apiblaze 0.21.21 → 0.21.23

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.21";
+    version = "0.21.23";
   }
 });
 
@@ -5734,8 +5734,6 @@ async function printDevOutcome(o, port) {
   const where = { tenant: o.tenant, anon: o.anon };
   const rest = restUrl(o.name, o.version, o.env, where);
   const agents = o.anon ? mcpUrl(o.name, o.version, o.env, where) : `https://${mcpHost(o.name, o.tenant)}/${o.version}/${o.env}`;
-  const first = BRAND === "mcpblaze" ? agents : rest;
-  const third = BRAND === "mcpblaze" ? `REST API: ${import_chalk19.default.bold(rest)}` : `agents: ${import_chalk19.default.bold(agents)}`;
   const s = o.secure;
   const applied = s?.applied ?? [];
   const locked = (o.families ?? []).filter((f) => applied.includes(f.key));
@@ -5753,24 +5751,19 @@ async function printDevOutcome(o, port) {
     spinner.stop();
     admin2 = await addAdmin(o.adminEmail, o.tenant, o.teamId);
   }
+  const lockedPhrase = applied.length && s?.enforced ? `${describeFamilies(applied)} locked to their creator` : applied.length && s?.pending ? `${describeFamilies(applied)} rules being applied` : s && !s.enforced && s.errors?.length ? import_chalk19.default.yellow(`rules not applied (${s.errors.join("; ")})`) : "no rules yet (needs a spec)";
+  const adminBit = o.adminEmail ? admin2 ? `${o.adminEmail} is admin${admin2.active ? "" : " (on first sign-in)"}` : import_chalk19.default.yellow(`could not add ${o.adminEmail} as admin`) : "";
+  const restLine = `    ${import_chalk19.default.dim("API ")}  ${import_chalk19.default.bold(rest)}   ${import_chalk19.default.dim(doorsPhrase(o.auth))}`;
+  const mcpLine = `    ${import_chalk19.default.dim("MCP ")}  ${import_chalk19.default.bold(agents)}   ${import_chalk19.default.dim("paste into Claude, ChatGPT or Cursor")}`;
   console.log();
-  console.log(`  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold(first)}  \u2192 localhost:${port}   ${import_chalk19.default.dim(`(${doorsPhrase(o.auth)})`)}`);
-  const adminBit = o.adminEmail ? admin2 ? ` \xB7 ${import_chalk19.default.bold(o.adminEmail)} is admin${admin2.active ? "" : " (active on first sign-in)"}` : ` \xB7 ${import_chalk19.default.yellow(`could not add ${o.adminEmail} as admin`)}` : "";
-  if (applied.length && s?.enforced) {
-    console.log(`  ${import_chalk19.default.green("\u2713")} ${describeFamilies(applied)} locked to their creator${s.skipped?.length ? ` (${s.skipped.length} skipped)` : ""}${adminBit}`);
-  } else if (applied.length && s?.pending) {
-    console.log(`  ${import_chalk19.default.green("\u2713")} ${describeFamilies(applied)}: rules are being applied \u2014 check with ${import_chalk19.default.cyan(`${B.cli} rule ${o.name}`)} in a minute${adminBit}`);
-  } else if (s && !s.enforced && s.errors?.length) {
-    console.log(`  ${import_chalk19.default.yellow("\u26A0")} ${import_chalk19.default.yellow(`not locked \u2014 ${s.errors.join("; ")}`)}${adminBit}`);
-  } else {
-    console.log(`  ${import_chalk19.default.dim("\u2013")} ${import_chalk19.default.dim(`nothing locked \u2014 every caller who gets in can reach every route (npx ${B.cli} rule ${o.name} once you have a spec)`)}${adminBit}`);
-  }
-  console.log(`  ${import_chalk19.default.green("\u2713")} ${third}`);
-  if (!o.adminEmail) console.log(`  ${import_chalk19.default.dim("\u2013")} ${import_chalk19.default.dim(`no admin yet \u2014 npx ${B.cli} admins add you@example.com --tenant ${o.tenant ?? "<tenant>"}`)}`);
+  console.log(`  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold(`localhost:${port} is live on the internet`)}`);
+  console.log(BRAND === "mcpblaze" ? mcpLine : restLine);
+  console.log(BRAND === "mcpblaze" ? restLine : mcpLine);
   if (o.auth.doors.includes("api_key") && o.apiKey) {
-    console.log();
-    console.log(`  ${import_chalk19.default.dim("API key (backend key, for your frontend-server, shown once):")} ${import_chalk19.default.bold.green(o.apiKey)}   ${import_chalk19.default.dim("\u2192 send it as X-API-Key and say who is calling with X-End-User-Id")}`);
+    console.log(`    ${import_chalk19.default.dim("Key ")}  ${import_chalk19.default.bold.green(o.apiKey)}   ${import_chalk19.default.dim("shown once \xB7 your server sends it as X-API-Key, naming the user in X-End-User-Id")}`);
   }
+  console.log(`    ${import_chalk19.default.dim("Included")}  ${["API keys", "sign-in", lockedPhrase, "rate limits", adminBit].filter(Boolean).join(import_chalk19.default.dim(" \xB7 "))}`);
+  if (isVerbose() && !o.adminEmail) console.log(import_chalk19.default.dim(`    No admin yet: npx ${B.cli}@latest admins add you@example.com --tenant ${o.tenant ?? "<tenant>"}`));
   const okLines = agentPrompts(locked, o.openapi, null).filter((l) => l.ok);
   const tryHint = okLines[1]?.say ?? okLines[0]?.say;
   await connectAgentStep({
@@ -6320,6 +6313,7 @@ var init_create = __esm({
     init_apichat();
     import_yaml4 = require("yaml");
     import_chalk19 = __toESM(require("chalk"));
+    init_trace();
     import_ora6 = __toESM(require("ora"));
     init_auth();
     init_api();
@@ -6371,340 +6365,186 @@ var init_files = __esm({
   "src/demo-app/files.ts"() {
     "use strict";
     DEMO_FILES = {
-      "README.md": "# ResiResi: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Without APIblaze.** The app uses one shared password, so Ben can cancel Ana's booking.\n2. **With APIblaze.** Same app, unchanged. Ben tries again and is blocked: only the person who made\n   a booking can change it.\n3. **An AI assistant.** It uses the same app, under the same rules, and cannot cancel Ana's booking either.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | The list of endpoints. APIblaze reads it to work out who may change what. |\n| `app.js` | The website's server. It calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\nStop the demo with `npx apiblaze@latest demo stop`.\n",
-      "openapi.yaml": "openapi: 3.0.3\ninfo:\n  title: ResiResi API\n  version: 1.0.0\n  description: Table bookings for a pizzeria. This file is all APIblaze reads to decide who may do what.\npaths:\n  /reservations:\n    get:\n      operationId: listReservations\n      summary: List my bookings\n      responses:\n        '200':\n          description: The caller's bookings\n          content:\n            application/json:\n              schema:\n                type: array\n                items: { $ref: '#/components/schemas/Reservation' }\n    post:\n      operationId: createReservation\n      summary: Book a table\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema: { $ref: '#/components/schemas/NewReservation' }\n      responses:\n        '201':\n          description: Booked\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n  /reservations/{id}:\n    parameters:\n      - { name: id, in: path, required: true, schema: { type: string } }\n    get:\n      operationId: getReservation\n      summary: Get one booking\n      responses:\n        '200':\n          description: The booking\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n    delete:\n      operationId: cancelReservation\n      summary: Cancel a booking\n      responses:\n        '204': { description: Cancelled }\ncomponents:\n  schemas:\n    NewReservation:\n      type: object\n      required: [name, table, time]\n      properties:\n        name: { type: string, example: Ana }\n        table: { type: integer, example: 4 }\n        time: { type: string, example: '19:30' }\n    Reservation:\n      allOf:\n        - $ref: '#/components/schemas/NewReservation'\n        - type: object\n          properties:\n            id: { type: string, example: r1 }\n",
-      "backend.js": `// The pizzeria's backend: book, list and cancel tables.
-//
-// Look at what is NOT here: no login, no API keys, no "is this your booking?"
-// check, no AI code. APIblaze sits in front of this file and does all of that.
-// The only things this backend knows about people are two headers APIblaze adds
-// to every call it lets through: x-abz-tenant-id, "which pizzeria", and
-// x-abz-user-id, "who is asking".
-//
-// Two doors, so the demo can show the difference:
-//   /before/...  the way most apps ship: one shared password, anyone holding it can do anything.
-//   /...         behind APIblaze: every call names its person, and APIblaze decides.
-//
-// Zero dependencies. Run it alone with \`node backend.js\` (port 3001).
-
-const http = require('http');
-
-const PASSWORD = 'pizza123'; // the "before" app's shared secret
-const stores = { before: new Map(), after: new Map() };
-let next = 1;
-
-function send(res, status, body) {
-  res.writeHead(status, { 'content-type': 'application/json' });
-  res.end(body === undefined ? '' : JSON.stringify(body));
-}
-
-function handle(req, res, body) {
-  const url = new URL(req.url, 'http://x');
-  let path = url.pathname;
-  let door = 'after';
-  if (path.startsWith('/before/')) { door = 'before'; path = path.slice('/before'.length); }
-
-  if (path === '/openapi.yaml') {
-    res.writeHead(200, { 'content-type': 'text/yaml' });
-    return res.end(require('fs').readFileSync(require('path').join(__dirname, 'openapi.yaml')));
-  }
-
-  const who = req.headers['x-abz-user-id'] || '';
-  const tenant = req.headers['x-abz-tenant-id'] || '';
-  if (door === 'before' && req.headers['x-demo-password'] !== PASSWORD) return send(res, 401, { error: 'wrong password' });
-  if (door === 'after' && !who) return send(res, 401, { error: 'only APIblaze may call this door' });
-
-  const db = stores[door];
-  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(path);
-  if (!m) return send(res, 404, { error: 'not found' });
-  const id = m[1];
-
-  if (!id && req.method === 'POST') {
-    let input = {};
-    try { input = JSON.parse(body || '{}'); } catch { return send(res, 400, { error: 'body must be JSON' }); }
-    const row = { id: \`r\${next++}\`, name: String(input.name || 'Guest'), table: Number(input.table) || 1, time: String(input.time || '19:30'), owner: who || null, tenant: tenant || null };
-    db.set(row.id, row);
-    return send(res, 201, row);
-  }
-  if (!id && req.method === 'GET') {
