth token required|authorization: bearer/i.test(msg);
+    const keyWanted = /api key required|x-api-key/i.test(msg);
+    if (oauthWanted && !p.consumerAuth) {
+      if (p.teamId && p.tenant && loadCredentials()) {
+        console.log(import_chalk47.default.dim("  This proxy signs consumers in with OAuth \u2014 starting the login\u2026"));
+        try {
+          await ensureConsumerLogin(p.teamId, p.tenant, p.version);
+          p.consumerAuth = true;
+          p.dpKey = void 0;
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        } catch (err) {
+          console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          return;
+        }
+      }
+      console.log(import_chalk47.default.red("  This proxy signs consumers in with OAuth (a login), not an API key."));
+      console.log(import_chalk47.default.dim("  Sign in with: `apiblaze consumer login --tenant <tenant> --client <app-client-id>`, then re-run apichat."));
       return;
     }
-    if (Array.isArray(data.delta)) {
-      renderToolEvents(
-        data.tool_events,
-        p.consumerAuth ? (() => {
-          const t = loadConsumer()?.accessToken;
-          return t ? { header: "Authorization", value: `Bearer ${t}` } : void 0;
-        })() : p.dpKey ? { header: "X-API-Key", value: p.dpKey } : void 0
-      );
-      renderToolResults(data.delta, data.tool_events);
-      for (const m of data.delta) messages.push(m);
-      printAssistant(data.delta);
+    if (keyWanted) {
+      if (tty) {
+        console.log(import_chalk47.default.yellow(`  ${msg || "This API requires an API key."}`));
+        const { default: inquirer3 } = await import("inquirer");
+        const { key } = await inquirer3.prompt([{ type: "password", name: "key", mask: "*", message: "API key for this proxy:" }]);
+        if (typeof key === "string" && key.trim()) {
+          p.dpKey = key.trim();
+          p.consumerAuth = false;
+          persistAuthState(p);
+          spinner.start("retrying\u2026");
+          continue;
+        }
+      }
+      console.log(import_chalk47.default.red(`  ${msg || "This API requires an API key."}`));
+      console.log(import_chalk47.default.dim("  Re-run with --apikey <key> (mint one from the producer's site or dev portal)."));
+      return;
     }
-    const bl = billingLine(data.billing);
-    if (bl) console.log(bl);
-    const warn = freeBudgetWarning(data.billing, p.anon);
-    if (warn) console.log(warn);
-    if (!data.continue) return;
+    if (res && (res.status === 402 || res.status === 403)) {
+      renderUpsell(p, { reason: "PAUSED", message: msg || "This turn is not available on your current plan." });
+      return;
+    }
+    if (res && res.status === 401) {
+      console.log(import_chalk47.default.red(`  The proxy rejected the request (401)${msg ? `: ${msg}` : "."}`));
+      console.log(import_chalk47.default.dim(p.consumerAuth ? "  Sent your consumer OAuth token. Run `apiblaze consumer login` again." : "  Sent an API key. Pass a different one with --apikey <key>."));
+      return;
+    }
+    console.log(import_chalk47.default.red(`  Chat error: ${msg || (res ? `HTTP ${res.status}` : "request failed")}`));
+    return;
   }
-  console.log(import_chalk46.default.dim("  (stopped after several tool rounds \u2014 ask again to continue)"));
-}
-function renderUpsell(p, upsell) {
+  if (!res || !res.body || !(res.headers.get("content-type") ?? "").includes("text/event-stream")) {
+    spinner.stop();
+    console.log(import_chalk47.default.red("  Chat error: could not authenticate to this proxy after several attempts."));
+    return;
+  }
+  let spinnerLive = true;
+  const stopSpinner = () => {
+    if (spinnerLive) {
+      spinner.stop();
+      spinnerLive = false;
+    }
+  };
+  const parts = [];
+  let openTextIdx = -1;
+  let assistantOpen = false;
+  const toolMeta = /* @__PURE__ */ new Map();
+  let upsell = null;
+  let turnInfo = null;
+  let errorText = null;
+  let messageId = `msg_${Date.now()}`;
+  const credHint = () => {
+    if (!isVerbose()) return null;
+    if (p.consumerAuth) {
+      const t = loadConsumer()?.accessToken;
+      return t ? `Authorization: Bearer ${revealAuth ? t : maskKey(t)}` : null;
+    }
+    return p.dpKey ? `X-API-Key: ${revealAuth ? p.dpKey : maskKey(p.dpKey)}` : null;
+  };
+  try {
+    await readSse(res.body, (ev) => {
+      switch (ev?.type) {
+        case "start":
+          if (typeof ev.messageId === "string") messageId = ev.messageId;
+          break;
+        case "tool-input-start": {
+          stopSpinner();
+          if (assistantOpen) {
+            process.stdout.write("\n");
+            assistantOpen = false;
+          }
+          const name = String(ev.toolName ?? "tool");
+          parts.push({ type: `tool-${name}`, toolCallId: String(ev.toolCallId ?? ""), state: "input-streaming" });
+          toolMeta.set(String(ev.toolCallId ?? ""), { name, startedAt: Date.now(), partIdx: parts.length - 1 });
+          console.log(`  ${import_chalk47.default.cyan("\u2699")} ${import_chalk47.default.cyan(name)}${import_chalk47.default.dim("\u2026")}`);
+          break;
+        }
+        case "tool-input-available": {
+          const id = String(ev.toolCallId ?? "");
+          const meta = toolMeta.get(id);
+          const input = ev.input && typeof ev.input === "object" ? ev.input : {};
+          if (meta) {
+            meta.input = input;
+            Object.assign(parts[meta.partIdx], { state: "input-available", input });
+          }
+          if (isVerbose()) {
+            console.log(import_chalk47.default.dim(`      args ${JSON.stringify(input)}`));
+            const hint = credHint();
+            if (hint) console.log(import_chalk47.default.dim(`      auth ${hint}`) + (revealAuth ? "" : import_chalk47.default.yellow("  \u2190 /showauth reveals")));
+          }
+          break;
+        }
+        case "tool-output-available":
+        case "tool-output-error": {
+          stopSpinner();
+          const id = String(ev.toolCallId ?? "");
+          const meta = toolMeta.get(id);
+          const ok = ev.type === "tool-output-available";
+          const ms = meta ? Date.now() - meta.startedAt : void 0;
+          const mark = ok ? import_chalk47.default.green("\u2713") : import_chalk47.default.red("\u2717");
+          console.log(`  ${mark} ${import_chalk47.default.cyan(meta?.name ?? "tool")} ${import_chalk47.default.dim(`(${ok ? "ok" : "error"}${ms != null ? `, ${ms}ms` : ""})`)}`);
+          const detail = ok ? String(ev.output ?? "") : String(ev.errorText ?? "Tool call failed.");
+          if (meta) {
+            Object.assign(parts[meta.partIdx], ok ? { state: "output-available", output: detail } : { state: "output-error", errorText: detail });
+          }
+          if (!ok || isVerbose()) {
+            const pretty = (() => {
+              try {
+                return JSON.stringify(JSON.parse(detail), null, 2);
+              } catch {
+                return detail;
+              }
+            })();
+            const lines = pretty.split("\n");
+            const cap = ok ? 12 : 24;
+            console.log(import_chalk47.default.dim("      response:"));
+            for (const line of lines.slice(0, cap)) console.log(import_chalk47.default.dim(`        ${line}`));
+            if (lines.length > cap) console.log(import_chalk47.default.dim(`        \u2026${lines.length - cap} more lines`));
+          }
+          break;
+        }
+        case "text-start":
+          stopSpinner();
+          parts.push({ type: "text", text: "" });
+          openTextIdx = parts.length - 1;
+          if (!assistantOpen) {
+            process.stdout.write("\n" + import_chalk47.default.green("assistant \u203A "));
+            assistantOpen = true;
+          }
+          break;
+        case "text-delta": {
+          const delta = String(ev.delta ?? "");
+          if (openTextIdx >= 0) parts[openTextIdx].text = String(parts[openTextIdx].text ?? "") + delta;
+          process.stdout.write(delta);
+          break;
+        }
+        case "text-end":
+          openTextIdx = -1;
+          break;
+        case "data-apiblaze-upsell": {
+          const d = ev.data ?? {};
+          upsell = { reason: String(d.reason ?? ""), message: String(d.message ?? "") };
+          break;
+        }
+        case "data-apiblaze-turn":
+          turnInfo = ev.data ?? {};
+          break;
+        case "error":
+          stopSpinner();
+          errorText = String(ev.errorText ?? "Something went wrong.");
+          break;
+        default:
+          break;
+      }
+    });
+  } catch (err) {
+    stopSpinner();
+    console.log(import_chalk47.default.red(`  Stream error: ${err instanceof Error ? err.message : String(err)}`));
+  }
+  stopSpinner();
+  if (assistantOpen) process.stdout.write("\n\n");
+  if (parts.length) messages.push({ id: messageId, role: "assistant", parts });
+  if (errorText) console.log(import_chalk47.default.red(`  ${errorText}`));
+  if (upsell) {
+    renderUpsell(p, upsell, { messageAlreadyShown: true });
+  }
+  const bl = billingLine(turnInfo);
+  if (bl) console.log(bl);
+  const warn = freeBudgetWarning(turnInfo, p.anon);
+  if (warn) console.log(warn);
+}
+function renderUpsell(p, upsell, opts = {}) {
   const loggedIn = !!loadCredentials();
   if (upsell.reason === "CAPPED" && !loggedIn) {
-    console.log("\n" + import_chalk46.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
-    console.log(import_chalk46.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
+    console.log("\n" + import_chalk47.default.yellow("  Type `npx apiblaze login` to claim the rest of your balance."));
+    console.log(import_chalk47.default.dim("  (or `/login` right here \u2014 your chat is preserved \u2014 or `apiblaze llm set-key` for your own model key.)"));
     console.log();
     return;
   }
-  console.log("\n" + import_chalk46.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  if (!opts.messageAlreadyShown) {
+    console.log("\n" + import_chalk47.default.yellow(`  ${upsell.message || "This turn is not available right now."}`));
+  }
   if (upsell.reason === "INSUFFICIENT" || upsell.reason === "BREAKER" || upsell.reason === "CAPPED" || upsell.reason === "QUOTA" || upsell.reason === "PROXY_CAP" || upsell.reason === "PAUSED" || upsell.reason === "BYO_REQUIRED") {
     if (!loggedIn) {
-      console.log(import_chalk46.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
+      console.log(import_chalk47.default.dim("  Options: `/login` for more free chats and requests, or `apiblaze llm set-key` to bring your own model key."));
     } else {
-      console.log(import_chalk46.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
+      console.log(import_chalk47.default.dim("  Options: top up your wallet, or `apiblaze llm set-key` to bring your own model key (bypasses platform limits)."));
     }
   } else if (upsell.reason === "INFLIGHT") {
-    console.log(import_chalk46.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
+    console.log(import_chalk47.default.dim("  Another turn is still in flight \u2014 wait a moment and try again."));
   }
   console.log();
 }
-var apichatsPath = () => path6.join(getApiblazeDir(), "apichats.json");
+var apichatsPath = () => path7.join(getApiblazeDir(), "apichats.json");
 function loadApichats() {
   try {
-    const list = JSON.parse(fs9.readFileSync(apichatsPath(), "utf-8"));
+    const list = JSON.parse(fs11.readFileSync(apichatsPath(), "utf-8"));
     return Array.isArray(list) ? list : [];
   } catch {
     return [];
   }
 }
 function writeApichats(list) {
-  fs9.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs9.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
+  fs11.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs11.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
   try {
-    fs9.chmodSync(apichatsPath(), 384);
+    fs11.chmodSync(apichatsPath(), 384);
   } catch {
   }
 }
@@ -8849,6 +9321,16 @@ function upsertApichat(entry) {
   else list.unshift(entry);
   writeApichats(list.slice(0, 30));
 }
+function persistAuthState(p) {
+  const list = loadApichats();
+  const i = list.findIndex((a) => a.projectId === p.projectId && a.version === p.version);
+  if (i < 0) return;
+  list[i].dpKey = p.dpKey;
+  list[i].consumerAuth = p.consumerAuth;
+  list[i].endUserId = p.endUserId;
+  list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeApichats(list);
+}
 function saveTranscript(p, messages) {
   const list = loadApichats();
   const i = list.findIndex((a) => apichatKey(a) === apichatKey(p));
@@ -8898,6 +9380,57 @@ async function fetchProxyDoor(teamId, projectId, apiVersion) {
     return { methods: null };
   }
 }
+async function openDirectProject(projectId, opts) {
+  const saved = loadApichats().find((a) => a.projectId === projectId);
+  const version2 = opts.apiversion || saved?.version || "1.0.0";
+  const environment = opts.environment || saved?.environment || "prod";
+  const anon = saved?.anon ?? !loadCredentials();
+  const mcpHost = saved?.mcpHost || `${projectId}.mcp.${anon ? "tryabz" : "abz"}.run`;
+  const p = {
+    projectId,
+    version: version2,
+    environment,
+    dpKey: opts.apikey ?? saved?.dpKey,
+    consumerAuth: opts.apikey ? false : saved?.consumerAuth,
+    mcpHost,
+    proxyUrl: `https://${projectId}.${anon ? "tryabz" : "abz"}.run/${version2}/${environment}`,
+    anon,
+    access: "invite",
+    tenant: saved?.tenant,
+    teamId: saved?.teamId,
+    endUserId: opts.xenduserid ?? saved?.endUserId
+  };
+  if (!p.dpKey && !p.consumerAuth) {
+    if (process.stdin.isTTY) {
+      const { default: inquirer3 } = await import("inquirer");
+      const { key } = await inquirer3.prompt([{
+        type: "password",
+        name: "key",
+        mask: "*",
+        message: `API key for ${projectId} (leave empty if it uses a login):`
+      }]);
+      if (typeof key === "string" && key.trim()) p.dpKey = key.trim();
+      else p.consumerAuth = true;
+    }
+  }
+  console.log(`  ${import_chalk47.default.dim("Proxy:")} ${import_chalk47.default.bold(p.proxyUrl)}`);
+  if (p.endUserId) console.log(`  ${import_chalk47.default.dim("Acting as:")} ${import_chalk47.default.bold(p.endUserId)}`);
+  upsertApichat({
+    name: projectId,
+    target: p.proxyUrl,
+    projectId,
+    version: version2,
+    environment,
+    mcpHost,
+    teamId: p.teamId,
+    tenant: p.tenant,
+    dpKey: p.dpKey,
+    consumerAuth: p.consumerAuth,
+    anon,
+    endUserId: p.endUserId
+  });
+  return { p, messages: saved?.messages?.filter((m) => Array.isArray(m.parts)) ?? [] };
+}
 async function openServerProxy(project) {
   const version2 = project.apiVersion || "1.0.0";
   const environment = "prod";
@@ -8911,9 +9444,9 @@ async function openServerProxy(project) {
   let consumerAuth = false;
   if (acceptsApiKey) {
     if (!dpKey) {
-      console.log(import_chalk46.default.dim(`  Minting an API key for tenant ${import_chalk46.default.bold(tenant2)} to query project ${import_chalk46.default.bold(project.projectName)}\u2026`));
+      console.log(import_chalk47.default.dim(`  Minting an API key for tenant ${import_chalk47.default.bold(tenant2)} to query project ${import_chalk47.default.bold(project.projectName)}\u2026`));
       dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-      console.log(`  ${import_chalk46.default.green("\u2714")} API key: ${import_chalk46.default.dim(maskKey(dpKey))}`);
+      console.log(`  ${import_chalk47.default.green("\u2714")} API key: ${import_chalk47.default.dim(maskKey(dpKey))}`);