-    // Lists are the backend's job: show each person their own bookings, in their
-    // own pizzeria. ("ana" at Nino Pizza and "ana" at Gino Pizza are two people.)
-    const rows = [...db.values()].filter((r) => door === 'before' || (r.owner === who && r.tenant === tenant));
-    return send(res, 200, rows);
-  }
-  const row = db.get(id);
-  if (!row) return send(res, 404, { error: 'no such booking' });
-  if (req.method === 'GET') return send(res, 200, row);
-  if (req.method === 'DELETE') { db.delete(id); return send(res, 204); }
-  return send(res, 405, { error: 'method not allowed' });
-}
-
-function startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {
-  const server = http.createServer((req, res) => {
-    let body = '';
-    req.on('data', (c) => { body += c; });
-    req.on('end', () => {
-      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String(e && e.message || e) }); }
-    });
-  });
-  return new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(port, '127.0.0.1', () => resolve(server));
-  });
-}
-
-module.exports = { startBackend, PASSWORD };
-if (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));
-`,
-      "app.js": "// The pizzeria's website server. It serves the page and makes the calls for it.\n//\n//   \"Before\" calls go straight to the backend with the shared password.\n//   \"After\"  calls go through APIblaze with ONE server key, and say who is\n//            acting with X-End-User-Id. The browser never sees the key.\n//\n// That is the whole integration: a URL, a key, and a header naming the person.\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst { PASSWORD } = require('./backend');\n\nfunction env(name, fallback = '') { return process.env[name] || fallback; }\n\nfunction json(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(JSON.stringify(body));\n}\n\nconst mask = (k) => (k ? `${k.slice(0, 7)}\u2022\u2022\u2022\u2022${k.slice(-4)}` : '');\n\nasync function call(door, as, op, id, extra) {\n  const backend = `http://127.0.0.1:${env('BACKEND_PORT', '3001')}`;\n  const base = door === 'before' ? `${backend}/before` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (door === 'before') headers['x-demo-password'] = PASSWORD;\n  else {\n    // Each pizzeria has its own key. \"after\" = Nino Pizza's key, \"gino\" = Gino Pizza's key.\n    headers['x-api-key'] = door === 'gino' ? env('APIBLAZE_GINO_KEY') : env('APIBLAZE_SERVER_KEY');\n    headers['x-end-user-id'] = as;\n  }\n  const who = { ana: 'Ana', ben: 'Ben' }[as] || as;\n  const req = op === 'book'\n    ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: who, table: (extra && extra.table) || 4, time: (extra && extra.time) || '19:30' }) }\n    : op === 'cancel'\n      ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : op === 'open'\n        ? { method: 'GET', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n        : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let body = null;\n  try { body = text ? JSON.parse(text) : null; } catch { body = text; }\n  return { status: r.status, body };\n}\n\nasync function relayChat(req, res, raw) {\n  let input;\n  try { input = JSON.parse(raw || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }\n  const mcp = env('APIBLAZE_MCP_URL').replace(/\\/$/, '');\n  if (!mcp) return json(res, 503, { error: 'The assistant is not set up. Run: npx apiblaze@latest demo' });\n  const upstream = await fetch(`${mcp}/runtime-chat`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', 'x-api-key': env('APIBLAZE_SERVER_KEY'), 'x-end-user-id': String(input.as || 'ben') },\n    body: JSON.stringify({ id: String(input.id || Date.now()), trigger: 'submit-message', messages: input.messages || [] }),\n  });\n  res.writeHead(upstream.status, { 'content-type': upstream.headers.get('content-type') || 'application/json', 'cache-control': 'no-cache' });\n  if (!upstream.body) return res.end();\n  const reader = upstream.body.getReader();\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    res.write(Buffer.from(value));\n  }\n  res.end();\n}\n\nfunction startApp(port = Number(env('APP_PORT', '3000'))) {\n  const page = path.join(__dirname, 'public', 'index.html');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(page));\n        }\n        if (url.pathname === '/api/config') {\n          return json(res, 200, {\n            name: env('APIBLAZE_NAME'), apiUrl: env('APIBLAZE_URL'), mcpUrl: env('APIBLAZE_MCP_URL'),\n            key: mask(env('APIBLAZE_SERVER_KEY')),\n            ginoKey: mask(env('APIBLAZE_GINO_KEY')),\n          });\n        }\n        if (req.method === 'POST' && url.pathname === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          const door = ['before', 'gino'].includes(b.door) ? b.door : 'after';\n          return json(res, 200, await call(door, String(b.as || 'ana'), String(b.op || 'list'), b.id, b));\n        }\n        if (req.method === 'POST' && url.pathname === '/api/chat') return relayChat(req, res, raw);\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String(e && e.message || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
+      "README.md": "# Nino's Pizza: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Your API is live on the internet.** The backend runs on your laptop; APIblaze gives it a public\n   URL and an MCP address for AI assistants. A live ticker shows each request reaching your laptop.\n2. **An AI assistant uses it.** Ask it to book a table and watch the request arrive.\n3. **Included, no code:** only the owner can change a booking, each customer (Nino Pizza,\n   Gino Pizza) is separate, rate limits, sign-in, and drop-in widgets for API keys and roles.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | Its endpoints. APIblaze builds the AI tools and the ownership rules from it. |\n| `app.js` | The website's server. Calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\n`npx apiblaze@latest demo` also adds `lib/apiblaze-server.js` and `public/apiblaze-widgets.js`, the same\nhelpers you get from `npm i apiblaze`. Stop the demo with `npx apiblaze@latest demo stop`.\n",
+      "openapi.yaml": "openapi: 3.0.3\ninfo:\n  title: Nino's Pizza API\n  version: 1.0.0\n  description: Table bookings at Nino's Pizza. APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.\npaths:\n  /reservations:\n    get:\n      operationId: listReservations\n      summary: List my bookings\n      responses:\n        '200':\n          description: The caller's bookings\n          content:\n            application/json:\n              schema:\n                type: array\n                items: { $ref: '#/components/schemas/Reservation' }\n    post:\n      operationId: createReservation\n      summary: Book a table\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema: { $ref: '#/components/schemas/NewReservation' }\n      responses:\n        '201':\n          description: Booked\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n  /reservations/{id}:\n    parameters:\n      - { name: id, in: path, required: true, schema: { type: string } }\n    get:\n      operationId: getReservation\n      summary: Get one booking\n      responses:\n        '200':\n          description: The booking\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n    delete:\n      operationId: cancelReservation\n      summary: Cancel a booking\n      responses:\n        '204': { description: Cancelled }\ncomponents:\n  schemas:\n    NewReservation:\n      type: object\n      required: [name, table, time]\n      properties:\n        name: { type: string, example: Ana }\n        table: { type: integer, example: 4 }\n        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }\n        guests: { type: integer, example: 2, description: 'How many people' }\n    Reservation:\n      allOf:\n        - $ref: '#/components/schemas/NewReservation'\n        - type: object\n          properties:\n            id: { type: string, example: r1 }\n",
+      "backend.js": "// Nino's Pizza backend: book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  if (!who) return reply(401, { error: 'calls come through APIblaze, which says who is calling' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || 1,\n      time: String(input.time || '19:30'), guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row);\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'DELETE') { bookings.delete(id); return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "app.js": "// Nino's Pizza website server: serves the page and makes its calls.\n//\n// Every call goes through APIblaze with ONE server key (kept here, never in the\n// browser) and says who is acting with X-End-User-Id. The chat and the two\n// widgets use apiblaze's own server helpers (lib/apiblaze-server.js, copied in by\n// `npx apiblaze@latest demo` \u2014 the same code as `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\nconst mask = (k) => (k ? `${k.slice(0, 7)}\u2022\u2022\u2022\u2022${k.slice(-4)}` : '');\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// Who is using the page. A real app takes this from its own login; the demo lets you switch.\n//   App tab:   ana, ben  \u2014 customers of Nino Pizza\n//   Admin tab: ana       \u2014 admin of Nino Pizza;  gina \u2014 admin of Gino Pizza\nconst PEOPLE = {\n  ana: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example', tenant: () => env('APIBLAZE_TENANT') },\n  ben: { userId: 'ben', label: 'Ben', email: 'ben@ninopizza.example', tenant: () => env('APIBLAZE_TENANT') },\n  gina: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example', tenant: () => env('APIBLAZE_GINO_TENANT') },\n};\nfunction personOf(req) {\n  const as = new URL(req.url, 'http://x').searchParams.get('as') || 'ana';\n  return PEOPLE[as] || PEOPLE.ana;\n}\n\nasync function call(op, { as = 'ana', id, key = 'nino', body } = {}) {\n  const base = env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = {\n    'content-type': 'application/json',\n    'x-api-key': key === 'gino' ? env('APIBLAZE_GINO_KEY') : env('APIBLAZE_SERVER_KEY'),\n    'x-end-user-id': as,\n  };\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify(body || { name: (PEOPLE[as] || PEOPLE.ana).label, table: 4, time: '19:30', guests: 2 }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : op === 'open' ? { method: 'GET', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n        : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = {};\n  out.chat = lib.createApiblazeChat({\n    project: `${env('APIBLAZE_NAME')}-${env('APIBLAZE_TENANT')}`, apiKey: env('APIBLAZE_SERVER_KEY'),\n    host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: personOf(req).userId }),\n  });\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    const user = (req) => { const p = personOf(req); return { tenant: p.tenant(), userId: p.userId, email: p.email, label: p.label }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: user });\n  }\n  return out;\n}\n\nfunction startApp(port = Number(env('APP_PORT', '3000'))) {\n  const w = widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        if (req.method === 'GET' && p === '/apiblaze-widgets.js' && fs.existsSync(path.join(pub, 'apiblaze-widgets.js'))) {\n          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'apiblaze-widgets.js')));\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            name: env('APIBLAZE_NAME'), apiUrl: env('APIBLAZE_URL'), mcpUrl: env('APIBLAZE_MCP_URL'),\n            portalUrl: env('APIBLAZE_PORTAL_URL'), gino: !!env('APIBLAZE_GINO_TENANT'),\n            backendPort: env('BACKEND_PORT', '3001'), widgets: { chat: !!w.chat, keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/apiblaze/chat' && w.chat) return viaHandler(w.chat.handler, req, res, raw);\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { as: String(b.as || 'ana'), id: b.id, key: b.key, body: b.body }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts the pizzeria: the backend (port 3001) and the website (port 3000).\n// `npx apiblaze@latest demo` runs this for you and connects APIblaze to the backend.\n// To run it yourself: `node start.js`, then in another terminal\n//   npx apiblaze@latest dev --port 3001 --project <the name in .env.local> --auto\n\nconst fs = require('fs');\nconst path = require('path');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  await startBackend(backendPort);\n  await startApp(appPort);\n  return { backendPort, appPort };\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  start().then(({ appPort }) => console.log(`Pizzeria running: http://localhost:${appPort}`))\n    .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n}\n",
       "public/index.html": `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>ResiResi demo</title>
+<title>Nino's Pizza demo</title>
 <style>
   :root {
-    --bg: #faf7f2; --card: #ffffff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9;
-    --bad: #c2410c; --bad-bg: #fff1e8; --good: #15803d; --good-bg: #ecfdf3;
-    --accent: #e4572e; --accent-ink: #fff; --soft: #f3eee6; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
+    --bg: #faf7f2; --card: #fff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9; --soft: #f3eee6;
+    --accent: #e4572e; --accent-ink: #fff; --good: #15803d; --good-bg: #ecfdf3; --bad: #c2410c; --bad-bg: #fff1e8;
+    --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
   }
   @media (prefers-color-scheme: dark) {
-    :root {
-      --bg: #161412; --card: #1f1c1a; --ink: #f3efe9; --muted: #a39b92; --line: #34302c;
-      --bad: #fb923c; --bad-bg: #2b1a10; --good: #4ade80; --good-bg: #10241a; --soft: #26221f;
-    }
+    :root { --bg: #161412; --card: #1f1c1a; --ink: #f3efe9; --muted: #a39b92; --line: #34302c; --soft: #26221f;
+      --good: #4ade80; --good-bg: #10241a; --bad: #fb923c; --bad-bg: #2b1a10; }
   }
   * { box-sizing: border-box; }
   body { margin: 0; background: var(--bg); color: var(--ink); font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
-  main { max-width: 1040px; margin: 0 auto; padding: 32px 16px 64px; }
-  header { display: flex; flex-wrap: wrap; gap: 12px; align-items: center; justify-content: space-between; }
-  h1 { font-size: 28px; margin: 0; letter-spacing: -0.02em; }
-  .badge { font-size: 13px; color: var(--muted); border: 1px solid var(--line); border-radius: 999px; padding: 4px 12px; background: var(--card); }
-  .lede { font-size: 18px; color: var(--muted); margin: 8px 0 24px; max-width: 46em; }
-  .play { background: var(--accent); color: var(--accent-ink); border: 0; border-radius: 12px; padding: 14px 22px; font-size: 17px; font-weight: 600; cursor: pointer; }
-  .play:disabled { opacity: .6; cursor: default; }
-  .grid { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin-top: 24px; }
-  @media (max-width: 760px) { .grid { grid-template-columns: 1fr; } }
-  .card { background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 20px; }
-  .step { font-size: 12px; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; color: var(--muted); }
-  h2 { font-size: 20px; margin: 4px 0 4px; }
-  .sub { color: var(--muted); margin: 0 0 16px; font-size: 15px; }
-  .row { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 12px; }
-  button.act { background: var(--soft); color: var(--ink); border: 1px solid var(--line); border-radius: 10px; padding: 10px 14px; font-size: 15px; cursor: pointer; }
-  button.act:hover { border-color: var(--muted); }
-  .log { display: grid; gap: 8px; min-height: 96px; }
-  .out { border-radius: 10px; padding: 10px 12px; font-size: 15px; background: var(--soft); }
-  .out.bad { background: var(--bad-bg); color: var(--bad); font-weight: 600; }
+  main { max-width: 1000px; margin: 0 auto; padding: 20px 16px 56px; }
+  .live { display: flex; flex-wrap: wrap; gap: 6px 18px; align-items: center; font-size: 13px; color: var(--muted);
+    background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 8px 12px; }
+  .live b { color: var(--ink); font-weight: 600; }
+  .live code { font-family: var(--mono); font-size: 12px; color: var(--ink); word-break: break-all; }
+  .dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: #16a34a; margin-right: 6px; }
+  nav { display: flex; gap: 6px; margin: 18px 0 14px; }
+  nav button { border: 0; background: transparent; font-size: 17px; padding: 8px 14px; border-radius: 10px; cursor: pointer; color: var(--muted); }
+  nav button[aria-selected="true"] { background: var(--card); color: var(--ink); font-weight: 600; box-shadow: 0 0 0 1px var(--line); }
+  .who { display: flex; align-items: center; gap: 10px; margin-bottom: 14px; font-size: 15px; color: var(--muted); }
+  select { font-size: 15px; padding: 6px 10px; border-radius: 10px; border: 1px solid var(--line); background: var(--card); color: var(--ink); }
+  .cols { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
+  @media (max-width: 820px) { .cols { grid-template-columns: 1fr; } }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 18px; }
+  h2 { font-size: 19px; margin: 0 0 4px; }
+  .sub { color: var(--muted); font-size: 14px; margin: 0 0 12px; }
+  button.act { background: var(--soft); color: var(--ink); border: 1px solid var(--line); border-radius: 10px; padding: 8px 12px; font-size: 14px; cursor: pointer; }
+  button.primary { background: var(--accent); color: var(--accent-ink); border-color: transparent; font-weight: 600; }
+  ul.res { list-style: none; padding: 0; margin: 12px 0 0; display: grid; gap: 8px; }
+  ul.res li { display: flex; align-items: center; gap: 10px; background: var(--soft); border-radius: 10px; padding: 10px 12px; }
+  ul.res li.new { animation: flash 1.5s ease-out; }
+  @keyframes flash { from { background: var(--good-bg); } }
+  ul.res li span { flex: 1; }
+  .empty { color: var(--muted); font-size: 14px; }
+  .out { border-radius: 10px; padding: 8px 10px; font-size: 14px; margin-top: 10px; }
   .out.good { background: var(--good-bg); color: var(--good); font-weight: 600; }
-  .out small { display: block; font-weight: 400; color: var(--muted); font-family: var(--mono); font-size: 12px; margin-top: 2px; }
-  .chat { margin-top: 16px; }
-  .msgs { display: grid; gap: 8px; margin: 12px 0; min-height: 60px; }
-  .msg { border-radius: 12px; padding: 10px 12px; max-width: 85%; white-space: pre-wrap; }
-  .msg.user { background: var(--accent); color: var(--accent-ink); justify-self: end; }
-  .msg.bot { background: var(--soft); }
-  .msg.tool { font-family: var(--mono); font-size: 12px; color: var(--muted); background: transparent; padding: 0 12px; }
-  form.ask { display: flex; gap: 8px; }
-  form.ask input { flex: 1; min-width: 0; border: 1px solid var(--line); border-radius: 10px; padding: 10px 12px; font-size: 15px; background: var(--card); color: var(--ink); }
-  .added { margin-top: 16px; }
-  .added ul { list-style: none; padding: 0; margin: 8px 0 0; display: grid; gap: 8px; }
-  .added li::before { content: "\u2713  "; color: var(--good); font-weight: 700; }
-  code { font-family: var(--mono); font-size: 13px; background: var(--soft); padding: 1px 6px; border-radius: 6px; word-break: break-all; }
-  .next { margin-top: 16px; font-size: 17px; }
+  .out.bad { background: var(--bad-bg); color: var(--bad); font-weight: 600; }
+  #chat { min-height: 460px; }
+  .chatcard { padding: 0; overflow: hidden; }
+  .next { margin-top: 16px; color: var(--muted); font-size: 15px; }
+  .next a { color: var(--accent); cursor: pointer; text-decoration: none; font-weight: 600; }
+  .next code { font-family: var(--mono); font-size: 13px; }
+  .stack { display: grid; gap: 16px; }
 </style>
 </head>
 <body>
 <main>
-  <header>
-    <h1>\u{1F355} ResiResi \xB7 table bookings for pizzerias</h1>
-    <span class="badge" id="badge">connecting\u2026</span>
-  </header>
-  <p class="lede">Ana books a table at Nino Pizza. The same little booking app, twice. On the left, it ships the way most apps do. On the right, APIblaze stands in front of it. Nobody changed the app's code.</p>
-  <button class="play" id="play">\u25B6 Play the story</button>
+  <div class="live"><span><span class="dot"></span><b>Running on your laptop, live on the internet</b></span>
+    <span>API <code id="api">\u2026</code></span><span>MCP <code id="mcp">\u2026</code></span></div>
 