     }
   } else {
     consumerAuth = true;
@@ -8942,9 +9475,9 @@ async function openServerProxy(project) {
     const spec2 = raw && (raw.spec ?? raw);
     spinner.stop();
     if (!spec2 || !(spec2.paths || spec2.openapi)) {
-      console.log(import_chalk46.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
+      console.log(import_chalk47.default.yellow("  This proxy has no OpenAPI spec yet \u2014 chat will have no tools. Build one with `apiblaze agent openapi`."));
     } else {
-      console.log(import_chalk46.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
+      console.log(import_chalk47.default.dim("  Using the proxy's existing MCP catalogue (`apiblaze mcp` to rebuild it)."));
     }
   } catch (err) {
     spinner.fail("Could not open the proxy.");
@@ -8976,15 +9509,15 @@ function discoverLocalSpecs() {
   const found = [];
   for (const n of known) {
     try {
-      if (fs9.statSync(path6.join(cwd, n)).isFile()) found.push(n);
+      if (fs11.statSync(path7.join(cwd, n)).isFile()) found.push(n);
     } catch {
     }
   }
   try {
-    const files = fs9.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
+    const files = fs11.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
     for (const f of files.slice(0, 60)) {
       try {
-        const head = fs9.readFileSync(path6.join(cwd, f), "utf-8").slice(0, 4e3);
+        const head = fs11.readFileSync(path7.join(cwd, f), "utf-8").slice(0, 4e3);
         if (/["']?openapi["']?\s*:/i.test(head) || /["']?swagger["']?\s*:/i.test(head) || /^\s*paths\s*:/im.test(head) || /"paths"\s*:/.test(head)) {
           found.push(f);
         }
@@ -9000,7 +9533,7 @@ async function noArgsMenu(opts) {
   const me = loadCredentials()?.apiblazeUserId;
   const saved = loadApichats().filter((a) => a.anon ? true : a.ownerUserId !== void 0 && a.ownerUserId === me);
   const choices = saved.map((a) => ({
-    name: `Chat with ${import_chalk46.default.bold(a.name)} ${import_chalk46.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
+    name: `Chat with ${import_chalk47.default.bold(a.name)} ${import_chalk47.default.dim(`(${a.target})${a.messages && a.messages.length ? ` \xB7 ${a.messages.length} msgs` : ""}`)}`,
     value: { type: "existing", a }
   }));
   const creds = loadCredentials();
@@ -9010,14 +9543,14 @@ async function noArgsMenu(opts) {
       const proxies = (await getProjects(creds.teamId)).filter((pr) => !savedIds.has(pr.projectId));
       for (const pr of proxies) {
         choices.push({
-          name: `Chat with ${import_chalk46.default.bold(pr.projectName)} ${import_chalk46.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
+          name: `Chat with ${import_chalk47.default.bold(pr.projectName)} ${import_chalk47.default.dim(`(v${pr.apiVersion}) \xB7 your proxy`)}`,
           value: { type: "server", project: pr }
         });
       }
     } catch {
     }
   }
-  choices.push({ name: import_chalk46.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
+  choices.push({ name: import_chalk47.default.green("\uFF0B Create a new apichat"), value: { type: "new" } });
   const { pick: pick2 } = await inquirer3.prompt([
     { type: "list", name: "pick", message: "What would you like to do?", choices }
   ]);
@@ -9119,37 +9652,37 @@ async function noArgsMenu(opts) {
 }
 async function runRepl(p, initialMessages) {
   const { default: inquirer3 } = await import("inquirer");
-  const messages = initialMessages && initialMessages.length ? initialMessages.slice() : [];
-  console.log("\n" + import_chalk46.default.cyan.bold("Chat with your API") + import_chalk46.default.dim(`  \xB7 ${p.mcpHost}`));
-  if (messages.length) console.log(import_chalk46.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
+  const messages = (initialMessages ?? []).filter((m) => Array.isArray(m.parts));
+  console.log("\n" + import_chalk47.default.cyan.bold("Chat with your API") + import_chalk47.default.dim(`  \xB7 ${p.mcpHost}`));
+  if (messages.length) console.log(import_chalk47.default.dim(`  Resumed \u2014 ${messages.length} prior messages.`));
   const llm2 = loadLlmConfig();
   console.log(
-    import_chalk46.default.dim(
+    import_chalk47.default.dim(
       llm2 ? `Using your local ${llm2.provider} key for the model. Type a question, or /exit. /login /claim manage your workspace.` : "Ask a question in plain English. /exit to quit \xB7 /login for more free chats \xB7 /claim to keep this workspace \xB7 `apiblaze llm set-key` for BYO models."
     )
   );
   for (; ; ) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk46.default.green("you \u203A") }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk47.default.green("you \u203A") }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["/exit", "/quit", "exit", "quit", ":q"].includes(text.toLowerCase())) break;
     if (text === "/login") {
       try {
         await runLogin();
-        console.log(import_chalk46.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
+        console.log(import_chalk47.default.dim("  Logged in \u2014 history preserved. Keep chatting."));
       } catch (err) {
-        console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/claim") {
       const justLoggedIn = !loadCredentials();
       if (justLoggedIn) {
-        console.log(import_chalk46.default.dim("  Logging in to claim your workspace\u2026"));
+        console.log(import_chalk47.default.dim("  Logging in to claim your workspace\u2026"));
         try {
           await runLogin();
         } catch (err) {
-          console.log(import_chalk46.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
+          console.log(import_chalk47.default.red(`  Login failed: ${err instanceof Error ? err.message : String(err)}`));
           continue;
         }
         if (!loadCredentials()) continue;
@@ -9160,43 +9693,123 @@ async function runRepl(p, initialMessages) {
           p.mcpHost = p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run");
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
-          console.log(import_chalk46.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          console.log(import_chalk47.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
         }
       } catch (err) {
-        console.log(import_chalk46.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
+        console.log(import_chalk47.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
       }
       continue;
     }
     if (text === "/showauth") {
       revealAuth = !revealAuth;
-      console.log(import_chalk46.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
+      console.log(import_chalk47.default.dim(revealAuth ? "  The real API key will be shown in the next call's curl. /showauth again to re-mask." : "  API key re-masked."));
       continue;
     }
     if (text.startsWith("/")) {
-      console.log(import_chalk46.default.dim("  Commands: /login /claim /showauth /exit"));
+      console.log(import_chalk47.default.dim("  Commands: /login /claim /showauth /exit"));
       continue;
     }
     await replTurn(p, messages, text);
     saveTranscript(p, messages);
   }
-  console.log(import_chalk46.default.dim("\nBye."));
+  console.log(import_chalk47.default.dim("\nBye."));
+}
+function rememberCliOffer(projectId, cli, state) {
+  const list = loadApichats();
+  const i = list.findIndex((a) => a.projectId === projectId);
+  if (i < 0) return;
+  list[i].cliOffer = { ...list[i].cliOffer ?? {}, [cli]: state };
+  list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeApichats(list);
+}
+async function maybeInstallExternalCli(p, opts) {
+  const spec2 = {
+    name: p.projectId,
+    url: `https://${p.mcpHost}/${p.version}/${p.environment}`,
+    // consumerAuth means the door is a login — install bare, the CLI signs in.