-  <div class="grid">
-    <section class="card">
-      <div class="step">1 \xB7 Without APIblaze</div>
-      <h2>One shared password</h2>
-      <p class="sub">The app holds a password. Anyone who gets it can do anything.</p>
-      <div class="row">
-        <button class="act" data-door="before" data-as="ana" data-op="book">Ana books table 4</button>
-        <button class="act" data-door="before" data-as="ben" data-op="cancel">Ben cancels Ana's booking</button>
-      </div>
-      <div class="log" id="log-before"></div>
-    </section>
+  <nav role="tablist">
+    <button role="tab" id="tab-app" aria-selected="true">\u{1F355} Nino's Pizza</button>
+    <button role="tab" id="tab-admin" aria-selected="false">\u2699 Admin</button>
+  </nav>
 
-    <section class="card">
-      <div class="step">2 \xB7 With APIblaze</div>
-      <h2>Every call says who is asking</h2>
-      <p class="sub">APIblaze checks each request. Only the person who made a booking can change it.</p>
-      <div class="row">
-        <button class="act" data-door="after" data-as="ana" data-op="book">Ana books table 4</button>
-        <button class="act" data-door="after" data-as="ben" data-op="cancel">Ben cancels Ana's booking</button>
+  <!-- THE APP: what a customer of the pizzeria sees -->
+  <section id="app">
+    <div class="who">Signed in as
+      <select id="as"><option value="ana">Ana</option><option value="ben">Ben</option></select>
+    </div>
+    <div class="cols">
+      <div class="card">
+        <h2>Your reservations</h2>
+        <p class="sub">Book here, or ask the assistant. Each person only sees their own.</p>
+        <button class="act primary" id="book">Book table 4 at 7:30pm</button>
+        <ul class="res" id="list"><li class="empty">No reservations yet.</li></ul>
+        <div id="try-ben" hidden>
+          <p class="sub" style="margin:14px 0 6px">Ana booked a table. Can Ben cancel it?</p>
+          <button class="act" id="ben-cancel">Cancel Ana's booking</button>
+          <div id="ben-out"></div>
+        </div>
       </div>
-      <div class="log" id="log-after"></div>
-    </section>
-  </div>
-
-  <section class="card chat" id="tenants" hidden>
-    <div class="step">3 \xB7 Two pizzerias, one app</div>
-    <h2>Each pizzeria gets its own key</h2>
-    <p class="sub">Nino Pizza and Gino Pizza both use this app. Nino's key <code id="nino-key">\u2026</code> \xB7 Gino's key <code id="gino-key">\u2026</code></p>
-    <div class="row">
-      <button class="act" id="gino-peek">Gino Pizza's key asks for Nino's booking</button>
+      <div class="card chatcard"><div id="chat"></div></div>
     </div>
-    <div class="log" id="log-gino"></div>
+    <p class="next">Every request here went from the internet, through APIblaze, to your laptop: <code>npx apiblaze@latest demo logs</code> shows them. Next: <a id="go-admin">the admin side \u2192</a></p>
   </section>
 
-  <section class="card chat">
-    <div class="step" id="ai-step">3 \xB7 An AI assistant, same rules</div>
-    <h2>Ben asks an AI to do it instead</h2>
-    <p class="sub">AI assistants can use this app too, and they get exactly the same answer as Ben.</p>
-    <div class="row">
-      <button class="act" id="ask-ben">Ben asks: "Cancel Ana's booking"</button>
-      <button class="act" id="ask-ana">Ana asks: "What are my bookings?"</button>
+  <!-- ADMIN: what each pizzeria's admin sees -->
+  <section id="admin" hidden>
+    <div class="who">Signed in as
+      <select id="admin-as"><option value="ana">Ana, admin of Nino Pizza</option><option value="gina">Gina, admin of Gino Pizza</option></select>
     </div>
-    <div class="msgs" id="msgs"></div>
-    <form class="ask" id="ask">
-      <input id="q" placeholder="Ask the assistant something, as Ben" autocomplete="off">
-      <button class="act" type="submit">Send</button>
-    </form>
-  </section>
-
-  <section class="card added">
-    <div class="step">What APIblaze added, with zero code in this app</div>
-    <ul>
-      <li>A key for this app: <code id="key">\u2026</code> (kept on the server, never in the browser)</li>
-      <li>"Only the person who made a booking can change it", worked out from <code>openapi.yaml</code></li>
-      <li>A door for AI assistants: <code id="mcp">\u2026</code></li>
-    </ul>
-    <p class="next">Want this in front of your own app? Ask Claude: <b>"Put APIblaze in front of my app."</b></p>
+    <div class="stack">
+      <div class="card"><div id="keys"></div></div>
+      <div class="card"><div id="groups"></div></div>
+    </div>
+    <p class="next">Each pizzeria only sees its own keys and people. Developers can also sign in and get a key at the <a id="portal" target="_blank" rel="noopener">developer portal</a>.</p>
   </section>
 </main>
+<script src="/apiblaze-widgets.js"></script>
 <script>
 const $ = (s) => document.querySelector(s);
-const ids = { before: null, after: null };
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const post = (url, body) => fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body || {}) }).then((r) => r.json()).catch(() => ({ status: 0 }));
+const W = window.ApiblazeWidgets;
+const theme = { accent: '#e4572e' };
+let cfg = {};
+let anaBooking = null;
 
-function show(door, cls, text, detail) {
-  const el = document.createElement('div');
-  el.className = 'out ' + (cls || '');
-  el.textContent = text;
-  if (detail) { const s = document.createElement('small'); s.textContent = detail; el.appendChild(s); }
-  $('#log-' + door).appendChild(el);
-}
-
-async function act(door, as, op) {
-  if (op === 'cancel' && !ids[door]) await act(door, 'ana', 'book');
-  const r = await fetch('/api/act', { method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ door, as, op, id: ids[door] }) }).then((x) => x.json()).catch((e) => ({ status: 0, body: { error: String(e) } }));
-  const code = 'HTTP ' + r.status;
-  if (op === 'book') {
-    if (r.status === 201) { ids[door] = r.body.id; show(door, '', \`Ana booked table \${r.body.table} at \${r.body.time}.\`, \`\${code} \xB7 booking \${r.body.id}\`); }
-    else show(door, 'bad', explain(r), code);
-    return;
-  }
-  if (r.status === 204) {
-    show(door, door === 'before' ? 'bad' : '', door === 'before' ? "Cancelled. Ben just deleted Ana's table." : 'Cancelled.', code);
-    ids[door] = null;
-  } else if (r.status === 403 || r.status === 404) {
-    show(door, 'good', "\u{1F6E1} Blocked. Only Ana can cancel Ana's booking.", code + ' \xB7 decided by APIblaze, not the app');
-  } else show(door, 'bad', explain(r), code);
-}
-
-function explain(r) {
-  const b = r.body || {};
-  if (r.status === 402) return 'The free demo calls ran out. Run again: npx apiblaze@latest demo';
-  if (r.status === 429) return 'Too many clicks at once. Wait a second and try again.';
-  if (r.status >= 500 || r.status === 0) return 'The connection to APIblaze dropped. Run again: npx apiblaze@latest demo';
-  return (b.detail || b.title || b.error || 'Something went wrong') + '';
-}
-
-$('.grid').addEventListener('click', (e) => {
-  const b = e.target.closest('button.act'); if (!b) return;
-  act(b.dataset.door, b.dataset.as, b.dataset.op);
-});
+// \u2500\u2500 tabs \u2500\u2500
+function show(tab) {
+  $('#app').hidden = tab !== 'app'; $('#admin').hidden = tab !== 'admin';
+  $('#tab-app').setAttribute('aria-selected', tab === 'app'); $('#tab-admin').setAttribute('aria-selected', tab === 'admin');
+  if (tab === 'admin') mountAdmin();
+}
+$('#tab-app').onclick = () => show('app');
+$('#tab-admin').onclick = () => show('admin');
+$('#go-admin').onclick = () => show('admin');
 