+    apiKey: p.consumerAuth ? void 0 : p.dpKey,
+    projectLabel: p.projectId
+  };
+  const clis = detectExternalClis();
+  if (opts.installMcp) {
+    const want = opts.installMcp.toLowerCase();
+    if (want !== "claude" && want !== "codex") fail4(`--install-mcp takes "claude" or "codex", not "${opts.installMcp}".`);
+    const cli = clis.find((c) => c.kind === want);
+    if (!cli) fail4(
+      `${want === "claude" ? "Claude" : "Codex"} CLI not found on this machine.`,
+      want === "claude" ? "Install it: npm install -g @anthropic-ai/claude-code" : "Install it: npm install -g @openai/codex"
+    );
+    const question2 = opts.prompt ?? (process.stdin.isTTY ? await askApiQuestion() : void 0);
+    const ran2 = installAndDemo(cli, spec2, question2);
+    if (ran2) rememberCliOffer(p.projectId, cli.kind, "installed");
+    return ran2;
+  }
+  if (!process.stdin.isTTY || clis.length === 0) return false;
+  const offer = loadApichats().find((a) => a.projectId === p.projectId)?.cliOffer ?? {};
+  const fresh = clis.filter((c) => !offer[c.kind]);
+  if (fresh.length === 0) return false;
+  const { default: inquirer3 } = await import("inquirer");
+  const names = fresh.map((c) => c.label).join(" and ");
+  const { pick: pick2 } = await inquirer3.prompt([{
+    type: "list",
+    name: "pick",
+    message: `I see ${names} ${fresh.length > 1 ? "are" : "is"} installed on this computer. Add the MCP for this proxy so you can chat with your API from there directly?`,
+    choices: [
+      ...fresh.map((c) => ({ name: `Yes \u2014 add it to ${c.label}`, value: c })),
+      { name: "No \u2014 chat here instead", value: "no" }
+    ]
+  }]);
+  if (pick2 === "no") {
+    for (const c of fresh) rememberCliOffer(p.projectId, c.kind, "declined");
+    return false;
+  }
+  const question = opts.prompt ?? await askApiQuestion();
+  const ran = installAndDemo(pick2, spec2, question);
+  if (ran) rememberCliOffer(p.projectId, pick2.kind, "installed");
+  return ran;
+}
+async function askApiQuestion() {
+  const { default: inquirer3 } = await import("inquirer");
+  const { q } = await inquirer3.prompt([{
+    type: "input",
+    name: "q",
+    message: "What question do you have for this API?"
+  }]);
+  const t = (q ?? "").trim();
+  return t || void 0;
 }
 async function runApichat(opts) {
   setVerbose(opts.verbose !== false);
-  console.log(import_chalk46.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  console.log(import_chalk47.default.bold("\napichat \u2014 turn any API into a chat\n"));
+  if (opts.target && !opts.openapispec) {
+    const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
+    const c = await classifyTargetInput2(opts.target, fail4);
+    if (c.kind === "spec") {
+      console.log(import_chalk47.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 using it as the spec.`));
+      opts.openapispec = opts.target;
+      opts.target = void 0;
+    }
+  }
+  if (opts.project) {
+    const opened = await openDirectProject(opts.project, opts);
+    if (await maybeInstallExternalCli(opened.p, opts)) return;
+    await runRepl(opened.p, opened.messages);
+    return;
+  }
   if (!opts.openapispec && !opts.target) {
     if (!process.stdin.isTTY) {
-      fail4("No spec source. Pass --openapispec <file|url> or --target <url>.", GENERATOR_HINT);
+      fail4("No spec source. Pass --target <server-url | openapi-file | openapi-url>.", GENERATOR_HINT);
     }
     const resumed = await noArgsMenu(opts);
     if (resumed) {
+      if (await maybeInstallExternalCli(resumed.p, opts)) return;
       await runRepl(resumed.p, resumed.messages);
       return;
     }
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
   const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk46.default.dim("Target:")} ${import_chalk46.default.bold(target)}`);
+  console.log(`  ${import_chalk47.default.dim("Target:")} ${import_chalk47.default.bold(target)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail4(
@@ -9205,7 +9818,7 @@ async function runApichat(opts) {
     );
   }
   const p = await provision(spec2, target, opts);
-  console.log(`  ${import_chalk46.default.dim("Proxy: ")} ${import_chalk46.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
+  console.log(`  ${import_chalk47.default.dim("Proxy: ")} ${import_chalk47.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
     target,
@@ -9225,30 +9838,31 @@ async function runApichat(opts) {
     const secret = await captureTargetSecret(auth, opts);
     if (secret) await writeTargetAuth(p, auth, secret);
   } else {
-    console.log(import_chalk46.default.dim("  Target auth: none required."));
+    console.log(import_chalk47.default.dim("  Target auth: none required."));
   }
   const specText = JSON.stringify(spec2);
   await uploadSpec(p, specText, opts);
   const mcpUrl = await publishMcp(p, spec2);
   console.log();
-  if (p.proxyUrl) console.log(`  ${import_chalk46.default.green("\u2713")} proxy  ${import_chalk46.default.bold(p.proxyUrl)}`);
+  if (p.proxyUrl) console.log(`  ${import_chalk47.default.green("\u2713")} proxy  ${import_chalk47.default.bold(p.proxyUrl)}`);
   if (mcpUrl) {
-    console.log(`  ${import_chalk46.default.green("\u2713")} mcp    ${import_chalk46.default.bold(mcpUrl)}`);
+    console.log(`  ${import_chalk47.default.green("\u2713")} mcp    ${import_chalk47.default.bold(mcpUrl)}`);
     if (p.access === "invite") {
-      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
-      console.log(import_chalk46.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
+      console.log(import_chalk47.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: invite \u2014 only you + emails you pre-approve"));
+      console.log(import_chalk47.default.dim(`         Let others in:  apiblaze preapprove someone@company.com${p.tenant ? ` --tenant ${p.tenant}` : ""}   (or re-run with --access open)`));
     } else {
-      console.log(import_chalk46.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
+      console.log(import_chalk47.default.dim("         Claude/ChatGPT-connectable (GitHub sign-in) \xB7 access: open \u2014 anyone who signs in can call this API"));
     }
   }
   if (p.anon) {
-    console.log(import_chalk46.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
+    console.log(import_chalk47.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
+  if (await maybeInstallExternalCli(p, opts)) return;
   await runRepl(p);
 }
 
 // src/commands/consumer.ts
-var import_chalk47 = __toESM(require("chalk"));
+var import_chalk48 = __toESM(require("chalk"));
 var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -9270,7 +9884,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk47.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk48.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -9281,7 +9895,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk47.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk48.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -9299,18 +9913,18 @@ async function runConsumerLogin(opts) {
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk47.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk48.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk47.default.cyan("\u2192")} Logging in to ${import_chalk47.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk48.default.cyan("\u2192")} Logging in to ${import_chalk48.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk47.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk47.default.bold(userCode)}
+  Open: ${import_chalk48.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk48.default.bold(userCode)}
 `);
-    console.log(import_chalk47.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk48.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -9325,7 +9939,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk47.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk48.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer2();
@@ -9338,18 +9952,18 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk47.default.cyan("Consumer")} ${import_chalk47.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk47.default.bold(fresh.tenant)}
+  console.log(`${import_chalk48.default.cyan("Consumer")} ${import_chalk48.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk48.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk47.default.bold("access_token")}  ${import_chalk47.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk48.default.bold("access_token")}  ${import_chalk48.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk47.default.bold("id_token")}      ${import_chalk47.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk48.default.bold("id_token")}      ${import_chalk48.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk47.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk48.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk47.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk48.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
@@ -9359,8 +9973,8 @@ async function runConsumerApikeys(opts) {
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk47.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk47.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk48.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk48.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -9368,16 +9982,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk47.default.yellow("No API keys yet."));
+    console.log(import_chalk48.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk47.default.green(clear) : import_chalk47.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk47.default.dim(`exp ${k.expires_at}`) : import_chalk47.default.dim("no expiry");
-      console.log(`  ${import_chalk47.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk47.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk48.default.green(clear) : import_chalk48.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk48.default.dim(`exp ${k.expires_at}`) : import_chalk48.default.dim("no expiry");
+      console.log(`  ${import_chalk48.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk48.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk47.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk48.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -9399,35 +10013,35 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk47.default.green(key)}  ${import_chalk47.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk47.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk48.default.green(key)}  ${import_chalk48.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk48.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk48 = __toESM(require("chalk"));
+var import_chalk49 = __toESM(require("chalk"));
 var import_ora25 = __toESM(require("ora"));
-var fs10 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var fs12 = __toESM(require("fs"));
+var path8 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs10.existsSync(path7.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs12.existsSync(path8.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs10.readFileSync(path7.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs12.readFileSync(path8.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs10.existsSync(path7.join(root, "app")) || fs10.existsSync(path7.join(root, "src", "app"));
-  const pagesDir = fs10.existsSync(path7.join(root, "pages")) || fs10.existsSync(path7.join(root, "src", "pages"));
+  const appDir = fs12.existsSync(path8.join(root, "app")) || fs12.existsSync(path8.join(root, "src", "app"));
+  const pagesDir = fs12.existsSync(path8.join(root, "pages")) || fs12.existsSync(path8.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
-  const p = path7.join(root, ".env.local");
+  const p = path8.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs10.readFileSync(p, "utf8");
+    existing = fs12.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -9442,15 +10056,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs10.writeFileSync(p, next);
+  fs12.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs10.existsSync(path7.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk48.default.green("\u2713")} apiblaze package already installed`);
+  if (fs12.existsSync(path8.join(root, "node_modules", "apiblaze", "package.json"))) {
+    console.log(`  ${import_chalk49.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f) => fs10.existsSync(path7.join(root, f));
+  const has = (f) => fs12.existsSync(path8.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora25.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -9458,12 +10072,12 @@ function installSidecarPackage(root) {
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk48.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk48.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk49.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk49.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
   try {
-    const s = fs10.readFileSync(path7.join(root, ".env.local"), "utf8");
+    const s = fs12.readFileSync(path8.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -9471,16 +10085,16 @@ function readEnvKey(root) {
   }
 }
 function ensureGitignored(root) {
-  const p = path7.join(root, ".gitignore");
+  const p = path8.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs10.readFileSync(p, "utf8");
+    c = fs12.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs10.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs12.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path7.join("src", "instrumentation.ts")].map((c) => path7.join(root, c)).find((f) => fs10.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path8.join("src", "instrumentation.ts")].map((c) => path8.join(root, c)).find((f) => fs12.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -9488,18 +10102,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs10.writeFileSync(path7.join(root, "instrumentation.ts"), body);
+    fs12.writeFileSync(path8.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs10.readFileSync(existing, "utf8");
+  const cur = fs12.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs10.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs12.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs10.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs12.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -9578,17 +10192,17 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs10.existsSync(path7.join(root, "src", "pages")) ? path7.join(root, "src", "pages") : path7.join(root, "pages");
-      const f2 = path7.join(dir2, "abz-inspector.tsx");
-      fs10.writeFileSync(f2, INSPECTOR_PAGE);
-      return path7.relative(root, f2);
-    }
-    const base2 = fs10.existsSync(path7.join(root, "src", "app")) ? path7.join(root, "src", "app") : path7.join(root, "app");
-    const dir = path7.join(base2, "abz-inspector");
-    fs10.mkdirSync(dir, { recursive: true });
-    const f = path7.join(dir, "page.tsx");
-    fs10.writeFileSync(f, INSPECTOR_PAGE);
-    return path7.relative(root, f);
+      const dir2 = fs12.existsSync(path8.join(root, "src", "pages")) ? path8.join(root, "src", "pages") : path8.join(root, "pages");
+      const f2 = path8.join(dir2, "abz-inspector.tsx");
+      fs12.writeFileSync(f2, INSPECTOR_PAGE);
+      return path8.relative(root, f2);
+    }
+    const base2 = fs12.existsSync(path8.join(root, "src", "app")) ? path8.join(root, "src", "app") : path8.join(root, "app");
+    const dir = path8.join(base2, "abz-inspector");
+    fs12.mkdirSync(dir, { recursive: true });
+    const f = path8.join(dir, "page.tsx");
+    fs12.writeFileSync(f, INSPECTOR_PAGE);
+    return path8.relative(root, f);
   } catch {
     return null;
   }
@@ -9609,29 +10223,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk49.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk48.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk49.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk49.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk49.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk48.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk48.default.cyan("apiblaze login")}  then  ${import_chalk48.default.cyan("apiblaze claim")}   ${import_chalk48.default.dim("(no code needed here)")}`);
-  console.log(import_chalk48.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk49.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk49.default.cyan("apiblaze login")}  then  ${import_chalk49.default.cyan("apiblaze claim")}   ${import_chalk49.default.dim("(no code needed here)")}`);
+  console.log(import_chalk49.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
-  const root = path7.resolve(opts.dir ?? process.cwd());
+  const root = path8.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk48.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk49.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -9642,10 +10256,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk48.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk49.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk48.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk49.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -9668,38 +10282,38 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk48.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk49.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk48.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk49.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk48.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk49.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk48.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk48.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk48.default.bold("candidates")} \u2014 list them:  ${import_chalk48.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk48.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk49.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk49.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk49.default.bold("candidates")} \u2014 list them:  ${import_chalk49.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk49.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk48.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path7.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk48.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk49.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path8.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk49.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk48.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk48.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk48.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk49.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk49.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk49.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk48.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk48.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk49.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk49.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk49 = __toESM(require("chalk"));
+var import_chalk50 = __toESM(require("chalk"));
 var import_ora26 = __toESM(require("ora"));
 init_admin();
 init_resolve();
@@ -9710,7 +10324,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk49.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk50.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -9728,27 +10342,27 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk49.default.bold(`
+  console.log(import_chalk50.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk49.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk49.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk49.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk49.default.bold(`
+  if (!routed.length) console.log(import_chalk50.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk50.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk50.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk50.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk49.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk50.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk49.default.yellow("\u25CB")} ${c.origin}  ${import_chalk49.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk50.default.yellow("\u25CB")} ${c.origin}  ${import_chalk50.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk49.default.dim(`
+    console.log(import_chalk50.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk49.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk50.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk49.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk50.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
     const spinner2 = (0, import_ora26.default)(`Approving ${origin} (anonymous)...`).start();