-// \u2500\u2500 the assistant \u2500\u2500
-const thread = { ana: [], ben: [] };
-function bubble(cls, text) { const d = document.createElement('div'); d.className = 'msg ' + cls; d.textContent = text; $('#msgs').appendChild(d); return d; }
-async function ask(as, text) {
-  bubble('user', (as === 'ana' ? 'Ana: ' : 'Ben: ') + text);
-  const msg = { id: String(Math.random()), role: 'user', parts: [{ type: 'text', text }] };
-  thread[as].push(msg);
-  let bot = null, said = '';
-  try {
-    const res = await fetch('/api/chat', { method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ as, id: 'demo-' + as, messages: thread[as] }) });
-    const ct = res.headers.get('content-type') || '';
-    if (!res.ok || !ct.includes('event-stream')) {
-      const d = await res.json().catch(() => ({}));
-      bubble('bot', res.status === 402 ? 'The free assistant turns ran out for this demo.' : (d.error || d.detail || 'The assistant is not available right now.'));
-      return;
-    }
-    const reader = res.body.getReader(); const dec = new TextDecoder(); let buf = '';
-    for (;;) {
-      const { done, value } = await reader.read(); if (done) break;
-      buf += dec.decode(value, { stream: true });
-      let at;
-      while ((at = buf.indexOf('\\n\\n')) !== -1) {
-        const raw = buf.slice(0, at); buf = buf.slice(at + 2);
-        const data = raw.split('\\n').filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).join('\\n');
-        if (!data || data === '[DONE]') continue;
-        let ev; try { ev = JSON.parse(data); } catch { continue; }
-        if (ev.type === 'tool-input-start') bubble('tool', '\u2192 using the app: ' + (ev.toolName || 'tool'));
-        if (ev.type === 'tool-output-error') bubble('tool', '\u2190 refused: ' + String(ev.errorText || '').slice(0, 120));
-        if (ev.type === 'text-delta') { if (!bot) bot = bubble('bot', ''); said += ev.delta || ''; bot.textContent = said; }
-        if (ev.type === 'error') bubble('bot', ev.errorText || 'Something went wrong.');
-      }
-    }
-    if (said) thread[as].push({ id: String(Math.random()), role: 'assistant', parts: [{ type: 'text', text: said }] });
-  } catch (e) { bubble('bot', 'The assistant is not reachable right now.'); }
-}
-$('#ask-ben').onclick = async () => {
-  if (!ids.after) await act('after', 'ana', 'book');
-  ask('ben', \`Cancel booking \${ids.after}. It's Ana's table, I want it.\`);
+// \u2500\u2500 the app \u2500\u2500
+const me = () => $('#as').value;
+const seen = new Set();
+async function refresh() {
+  const r = await post('/api/act', { op: 'list', as: me() });
+  const rows = Array.isArray(r.body) ? r.body : [];
+  if (me() === 'ana') anaBooking = rows.length ? rows[0].id : null;
+  const ul = $('#list'); ul.replaceChildren();
+  if (!rows.length) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'No reservations yet.'; ul.append(li); }
+  for (const b of rows) {
+    const li = document.createElement('li');
+    if (!seen.has(b.id)) { li.className = 'new'; seen.add(b.id); }
+    const t = document.createElement('span');
+    t.textContent = \`Table \${b.table} \xB7 \${b.time} \xB7 \${b.guests || 2} people \xB7 #\${b.id}\`;
+    const x = document.createElement('button'); x.className = 'act'; x.textContent = 'Cancel';
+    x.onclick = async () => { await post('/api/act', { op: 'cancel', as: me(), id: b.id }); refresh(); };
+    li.append(t, x); ul.append(li);
+  }
+  $('#try-ben').hidden = !(me() === 'ben' && anaBooking);
+}
+$('#book').onclick = async () => { await post('/api/act', { op: 'book', as: me() }); refresh(); };
+$('#ben-cancel').onclick = async () => {
+  const r = await post('/api/act', { op: 'cancel', as: 'ben', id: anaBooking });
+  const d = document.createElement('div');
+  if (r.status === 403) { d.className = 'out good'; d.textContent = "\u{1F6E1} Blocked. Only Ana can cancel Ana's booking. APIblaze decided, not the app's code."; }
+  else { d.className = 'out bad'; d.textContent = r.status === 204 ? 'Cancelled. That should not happen.' : 'Something went wrong (HTTP ' + r.status + ').'; }
+  $('#ben-out').replaceChildren(d);
 };
-$('#ask-ana').onclick = () => ask('ana', 'What are my bookings?');
+function mountChat() {
+  if (!W || !cfg.widgets || !cfg.widgets.chat) return;
+  const who = me() === 'ben' ? 'Ben' : 'Ana';
+  $('#chat').replaceChildren();
+  W.chat('#chat', { endpoint: '/api/apiblaze/chat?as=' + me(), mode: 'inline', title: "Nino's Pizza assistant", avatar: '\u{1F355}', height: 520, theme,
+    storageKey: 'nino-chat-' + me(),
+    welcome: \`Hi \${who}! I can book, list and cancel your tables. I'm using the app on your laptop, through APIblaze.\`,
+    suggestions: ['Book table 2 for 4 people at 8pm', 'What are my reservations?'] });
+}
+$('#as').onchange = () => { $('#ben-out').replaceChildren(); refresh(); mountChat(); };
+setInterval(() => { if (!$('#app').hidden) refresh(); }, 2000); // the assistant's bookings appear here
 
-// \u2500\u2500 two pizzerias \u2500\u2500
-let hasTenants = false;
-async function ginoPeek() {
-  if (!ids.after) await act('after', 'ana', 'book');
-  // Same person name, different pizzeria: only the key differs.
-  const r = await fetch('/api/act', { method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ door: 'gino', as: 'ana', op: 'open', id: ids.after }) }).then((x) => x.json()).catch(() => ({ status: 0 }));
-  const code = 'HTTP ' + r.status;
-  if (r.status === 200) show('gino', 'bad', "Gino Pizza can read Nino's booking.", code);
-  else if (r.status === 403 || r.status === 404) show('gino', 'good', "\u{1F6E1} Blocked. Gino Pizza's key only sees Gino Pizza's bookings.", code + ' \xB7 decided by APIblaze, not the app');
-  else show('gino', 'bad', explain(r), code);
-}
-$('#gino-peek').onclick = ginoPeek;
-$('#ask').onsubmit = (e) => { e.preventDefault(); const q = $('#q').value.trim(); if (q) { $('#q').value = ''; ask('ben', q); } };
-
-$('#play').onclick = async () => {
-  $('#play').disabled = true;
-  await act('before', 'ana', 'book'); await sleep(700);
-  await act('before', 'ben', 'cancel'); await sleep(1200);
-  await act('after', 'ana', 'book'); await sleep(700);
-  await act('after', 'ben', 'cancel'); await sleep(900);
-  if (hasTenants) { await ginoPeek(); await sleep(900); }
-  $('#ask-ben').click();
-  $('#play').disabled = false;
-};
+// \u2500\u2500 admin \u2500\u2500
+function mountAdmin() {
+  if (!W) return;
+  const as = $('#admin-as').value;
+  for (const id of ['#keys', '#groups']) $(id).replaceChildren();
+  if (cfg.widgets && cfg.widgets.keys) W.keys('#keys', { endpoint: '/api/apiblaze/keys?as=' + as, theme, title: 'API keys' });
+  if (cfg.widgets && cfg.widgets.groups) W.groups('#groups', { endpoint: '/api/apiblaze/groups?as=' + as, theme, title: 'People and groups' });
+}
+$('#admin-as').onchange = mountAdmin;
 