@@ -9801,13 +10415,13 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk51 = __toESM(require("chalk"));
+var import_chalk52 = __toESM(require("chalk"));
 init_auth();
 init_trace();
 init_types();
 
 // src/commands/op-billing.ts
-var import_chalk50 = __toESM(require("chalk"));
+var import_chalk51 = __toESM(require("chalk"));
 init_admin();
 var SANDBOX = {
   teamId: "team_1782844865835_zujrf",
@@ -9866,7 +10480,7 @@ async function rowsForRays(project, version2, tenant2, rays) {
 }
 function printDoors(data) {
   const checks = [];
-  console.log(import_chalk50.default.bold("\n  Doors \u2014 is every way in metered?\n"));
+  console.log(import_chalk51.default.bold("\n  Doors \u2014 is every way in metered?\n"));
   const doors = data?.doors ?? [];
   const metered = doors.filter((d) => d.verdict === "metered");
   const allowed = doors.filter((d) => d.verdict === "allowed-free");
@@ -9875,29 +10489,29 @@ function printDoors(data) {
   const errs = data?.errors ?? [];
   const routeAuditBroke = errs.some((e) => e.startsWith("zone "));
   const devAuditBroke = errs.some((e) => e.startsWith("workers.dev audit"));
-  console.log(import_chalk50.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
-  for (const d of metered) console.log(import_chalk50.default.green(`      \u2713 ${d.pattern}`));
-  console.log(import_chalk50.default.dim(`
+  console.log(import_chalk51.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
+  for (const d of metered) console.log(import_chalk51.default.green(`      \u2713 ${d.pattern}`));
+  console.log(import_chalk51.default.dim(`
     ${allowed.length} route(s) free ON PURPOSE`));
   for (const d of allowed) {
-    console.log(import_chalk50.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-    console.log(import_chalk50.default.dim(`        ${d.why}`));
+    console.log(import_chalk51.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+    console.log(import_chalk51.default.dim(`        ${d.why}`));
   }
   if (known.length) {
-    console.log(import_chalk50.default.yellow(`
+    console.log(import_chalk51.default.yellow(`
     ${known.length} route(s) KNOWN OPEN \u2014 unmetered, not yet closed`));
     for (const d of known) {
-      console.log(import_chalk50.default.yellow(`      ! ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk50.default.dim(`        ${d.why}`));
+      console.log(import_chalk51.default.yellow(`      ! ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk51.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no known-open doors", status: "KNOWN", detail: `${known.length} unmetered route(s) still open \u2014 see above` });
   }
   if (stray.length) {
-    console.log(import_chalk50.default.red(`
+    console.log(import_chalk51.default.red(`
     ${stray.length} STRAY route(s) \u2014 not main-proxy, not on the allowlist`));
     for (const d of stray) {
-      console.log(import_chalk50.default.red(`      \u2717 ${d.pattern}`) + import_chalk50.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk50.default.dim(`        ${d.why}`));
+      console.log(import_chalk51.default.red(`      \u2717 ${d.pattern}`) + import_chalk51.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk51.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no stray routes", status: "FAIL", detail: `${stray.length}: ${stray.map((s) => s.pattern).join(", ")}` });
   } else if (routeAuditBroke) {
@@ -9908,22 +10522,22 @@ function printDoors(data) {
   const wd = data?.workers_dev ?? {};
   const open = wd.enabled ?? [];
   if (open.length) {
-    console.log(import_chalk50.default.red(`
+    console.log(import_chalk51.default.red(`
     ${open.length} of ${wd.total} worker(s) reachable on *.workers.dev`));
-    for (const s of open) console.log(import_chalk50.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk50.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
-    console.log(import_chalk50.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
+    for (const s of open) console.log(import_chalk51.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk51.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
+    console.log(import_chalk51.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
     checks.push({ name: "no workers.dev doors", status: "FAIL", detail: `${open.length} script(s) publicly reachable: ${open.map((s) => s.script).join(", ")}` });
   } else if (devAuditBroke || !wd.total) {
     checks.push({ name: "no workers.dev doors", status: "SKIP", detail: "script enumeration failed \u2014 NOT a pass, no subdomain was ever read. Needs a CF token with Workers Scripts:Read." });
   } else {
-    console.log(import_chalk50.default.green(`
+    console.log(import_chalk51.default.green(`
     \u2713 0 of ${wd.total} workers reachable on *.workers.dev`));
     checks.push({ name: "no workers.dev doors", status: "PASS", detail: `all ${wd.total} scripts have workers.dev + previews disabled` });
   }
-  if (data?.how_to_fix) console.log(import_chalk50.default.yellow(`
-    ${data.reason}`) + import_chalk50.default.dim(`
+  if (data?.how_to_fix) console.log(import_chalk51.default.yellow(`
+    ${data.reason}`) + import_chalk51.default.dim(`
     ${data.how_to_fix}`));
-  else for (const e of errs) console.log(import_chalk50.default.red(`
+  else for (const e of errs) console.log(import_chalk51.default.red(`
     audit error: ${e}`));
   if (errs.length) {
     checks.push({ name: "audit completeness", status: "FAIL", detail: `${errs.length} part(s) of the audit could not run \u2014 coverage is INCOMPLETE, and the checks they would have covered are SKIP above` });
@@ -9933,9 +10547,9 @@ function printDoors(data) {
 async function runMeter(readLedger, opts) {
   const checks = [];
   const N = Math.max(1, Math.min(10, opts.count ?? 3));
-  console.log(import_chalk50.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
+  console.log(import_chalk51.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
   const snap = await readLedger();
-  console.log(import_chalk50.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
+  console.log(import_chalk51.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
 `));
   const url = `https://${dpHost}/${SANDBOX.version}/${SANDBOX.environment}/`;
   const headers = opts.key ? { "X-API-Key": opts.key } : {};
@@ -10017,22 +10631,22 @@ async function runMeter(readLedger, opts) {
   return checks;
 }
 function printChecks(checks) {
-  console.log(import_chalk50.default.bold("\n  Results\n"));
-  const mark = { PASS: import_chalk50.default.green("  PASS"), FAIL: import_chalk50.default.red("  FAIL"), SKIP: import_chalk50.default.dim("  SKIP"), KNOWN: import_chalk50.default.yellow(" KNOWN") };
+  console.log(import_chalk51.default.bold("\n  Results\n"));
+  const mark = { PASS: import_chalk51.default.green("  PASS"), FAIL: import_chalk51.default.red("  FAIL"), SKIP: import_chalk51.default.dim("  SKIP"), KNOWN: import_chalk51.default.yellow(" KNOWN") };
   for (const ch of checks) {
-    console.log(`  ${mark[ch.status]}  ${import_chalk50.default.bold(ch.name)}`);
-    console.log(import_chalk50.default.dim(`          ${ch.detail}`));
+    console.log(`  ${mark[ch.status]}  ${import_chalk51.default.bold(ch.name)}`);
+    console.log(import_chalk51.default.dim(`          ${ch.detail}`));
   }
   const fails = checks.filter((c) => c.status === "FAIL").length;
   const skips = checks.filter((c) => c.status === "SKIP").length;
   const known = checks.filter((c) => c.status === "KNOWN").length;
   console.log("");
   const passes = checks.filter((c) => c.status === "PASS").length;
-  if (fails) console.log(import_chalk50.default.red(`  ${fails} check(s) FAILED.`));
-  else if (passes) console.log(import_chalk50.default.green(`  ${passes} check(s) passed, 0 failed.`));
-  else console.log(import_chalk50.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
-  if (known) console.log(import_chalk50.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
-  if (skips) console.log(import_chalk50.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
+  if (fails) console.log(import_chalk51.default.red(`  ${fails} check(s) FAILED.`));
+  else if (passes) console.log(import_chalk51.default.green(`  ${passes} check(s) passed, 0 failed.`));
+  else console.log(import_chalk51.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
+  if (known) console.log(import_chalk51.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
+  if (skips) console.log(import_chalk51.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
   console.log("");
 }
 
@@ -10079,93 +10693,93 @@ var OP_COMMANDS = [
 function renderOpCommands() {
   const width = Math.max(...OP_COMMANDS.map((c) => c.cmd.length)) + 10;
   const lines = OP_COMMANDS.map((c) => {
-    const left = `  ${import_chalk51.default.cyan(`apiblaze ${c.cmd}`)}`;
+    const left = `  ${import_chalk52.default.cyan(`apiblaze ${c.cmd}`)}`;
     const pad = " ".repeat(Math.max(1, width - c.cmd.length));
-    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk51.default.dim(`(${c.extra})`) : ""}`;
+    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk52.default.dim(`(${c.extra})`) : ""}`;
   });
   return [
-    import_chalk51.default.bold("Operator commands"),
+    import_chalk52.default.bold("Operator commands"),
     ...lines,
     "",
-    import_chalk51.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
-    import_chalk51.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
-    import_chalk51.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
+    import_chalk52.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
+    import_chalk52.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
+    import_chalk52.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
     "",
-    import_chalk51.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
-    import_chalk51.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
-    import_chalk51.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
+    import_chalk52.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
+    import_chalk52.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
+    import_chalk52.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
   ].join("\n");
 }
 function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk51.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk51.default.bold("\n  Upstash"));
+  console.log(import_chalk52.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk52.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk51.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk51.default.yellow(o.key)} ${import_chalk51.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk51.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk52.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk52.default.yellow(o.key)} ${import_chalk52.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk52.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk51.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk52.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk51.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk52.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk51.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk51.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
-  console.log(import_chalk51.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk52.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk52.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
+  console.log(import_chalk52.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk51.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk52.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk51.default.yellow(s.store_id)} ${import_chalk51.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk52.default.yellow(s.store_id)} ${import_chalk52.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk51.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk52.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk51.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk52.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk51.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk52.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk51.default.yellow(s.store_id)} ${import_chalk51.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk52.default.yellow(s.store_id)} ${import_chalk52.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk51.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk52.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk51.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk52.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
-  console.log(import_chalk51.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
+  console.log(import_chalk52.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk51.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk51.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk51.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk52.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk52.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk52.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk51.default.green(`    no ghost tuples ${import_chalk51.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk52.default.green(`    no ghost tuples ${import_chalk52.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk51.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk52.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk51.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk52.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk51.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk52.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk51.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk52.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}, view) {
   if (!loadCredentials()) {
-    console.log(import_chalk51.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk52.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk51.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk52.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
@@ -10191,17 +10805,17 @@ async function runOp(sub, opts = {}, view) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk51.default.green("Nothing to sweep."));
+        console.log(import_chalk52.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline3 = await import("readline/promises");
         const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk51.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk52.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk51.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk52.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -10211,25 +10825,25 @@ async function runOp(sub, opts = {}, view) {
     case "mark": {
       const label3 = (view ?? "").trim();
       if (!label3) {
-        console.log(import_chalk51.default.red("Give the change a name:") + import_chalk51.default.cyan(' apiblaze op mark "cached tenant count"'));
+        console.log(import_chalk52.default.red("Give the change a name:") + import_chalk52.default.cyan(' apiblaze op mark "cached tenant count"'));
         return;
       }
       const res = await opCall({ method: "POST", path: "/operator/latency/mark", body: { label: label3 }, summary: "record change marker" });
       const ts = new Date(res?.marker?.ts ?? Date.now()).toISOString();
-      console.log(import_chalk51.default.green(`
-  Marked: `) + import_chalk51.default.bold(label3));
-      console.log(import_chalk51.default.dim(`  ${ts}`));
-      console.log(import_chalk51.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk51.default.cyan("apiblaze op latency compare") + "\n");
+      console.log(import_chalk52.default.green(`
+  Marked: `) + import_chalk52.default.bold(label3));
+      console.log(import_chalk52.default.dim(`  ${ts}`));
+      console.log(import_chalk52.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk52.default.cyan("apiblaze op latency compare") + "\n");
       return;
     }
     case "credits": {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk51.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk52.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk51.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk51.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk51.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk52.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk52.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk52.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
@@ -10240,7 +10854,7 @@ async function runOp(sub, opts = {}, view) {
     case "billing": {
       const which = (view ?? "").trim().toLowerCase();
       if (which && which !== "doors" && which !== "meter") {
-        return void console.log(import_chalk51.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
+        return void console.log(import_chalk52.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
       }
       const checks = [];
       let doorsData = null;
@@ -10301,29 +10915,29 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/grades${q}`, summary: "latency grades" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const t = data.thresholds_ms;
-        console.log(import_chalk51.default.bold("\nHow good was apiblaze itself?") + import_chalk51.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
-        console.log(import_chalk51.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
+        console.log(import_chalk52.default.bold("\nHow good was apiblaze itself?") + import_chalk52.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
+        console.log(import_chalk52.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
 `));
-        console.log(import_chalk51.default.dim("  date         reqs   excellent      okay       bad  terrible"));
+        console.log(import_chalk52.default.dim("  date         reqs   excellent      okay       bad  terrible"));
         for (const d of data.days ?? []) {
           const p = d.pct;
-          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk51.default.dim(`${String(v).padStart(5)}%`);
+          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk52.default.dim(`${String(v).padStart(5)}%`);
           console.log(
-            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk51.default.green)}  ${cell(p.okay, import_chalk51.default.cyan)}  ${cell(p.bad, import_chalk51.default.yellow)}  ${cell(p.terrible, import_chalk51.default.red)}`
+            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk52.default.green)}  ${cell(p.okay, import_chalk52.default.cyan)}  ${cell(p.bad, import_chalk52.default.yellow)}  ${cell(p.terrible, import_chalk52.default.red)}`
           );
         }
         const cul = data.culprits ?? [];
         if (cul.length) {
-          console.log(import_chalk51.default.bold("\n  Who caused the bad and terrible ones\n"));
-          console.log(import_chalk51.default.dim("     bad  terrible  feature \u2192 dependency"));
+          console.log(import_chalk52.default.bold("\n  Who caused the bad and terrible ones\n"));
+          console.log(import_chalk52.default.dim("     bad  terrible  feature \u2192 dependency"));
           for (const r of cul.slice(0, 12)) {
             if (!r.bad && !r.terrible) continue;
             console.log(
-              `  ${String(r.bad).padStart(6)}  ${import_chalk51.default.red(String(r.terrible).padStart(8))}  ${import_chalk51.default.yellow(r.feature)} ${import_chalk51.default.dim("\u2192")} ${import_chalk51.default.cyan(r.dep)}`
+              `  ${String(r.bad).padStart(6)}  ${import_chalk52.default.red(String(r.terrible).padStart(8))}  ${import_chalk52.default.yellow(r.feature)} ${import_chalk52.default.dim("\u2192")} ${import_chalk52.default.cyan(r.dep)}`
             );
           }
         }
-        if (data.caveat) console.log(import_chalk51.default.dim(`
+        if (data.caveat) console.log(import_chalk52.default.dim(`
   \u26A0 ${data.caveat}
 `));
         return;
@@ -10332,24 +10946,24 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/compare${q}`, summary: "latency before/after" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const b = data.before, a = data.after, d = data.delta;
-        console.log(import_chalk51.default.bold(`
-Before vs after: `) + import_chalk51.default.cyan(data.marker.label));
-        console.log(import_chalk51.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
+        console.log(import_chalk52.default.bold(`
+Before vs after: `) + import_chalk52.default.cyan(data.marker.label));
+        console.log(import_chalk52.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
 `));
         const row = (name, before, after, delta) => {
           const arrow = delta === 0 ? "=" : delta < 0 ? "\u2193" : "\u2191";