 fetch('/api/config').then((r) => r.json()).then((c) => {
-  $('#badge').textContent = c.name ? 'Protected by APIblaze \xB7 ' + c.name : 'APIblaze not connected';
-  $('#key').textContent = c.key || 'not set';
-  $('#mcp').textContent = c.mcpUrl || 'not set';
-  if (c.ginoKey) {
-    hasTenants = true;
-    $('#tenants').hidden = false;
-    $('#nino-key').textContent = c.key;
-    $('#gino-key').textContent = c.ginoKey;
-    $('#ai-step').textContent = '4 \xB7 An AI assistant, same rules';
-  }
+  cfg = c;
+  $('#api').textContent = c.apiUrl || 'not connected';
+  $('#mcp').textContent = c.mcpUrl || 'not connected';
+  if (c.portalUrl) $('#portal').href = c.portalUrl;
+  if (!c.gino) { const o = $('#admin-as').querySelector('[value="gina"]'); if (o) o.remove(); }
+  if (!c.widgets || (!c.widgets.keys && !c.widgets.groups)) $('#tab-admin').hidden = true;
+  refresh(); mountChat();
+  if (location.hash === '#admin') show('admin');
 });
 </script>
 </body>
@@ -6717,8 +6557,14 @@ fetch('/api/config').then((r) => r.json()).then((c) => {
 // src/commands/demo.ts
 var demo_exports = {};
 __export(demo_exports, {
+  DEMO_ADMIN_EMAIL: () => DEMO_ADMIN_EMAIL,
+  DEMO_GINO_ADMIN_EMAIL: () => DEMO_GINO_ADMIN_EMAIL,
+  DEMO_RPS: () => DEMO_RPS,
   demoName: () => demoName,
+  routesOf: () => routesOf,
   runDemo: () => runDemo,
+  runDemoLogs: () => runDemoLogs,
+  runDemoStart: () => runDemoStart,
   runDemoStop: () => runDemoStop,
   stopDemos: () => stopDemos
 });
@@ -6774,7 +6620,8 @@ async function stopDemos() {
   return stopped;
 }
 function writeApp(dir) {
-  import_fs5.default.rmSync(dir, { recursive: true, force: true });
+  import_fs5.default.mkdirSync(dir, { recursive: true });
+  for (const entry of import_fs5.default.readdirSync(dir)) import_fs5.default.rmSync(import_path4.default.join(dir, entry), { recursive: true, force: true });
   for (const [rel, text] of Object.entries(DEMO_FILES)) {
     const f = import_path4.default.join(dir, rel);
     import_fs5.default.mkdirSync(import_path4.default.dirname(f), { recursive: true });
@@ -6782,6 +6629,11 @@ function writeApp(dir) {
   }
   import_fs5.default.writeFileSync(import_path4.default.join(dir, "package.json"), JSON.stringify({ name: "nino-pizza-demo", private: true, scripts: { start: "node start.js" } }, null, 2) + "\n");
   import_fs5.default.writeFileSync(import_path4.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
+  for (const [from, to] of [[import_path4.default.join(__dirname, "server", "index.js"), import_path4.default.join(dir, "lib", "apiblaze-server.js")], [import_path4.default.join(__dirname, "browser", "widgets.js"), import_path4.default.join(dir, "public", "apiblaze-widgets.js")]]) {
+    if (!import_fs5.default.existsSync(from)) continue;
+    import_fs5.default.mkdirSync(import_path4.default.dirname(to), { recursive: true });
+    import_fs5.default.copyFileSync(from, to);
+  }
 }
 function saveState(dir, s) {
   const d = import_path4.default.join(dir, STATE_DIR);
@@ -6795,7 +6647,7 @@ function loadState(dir) {
     return null;
   }
 }
-async function createProxy2(name, backendPort, openapi) {
+async function createProxy2(name, backendPort, openapi, tenantName) {
   const auth = resolveAuth({});
   const proposed = await proposeFromSpec(openapi).catch(() => null);
   const families = proposed?.status === 200 && Array.isArray(proposed.data?.families) ? proposed.data.families.filter((f) => !f.skipped_reason).map((f) => f.key) : [];
@@ -6808,7 +6660,7 @@ async function createProxy2(name, backendPort, openapi) {
     environments: { dev: { target: `http://localhost:${backendPort}`, description: `the ${B.cli} demo on this machine` } },
     // Two customers of the same app, each with its own key: the proxy's own tenant
     // is Nino Pizza, and the server adds Gino Pizza and returns its key.
-    tenant: `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`,
+    tenant: tenantName,
     extra_tenants: ["Gino Pizza"],
     ...families.length ? { secure: { families } } : {}
   };
@@ -6849,6 +6701,14 @@ async function waitReady(dir, s, serverKey) {
   }
   throw new DemoError(`The demo is running but ${B.product} cannot reach it yet (last answer ${last}).`, `Run again: ${LATEST} demo`);
 }
+async function offerBrowser(url, opts) {
+  if (opts.open === false || !process.stdin.isTTY || !process.stdout.isTTY) return;
+  const readline3 = await import("readline");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((res) => rl.question(`  Open ${url} in your browser? (Y/n) `, res));
+  rl.close();
+  if (!/^n/i.test(answer.trim())) openBrowser3(url);
+}
 function openBrowser3(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
@@ -6870,17 +6730,56 @@ async function runDemo(opts = {}) {
     process.exit(1);
   }
 }
+function routesOf(openapi) {
+  const out = [];
+  let curPath = "";
+  let cur = null;
+  for (const line of openapi.split("\n")) {
+    const p = /^ {2}(\/[^:]*):\s*$/.exec(line);
+    if (p) {
+      curPath = p[1];
+      cur = null;
+      continue;
+    }
+    const mth = /^ {4}(get|post|put|patch|delete):\s*$/.exec(line);
+    if (mth && curPath) {
+      cur = { method: mth[1].toUpperCase(), path: curPath, summary: "", op: "" };
+      out.push(cur);
+      continue;
+    }
+    const sum = /^ {6}summary:\s*(.+)$/.exec(line);
+    if (sum && cur) cur.summary = sum[1].trim();
+    const op2 = /^ {6}operationId:\s*(.+)$/.exec(line);
+    if (op2 && cur) cur.op = op2[1].trim();
+  }
+  return out;
+}
 async function startDemo(opts) {
   const t0 = Date.now();
-  const dir = import_path4.default.resolve(process.cwd(), DIR_NAME);
-  console.log(import_chalk25.default.dim(`Setting up the demo in ./${DIR_NAME} (about 30 seconds)\u2026`));
+  const here = process.cwd();
+  const dir = import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json")) ? here : import_path4.default.resolve(here, DIR_NAME);
+  const rel = import_path4.default.relative(here, dir) || ".";
+  const run2 = (...cmds) => {
+    for (const c of cmds) console.log(import_chalk25.default.dim(`   $ ${LATEST} ${c}`));
+  };
+  const step = (label3, text, note = "") => console.log(`   ${import_chalk25.default.green("\u2713")} ${import_chalk25.default.bold(label3.padEnd(17))} ${text}${note ? `   ${import_chalk25.default.dim(note)}` : ""}`);
   await stopDemos();
   writeApp(dir);
   const appPort = await freePort(3e3);
   const backendPort = await freePort(3001, [appPort]);
   const name = demoName();
   const openapi = DEMO_FILES["openapi.yaml"];
-  const r = await createProxy2(name, backendPort, openapi);
+  console.log();
+  console.log(import_chalk25.default.bold(`1. The app: Nino's Pizza, a table-booking backend, now in ${rel}`));
+  console.log(import_chalk25.default.dim(`   backend.js runs on this laptop (localhost:${backendPort}). Its routes, from openapi.yaml:`));
+  for (const r2 of routesOf(openapi)) console.log(`     ${r2.method.padEnd(7)}${r2.path.padEnd(21)}${import_chalk25.default.dim(r2.summary)}`);
+  console.log(import_chalk25.default.dim("   No login, no API keys, no permission checks in its code. That is APIblaze's job."));
+  console.log();
+  console.log(import_chalk25.default.bold(`2. ${B.product}, in front of it`) + import_chalk25.default.dim("   (each step does what the command above it does)"));
+  const ninoTenant = `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`;
+  run2(`dev --port ${backendPort} --openapi ./openapi.yaml --name ${name} --tenant ${ninoTenant} --auto`);
+  const tCreate = Date.now();
+  const r = await createProxy2(name, backendPort, openapi, ninoTenant);
   const cpKey = r.cp_key;
   const teamId = r.team_id;
   const keys = r.api_keys ?? {};
@@ -6892,45 +6791,152 @@ async function startDemo(opts) {
   const missing = [!cpKey && "workspace key", !teamId && "team", !serverKey && "API key", !tenant2 && "tenant"].filter(Boolean);
   if (missing.length) throw new DemoError(`${B.product} did not return everything the demo needs (${missing.join(", ")}).`, `Run again: ${LATEST} demo`);
   const apiUrl = restUrl(project, version2, "dev", { anon: true });
-  const chatBase = `https://${project}-${tenant2}.mcp.tryabz.run/${version2}/dev`;
-  const gino = (r.tenants ?? []).find((t) => t.api_key);
+  const gino = (rr.tenants ?? []).find((t) => t.api_key);
+  const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
+  step("Proxy", `${project}, created from openapi.yaml`, `${((Date.now() - tCreate) / 1e3).toFixed(1)} s \xB7 no account needed`);
+  const applied = (rr.secure?.applied ?? []).map((k) => k.replace(/^\//, "").split("/")[0]);
+  if (applied.length) step("Rules", `${applied.join(", ")}: only the person who made one can change or cancel it`);
+  const tools0 = routesOf(openapi).map((x) => x.op).filter(Boolean);
+  step("AI", `${tools0.length} tools for AI assistants, one per route (${tools0.join(", ")})`, "the MCP address");
+  if (gino?.tenant) run2(`tenant create --name "Gino Pizza" --slug ${gino.tenant}`, `tenant attach ${project} --tenant ${gino.tenant}`, `apikeys mint --tenant ${gino.tenant} --backend --env dev`);
+  step("Customers/Tenants", gino ? `Nino Pizza and Gino Pizza, each with its own API key` : `Nino Pizza, with its own API key`, "one API, kept apart");
+  run2(`admins add ${DEMO_ADMIN_EMAIL} --tenant ${tenant2}`, ...gino?.tenant ? [`admins add ${DEMO_GINO_ADMIN_EMAIL} --tenant ${gino.tenant}`] : []);
+  const limited = await cpFetch(cpKey, `/projects/${encodeURIComponent(project)}/${encodeURIComponent(version2)}/limits`, {
+    method: "PUT",
+    body: JSON.stringify({ consumerRps: DEMO_RPS, endUserRps: DEMO_RPS })
+  }).then(() => true).catch(() => false);
+  const adminOk = await cpFetch(cpKey, `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin-emails`, {
+    method: "POST",
+    body: JSON.stringify({ email: DEMO_ADMIN_EMAIL })
+  }).then(() => true).catch(() => false);
+  let ginaOk = false;
+  if (gino?.tenant) {
+    ginaOk = await cpFetch(cpKey, `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(gino.tenant)}/admin-emails`, {
+      method: "POST",
+      body: JSON.stringify({ email: DEMO_GINO_ADMIN_EMAIL })
+    }).then(() => true).catch(() => false);
+  }
+  if (adminOk) step("Admins", ginaOk ? "Ana runs Nino Pizza, Gina runs Gino Pizza" : "Ana runs Nino Pizza", "they manage keys and people on the Admin tab");
+  run2(`limits set ${project} --rate ${DEMO_RPS} --end-user-rate ${DEMO_RPS}`);
+  if (limited) step("Limits", `${DEMO_RPS} calls a second per customer`);
   writeEnv(dir, {
     APIBLAZE_NAME: project,
+    APIBLAZE_TENANT: tenant2,
     APIBLAZE_URL: apiUrl,
     APIBLAZE_SERVER_KEY: serverKey,
-    ...gino?.api_key ? { APIBLAZE_GINO_KEY: gino.api_key } : {},
-    APIBLAZE_MCP_URL: chatBase,
+    ...gino?.api_key ? { APIBLAZE_GINO_KEY: gino.api_key, APIBLAZE_GINO_TENANT: gino.tenant ?? "" } : {},
+    APIBLAZE_MCP_URL: agents,
+    APIBLAZE_PORTAL_URL: `https://${tenant2}.portal.apiblaze.com/${version2}`,
+    // The keys + users widgets mint through the workspace's control key (server-side only).
+    APIBLAZE_CP_KEY: cpKey,
+    APIBLAZE_WIDGETS: process.env.APIBLAZE_DEMO_WIDGETS === "0" ? 0 : 1,
+    APIBLAZE_DEMO_RPS: DEMO_RPS,
     APP_PORT: appPort,
     BACKEND_PORT: backendPort
   });
   const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort, apiUrl, claimCode: r.claim_code };
   saveState(dir, state);
-  const log4 = import_fs5.default.openSync(import_path4.default.join(dir, STATE_DIR, "demo.log"), "a");
-  const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