           const txt = `${String(before).padStart(6)}ms  \u2192${String(after).padStart(7)}ms   ${arrow}${Math.abs(delta)}ms`;
-          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk51.default.green(txt) : import_chalk51.default.red(txt) : import_chalk51.default.dim(txt)}`);
+          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk52.default.green(txt) : import_chalk52.default.red(txt) : import_chalk52.default.dim(txt)}`);
         };
-        console.log(import_chalk51.default.dim("  metric                 before        after      change"));
+        console.log(import_chalk52.default.dim("  metric                 before        after      change"));
         row("total p50", b.total_p50, a.total_p50, d.total_p50);
         row("total p95", b.total_p95, a.total_p95, d.total_p95);
         row("apiblaze overhead p50", b.gw_p50, a.gw_p50, d.gw_p50);
         row("apiblaze overhead p95", b.gw_p95, a.gw_p95, d.gw_p95);
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   requests: ${b.requests} before \xB7 ${a.requests} after`));
         for (const w of data.warnings ?? []) {
-          console.log((data.trustworthy ? import_chalk51.default.dim : import_chalk51.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
+          console.log((data.trustworthy ? import_chalk52.default.dim : import_chalk52.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
         }
         console.log("");
         return;
@@ -10358,19 +10972,19 @@ Before vs after: `) + import_chalk51.default.cyan(data.marker.label));
         const data = await opCall({ method: "GET", path: `/operator/latency/slow${q}`, summary: "slowest requests" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk51.default.dim("No requests over the threshold in that window."));
-        console.log(import_chalk51.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk52.default.dim("No requests over the threshold in that window."));
+        console.log(import_chalk52.default.bold(`
 Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
 `));
-        console.log(import_chalk51.default.dim("  total   ours   theirs  blame                 request id"));
+        console.log(import_chalk52.default.dim("  total   ours   theirs  blame                 request id"));
         for (const r of rows2.slice(0, 30)) {
           console.log(
-            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk51.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk51.default.dim(r.request_id || "")}`
+            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk52.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk52.default.dim(r.request_id || "")}`
           );
         }
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   The last column is the request id (Cloudflare calls it a "cf-ray"). Look one up with`));
-        console.log(import_chalk51.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
+        console.log(import_chalk52.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
 `));
         return;
       }
@@ -10378,17 +10992,18 @@ Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
         const data = await opCall({ method: "GET", path: `/operator/latency/llm${q}`, summary: "llm latency" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk51.default.dim("No LLM traffic in that window."));
-        console.log(import_chalk51.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk52.default.dim("No LLM traffic in that window."));
+        console.log(import_chalk52.default.bold(`
 LLM timing \u2014 last ${data.window_hours}h
 `));
-        console.log(import_chalk51.default.dim("  requests   gen p95   reserve p95   in/out tokens p95   model"));
+        console.log(import_chalk52.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
         for (const r of rows2) {
+          const n = r.turns ?? r.requests ?? 0;
           console.log(
-            `  ${String(Math.round(r.requests)).padStart(8)}   ${String(Math.round(r.gen_p95_ms)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95)).padStart(6)}/${String(Math.round(r.output_tokens_p95)).padEnd(6)}   ${r.model || "-"}`
+            `  ${String(Math.round(n)).padStart(8)}   ${String(Math.round(r.turn_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.ttfc_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.gen_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms ?? 0)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95 ?? 0)).padStart(6)}/${String(Math.round(r.output_tokens_p95 ?? 0)).padEnd(6)}   ${r.model || "-"}`
           );
         }
-        console.log(import_chalk51.default.dim(`
+        console.log(import_chalk52.default.dim(`
   ${data.note}
 `));
         return;
@@ -10399,26 +11014,26 @@ LLM timing \u2014 last ${data.window_hours}h
       ]);
       if (opts.json) return void console.log(JSON.stringify({ blame, summary }, null, 2));
       const ov = summary?.apiblaze_overhead_ms ?? {};
-      console.log(import_chalk51.default.bold(`
+      console.log(import_chalk52.default.bold(`
 Latency \u2014 last ${summary?.window_hours ?? "?"}h, ${Number(summary?.requests ?? 0).toLocaleString()} requests
 `));
-      console.log(`  ${import_chalk51.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk51.default.dim("\u2190 ours")}`);
-      console.log(`  ${import_chalk51.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk51.default.dim("\u2190 theirs")}`);
-      console.log(import_chalk51.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
+      console.log(`  ${import_chalk52.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk52.default.dim("\u2190 ours")}`);
+      console.log(`  ${import_chalk52.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk52.default.dim("\u2190 theirs")}`);
+      console.log(import_chalk52.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
 `));
       const rows = blame?.blame ?? [];
-      if (!rows.length) return void console.log(import_chalk51.default.dim("No latency rows in that window."));
-      console.log(import_chalk51.default.bold("  Which feature ate the time, and what inside it\n"));
-      console.log(import_chalk51.default.dim("   share   p95      feature \u2192 dependency"));
+      if (!rows.length) return void console.log(import_chalk52.default.dim("No latency rows in that window."));
+      console.log(import_chalk52.default.bold("  Which feature ate the time, and what inside it\n"));
+      console.log(import_chalk52.default.dim("   share   p95      feature \u2192 dependency"));
       for (const r of rows.slice(0, 15)) {
         const share = `${(r.share * 100).toFixed(1)}%`;
-        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk51.default.yellow(r.feature)} ${import_chalk51.default.dim("\u2192")} ${import_chalk51.default.cyan(r.dep)}`);
+        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk52.default.yellow(r.feature)} ${import_chalk52.default.dim("\u2192")} ${import_chalk52.default.cyan(r.dep)}`);
       }
       console.log("");
       return;
     }
     default:
-      console.log(import_chalk51.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk52.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -10451,7 +11066,7 @@ program.command("login").description("Authenticate with APIblaze").option("--tea
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url>", "Target URL to forward requests to").option("--openapi <file|url>", "Create FROM an OpenAPI spec instead of --target \u2014 a local file or a URL (e.g. https://pokeapi.co/openapi.yaml). Routes, API version and environments (one per `servers` entry) all come from the spec").option("--openapispec <file|url>", "Alias for --openapi").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -10464,7 +11079,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Author an object-level access rule in plain English, in one shot (billed per turn)").argument("<rule>", 'The rule in plain English, e.g. "users see only their own rows"').argument("<project>", "Project name or id").option("--enforce", "Turn enforcement on immediately (default: shadow-publish only)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((rule, project, opts) => runRule(rule, project, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("apichat").description("Turn any API into a chat: point at an OpenAPI spec and start asking questions (no login needed)").option("--openapi <file|url>", "OpenAPI/Swagger spec to build from (JSON or YAML; file path or URL)").option("--openapispec <file|url>", "Alias for --openapi").option("--target <url>", "Upstream base URL (overrides servers[0].url; enables spec discovery when --openapi is omitted)").option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").action(action((opts) => runApichat({ ...opts, openapispec: opts.openapispec ?? opts.openapi })));
+program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").option("-p, --prompt <question>", "One-shot question piped through the external agent CLI after the MCP install (used with --install-mcp or the install offer)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
 llm.command("show").description("Show the locally stored LLM key (masked)").action(action(() => runLlmShow()));
@@ -10481,7 +11096,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk52.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk53.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, project: opts.project, yes: opts.yes, captureFile: opts.captureFile, newSession: opts.newSession });
@@ -10613,7 +11228,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk52.default.bold(g.title)}
+    return `${import_chalk53.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -10651,14 +11266,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk52.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk53.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk52.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk52.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk53.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk53.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -10666,16 +11281,16 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk52.default.red(`
+    console.error(import_chalk53.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk52.default.red(`
+    console.error(import_chalk53.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk52.default.red("\nUnknown error"));
+    console.error(import_chalk53.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);