-  child.unref();
-  saveState(dir, { ...state, pid: child.pid });
-  writeRegistry([...readRegistry(), { dir, pid: child.pid ?? 0 }]);
-  await waitReady(dir, state, serverKey);
+  step("Keys", "saved to .env.local for the website's server, never printed");
+  await spawnServe(dir, state, serverKey);
+  step("Tunnel", `the public address now reaches localhost:${backendPort} on this laptop`, "the dev command above keeps it open \xB7 checked with a real call");
+  console.log(import_chalk25.default.dim(`   $ node start.js`) + import_chalk25.default.dim("   (in the demo folder: the backend and the website)"));
+  step("Website", `http://localhost:${appPort}, calling ${B.product} with one server key`);
   const url = `http://localhost:${appPort}`;
-  if (opts.open !== false) openBrowser3(url);
   const secs = Math.round((Date.now() - t0) / 1e3);
-  const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
+  printReady(dir, secs);
+  await offerBrowser(url, opts);
+}
+function printReady(dir, secs) {
+  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  const row = (label3, value, note = "") => console.log(`  ${label3.padEnd(12)} ${value}${note ? `   ${import_chalk25.default.dim(note)}` : ""}`);
   console.log();
-  console.log(`${import_chalk25.default.green("\u2713")} The demo is live: ${import_chalk25.default.bold(url)}   ${import_chalk25.default.dim(`(${secs} s)`)}`);
+  console.log(import_chalk25.default.bold(`3. Live: Nino's Pizza runs on this laptop and is on the internet`) + `   ${import_chalk25.default.dim(`(${secs} s)`)}`);
   console.log();
-  console.log("  What it shows. Tell the user this, in plain words:");
-  console.log("  1. Without APIblaze, a booking app uses one shared password, so Ben can cancel Ana's table.");
-  console.log(`  2. With ${B.product} in front of the same app, unchanged, Ben tries again. Blocked.`);
-  if (gino) console.log("  3. Two pizzerias share the app, each with its own key. Gino Pizza's key cannot see Nino Pizza's bookings.");
-  console.log(`  ${gino ? 4 : 3}. An AI assistant uses the same app under the same rules. It cannot cancel Ana's table either.`);
-  console.log('  The page has a "Play the story" button that runs it all.');
+  row("App", import_chalk25.default.bold(`http://localhost:${env.APP_PORT}`));
+  row("Public API", env.APIBLAZE_URL ?? "", `answered by localhost:${env.BACKEND_PORT}`);
+  row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor");
+  if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
   console.log();
-  console.log(`  The app's code is in ./${DIR_NAME}. backend.js has no login or permissions code.`);
-  console.log(`  Its key is saved in ./${DIR_NAME}/.env.local, never shown here.`);
-  console.log(import_chalk25.default.dim(`  For AI assistants: ${agents}`));
-  console.log(import_chalk25.default.dim(`  Stop it: ${LATEST} demo stop   \xB7   Run it again any time: ${LATEST} demo`));
+  row("Logs", `${LATEST} demo logs`, "every request reaching your laptop");
+  row("Stop", `${LATEST} demo stop`);
+  row("Restart", `${LATEST} demo restart`, "same addresses and keys");
+  row("Start over", `${LATEST} demo`, "a brand-new demo");
   console.log();
-  console.log(`  Ask the user one question: "Want to put this in front of your own app?"`);
+  console.log(import_chalk25.default.dim(`  Code in ${import_path4.default.relative(process.cwd(), dir) || "."} \xB7 keys in .env.local, never shown here`));
+  console.log(import_chalk25.default.dim(`  Your own app: ${LATEST} dev --port <port>   \xB7   deployed already: ${LATEST} create --target <url>`));
+}
+function readEnvFile(file2) {
+  const out = {};
+  try {
+    for (const line of import_fs5.default.readFileSync(file2, "utf8").split("\n")) {
+      const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+      if (m) out[m[1]] = m[2];
+    }
+  } catch {
+  }
+  return out;
+}
+function demoDir() {
+  const here = process.cwd();
+  if (import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json"))) return here;
+  return import_path4.default.resolve(here, DIR_NAME);
+}
+async function spawnServe(dir, state, serverKey) {
+  const log4 = import_fs5.default.openSync(import_path4.default.join(dir, STATE_DIR, "demo.log"), "a");
+  const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
+  child.unref();
+  saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
+  writeRegistry([...readRegistry(), { dir, pid: child.pid ?? 0 }]);
+  await waitReady(dir, state, serverKey);
+}
+async function runDemoStart(opts = {}) {
+  const t0 = Date.now();
+  const dir = demoDir();
+  const state = loadState(dir);
+  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  if (!state || !env.APIBLAZE_SERVER_KEY) {
+    console.log(`${import_chalk25.default.red("\u2717")} There is no demo here to start.`);
+    console.log(`  Make one: ${LATEST} demo`);
+    process.exit(1);
+  }
+  try {
+    await stopDemos();
+    await spawnServe(dir, state, env.APIBLAZE_SERVER_KEY);
+  } catch (err) {
+    const e = err instanceof DemoError ? err : new DemoError(`The demo could not start (${err.message}).`, `Start over: ${LATEST} demo`);
+    await stopDemos().catch(() => 0);
+    console.log(`${import_chalk25.default.red("\u2717")} ${e.message}`);
+    console.log(`  ${e.fix}`);
+    process.exit(1);
+  }
+  printReady(dir, Math.round((Date.now() - t0) / 1e3));
+  await offerBrowser(`http://localhost:${env.APP_PORT}`, opts);
+}
+async function runDemoLogs() {
+  const file2 = import_path4.default.join(demoDir(), STATE_DIR, "demo.log");
+  if (!import_fs5.default.existsSync(file2)) {
+    console.log(`${import_chalk25.default.red("\u2717")} There is no demo log here.`);
+    console.log(`  Make a demo: ${LATEST} demo`);
+    process.exit(1);
+  }
+  console.log(import_chalk25.default.dim(`Following ${import_path4.default.relative(process.cwd(), file2)} \u2014 Ctrl-C stops following (the demo keeps running).`));
+  let pos = Math.max(0, import_fs5.default.statSync(file2).size - 4e3);
+  const pump = () => {
+    const size = import_fs5.default.statSync(file2).size;
+    if (size < pos) pos = 0;
+    if (size > pos) {
+      const fd = import_fs5.default.openSync(file2, "r");
+      const buf = Buffer.alloc(size - pos);
+      import_fs5.default.readSync(fd, buf, 0, buf.length, pos);
+      import_fs5.default.closeSync(fd);
+      pos = size;
+      process.stdout.write(buf.toString("utf8"));
+    }
+  };
+  pump();
+  setInterval(pump, 500);
+  await new Promise(() => {
+  });
 }
 async function runDemoStop() {
   const n = await stopDemos();
@@ -6999,7 +7005,7 @@ async function serveDemo(dir) {
   await new Promise(() => {
   });
 }
-var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_module, import_chalk25, DIR_NAME, STATE_DIR, LATEST, DemoError, ADJ, NOUN, pick2, registryFile, alive;
+var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_module, import_chalk25, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, DemoError, ADJ, NOUN, pick2, registryFile, alive;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
@@ -7013,12 +7019,16 @@ var init_demo = __esm({
     init_api();
     init_tunnel_client();
     init_auth();
+    init_anon_cred();
     init_brand();
     init_create();
     init_files();
     DIR_NAME = `${B.cli}-demo`;
     STATE_DIR = ".demo";
     LATEST = `npx ${B.cli}@latest`;
+    DEMO_RPS = 2;
+    DEMO_ADMIN_EMAIL = "ana@ninopizza.example";
+    DEMO_GINO_ADMIN_EMAIL = "gina@ginopizza.example";
     DemoError = class extends Error {
       constructor(message, fix) {
         super(message);
@@ -7354,6 +7364,13 @@ async function journey(label3, work, home, checks) {
   } else {
     add("tenants-record", false, "no Gino Pizza key: the server did not return extra_tenants");
   }
+  const page = `http://127.0.0.1:${env.APP_PORT}`;
+  const made = await http(`${page}/api/apiblaze/keys`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ action: "create" }) });
+  const widgetKey = made.body?.key;
+  const used = widgetKey ? await http(`${api}/reservations`, { headers: { "x-api-key": widgetKey } }) : { status: 0 };
+  add("keys-widget", made.status === 201 && used.status === 200, `create ${made.status} \xB7 the new key calls the API ${used.status}`);
+  const snap = await http(`${page}/api/apiblaze/groups`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ action: "snapshot" }) });
+  add("users-widget", snap.status === 200 && snap.body?.access === "ok", `snapshot ${snap.status} \xB7 access ${snap.body?.access ?? "-"}`);
   const chat = await http(`${env.APIBLAZE_MCP_URL}/runtime-chat`, {
     method: "POST",
     headers: as("ana"),
@@ -7368,11 +7385,16 @@ async function journey(label3, work, home, checks) {
     }
   }).filter(Boolean).filter((e) => e.type === "text-delta").map((e) => e.delta ?? "").join("");
   const streamErr = /"type":"error"/.test(chat.text);
-  add(
-    "ai-turn",
-    chat.status === 200 && chat.type.includes("event-stream") && said.length > 0 && !streamErr,
-    `HTTP ${chat.status}${streamErr ? " \xB7 stream error" : ""} \xB7 ${said.length} chars${chat.status !== 200 ? ` \xB7 ${chat.text.slice(0, 120)}` : ""}`
-  );
+  const ipCapped = /data-apiblaze-upsell/.test(chat.text) && /Free chats used up/.test(chat.text);
+  if (ipCapped) {
+    checks.push({ id: `${label3}:ai-turn`, ok: true, skipped: true, detail: "SKIPPED \u2014 this machine's IP is at today's free-chat cap (resets daily); a newcomer's first chat is unaffected" });
+  } else {
+    add(
+      "ai-turn",
+      chat.status === 200 && chat.type.includes("event-stream") && said.length > 0 && !streamErr,
+      `HTTP ${chat.status}${streamErr ? " \xB7 stream error" : ""} \xB7 ${said.length} chars${chat.status !== 200 ? ` \xB7 ${chat.text.slice(0, 120)}` : ""}`
+    );
+  }
   return env;
 }
 async function runOpAnon(o = {}) {
@@ -7401,9 +7423,13 @@ async function runOpAnon(o = {}) {
     checks.push({ id: "stop", ok: stop.code === 0 && portsFree, detail: `exit ${stop.code}${portsFree ? "" : " \xB7 ports still answering"}` });
     import_fs8.default.rmSync(root, { recursive: true, force: true });
   }
-  for (const c of checks) log4(`  ${c.ok ? import_chalk70.default.green("\u2713") : import_chalk70.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk70.default.dim(c.detail)}`);
+  for (const c of checks) log4(`  ${c.skipped ? import_chalk70.default.yellow("\u2013") : c.ok ? import_chalk70.default.green("\u2713") : import_chalk70.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk70.default.dim(c.detail)}`);
   const failed = checks.filter((c) => !c.ok).length;
-  log4(failed ? import_chalk70.default.red(`${checks.length - failed}/${checks.length} passed (${Math.round((Date.now() - t0) / 1e3)} s)`) : import_chalk70.default.green(`${checks.length}/${checks.length} passed (${Math.round((Date.now() - t0) / 1e3)} s)`));
+  const skipped = checks.filter((c) => c.skipped).length;
+  const passed = checks.length - failed - skipped;
+  const secs = Math.round((Date.now() - t0) / 1e3);
+  const tail = `${skipped ? `, ${skipped} skipped` : ""} (${secs} s)`;
+  log4(failed ? import_chalk70.default.red(`${passed}/${checks.length - skipped} passed, ${failed} failed${tail}`) : import_chalk70.default.green(`${passed}/${checks.length - skipped} passed${tail}`));
   if (o.json) process.stdout.write(JSON.stringify({ ok: !failed, checks }, null, 2) + "\n");
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
@@ -7973,12 +7999,11 @@ description: Use when the user asks what ${P} (or ${B.cli}) does or can do for t
 
 ## Explain: they ask what ${P} does
 
-Run nothing. Say this, in these words or very close to them, then stop:
+Run nothing. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
 
-"${P} puts a smart front door on your app's backend. In one command, every customer gets
-their own key, people can only touch their own data, and AI assistants like me can use your
-app safely, under the same rules. You don't write any login or permissions code. Want me to
-show you in about 30 seconds?"
+"${P} puts the app on your laptop on the internet in one command. It gets a public address,
+plus an address AI assistants like me can use to work with it. API keys, sign-in and
+who-can-change-what come built in, with no code. Want me to show you in about 30 seconds?"
 
 Do not use the words proxy, MCP, tenant, OpenAPI or header unless the user does first.
 
@@ -7986,15 +8011,13 @@ Do not use the words proxy, MCP, tenant, OpenAPI or header unless the user does
 
 1. Say one line: "Starting the demo, about 30 seconds."
 2. Run exactly this, in the foreground. It needs no login and asks nothing. It sets
-   everything up, opens the browser and exits by itself once the page is live:
+   everything up and exits by itself once the page is live. It opens nothing: give the user the App link it prints:
    \`${run2} demo\`
-3. When it prints \u2713, tell the three-beat story it printed, in plain words, with the link:
-   - "Here's a booking app where anyone with the password can do anything: Ben cancels Ana's table."
-   - "Same app with ${P} in front, no code changed: Ben tries again. Blocked."
-   - If it printed the pizzerias line: "Two pizzerias share the app, each with its own key. Gino's can't see Nino's bookings."
-   - "And here's an AI assistant using the same app, with the same rules."
-   Point them at the "Play the story" button. Then ask one question:
-   **"Want to put this in front of your own app?"**
+3. When it prints \u2713, tell this story in plain words, with the App link it printed:
+   - "This booking app runs on your laptop. ${P} just gave it a public address, and one for AI assistants."
+   - "On the Nino's Pizza tab, ask the assistant to book a table, and it appears in your list."
+   - "The Admin tab is what each pizzeria's admin gets: their own API keys and people, kept apart."
+   Then ask one question: **"Want to put your own app on the internet like this?"**
 4. If it prints \u2717, say its one sentence and run the one command it gives, once.
 
 Rules for the demo: keep each update to one line. Do not narrate steps, read the demo's
@@ -8003,6 +8026,7 @@ in \`.env.local\` and never prints it.
 
 ## Their own app: they say yes to that
 
+Their app runs on this machine \u2192 it will use \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
 Run \`${run2} skills --ship\` and follow what it prints.
 `;
 }
@@ -12867,6 +12891,7 @@ async function runDomainSetBase(project, opts) {
 var import_chalk53 = __toESM(require("chalk"));
 var import_ora22 = __toESM(require("ora"));
 init_admin();
+init_caller();
 init_resolve();
 init_auth();
 init_tenant_pick();
@@ -12929,10 +12954,11 @@ async function runTenantCreate(opts) {
     console.error(import_chalk53.default.red("--name (display name) is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
   const spinner = (0, import_ora22.default)("Creating tenant...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "POST",
       path: `/teams/${encodeURIComponent(teamId)}/tenants`,
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
@@ -12950,11 +12976,12 @@ async function runTenantAttach(project, opts) {
     console.error(import_chalk53.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
   const spinner = (0, import_ora22.default)("Attaching tenant...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "POST",
       path: `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`,
       body: { tenant_name: opts.tenant, ...opts.authConfig ? { auth_config_id: opts.authConfig } : {} },
@@ -17377,7 +17404,7 @@ program.command("login").description(`Authenticate with ${B.product}`).option("-
     process.exit(1);
   }
 });
-program.command("create").description(`Create a new ${B.thing} \u2014 both doors open by default (an API key for your backend and widget, GitHub sign-in for people and agents) and resources locked to their creator (no login needed: logged out it creates an anonymous ${B.thingShort} you can claim)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -17386,8 +17413,10 @@ program.command("create").description(`Create a new ${B.thing} \u2014 both doors
   }
 });
 program.command("integration").description(`What to add to your frontend and frontend-server for ${B.cli === "mcpblaze" ? "an MCP server" : "a proxy"} \u2014 the same kit the ${B.product} MCP hands an agent: widgets, the call-through with the key + X-End-User-Id, what your backend must trust, env vars, what stays open`).argument("<name>", `The ${B.thingShort} (project name)`).option("--stack <stack>", "nextjs | express | fastapi | other", "nextjs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--json", "Print the raw kit as JSON").action(action((name, opts) => runIntegration(name, opts)));
-program.command("demo").description(`See what ${B.product} does in 30 seconds: a small booking app on this machine, with ${B.product} in front of it (no login, no prompts)`).argument("[action]", '"stop" stops a running demo').option("--no-open", "Do not open the browser").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
+program.command("demo").description(`See what ${B.product} does in 30 seconds: a small booking app on this machine, with ${B.product} in front of it (no login, no prompts)`).argument("[action]", "stop \xB7 start / restart (the same demo again: same addresses and keys) \xB7 logs (follow the requests reaching your laptop)").option("--no-open", "Do not open the browser").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
   if (actionArg === "stop") return runDemoStop();
+  if (actionArg === "start" || actionArg === "restart") return runDemoStart(opts);
+  if (actionArg === "logs") return runDemoLogs();
   if (actionArg) {
     console.log(`Unknown demo action "${actionArg}". Run: npx ${B.cli}@latest demo`);
     process.exit(1);
@@ -17429,7 +17458,7 @@ withSetupOptions(sidecar.command("setup").description(`Wire a Next.js app to rou
 sidecar.command("approve").description(`Route an origin through ${B.product} (creates its proxy)`).argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Machine-readable output").action(action((origin, opts, cmd) => runOriginsApprove(origin, { ...cmd.parent?.opts(), ...opts })));
 sidecar.command("deny").description("Dismiss a candidate origin so it stops being suggested").argument("<origin>", "Origin, e.g. sentry.io").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts, cmd) => runOriginsDeny(origin, { ...cmd.parent?.opts(), ...opts })));
 sidecar.command("remove").description("Un-route an approved origin (deletes its proxy; the app goes direct again)").argument("<origin>", "Origin, e.g. api.stripe.com").option("--team <id|name>", "Team (defaults to active team)").action(action((origin, opts, cmd) => runOriginsRemove(origin, { ...cmd.parent?.opts(), ...opts })));
-program.command("dev").description(`Put the code running on this machine behind ${B.product}: everything \`create\` does \u2014 both doors, resources locked to their creator, an admin, an agent connected \u2014 with localhost as the target, through a tunnel (no login needed)`).argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port your server listens on", "3000").option("--openapi <file|url>", "Your OpenAPI spec (a local file or a URL). Omitted \u2192 looks for /openapi.json, /openapi.yaml, /docs/openapi.json on that port. Rules need one.").option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com); omitted \u2192 one short question with a generated default" : "Proxy name (becomes <name>.abz.run); omitted \u2192 one short question with a generated default").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new)`).option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in). With --oauth <config>: BOTH doors, sign-in through your own app or issuer").option("--oauth [config]", "Sign-in door only (no API key). Same shapes as `create --oauth`.").option("--auto", "Every answer = the default: generated name, both doors, every resource locked, no admin, no agent. No prompts, no TTY needed.").option("--project <nameOrId>", "Re-attach this existing localhost project (skips the picker \u2014 for scripts)").option("-y, --yes", "Skip the confirmation when one project already points at this machine").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").option("--new-session", "Logged-out only: start a fresh anonymous workspace instead of reusing this machine's (each run = a throwaway proxy)").action(async (port, opts) => {
+program.command("dev").description(`Put the app running on THIS machine on the internet: a public URL and an MCP address for AI agents, tunnelled to localhost. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (Deployed app? Use \`create\`.)`).argument("[port]", "Local port to tunnel (positional; overrides --port)").option("-p, --port <number>", "Local port your server listens on", "3000").option("--openapi <file|url>", "Your OpenAPI spec (a local file or a URL). Omitted \u2192 looks for /openapi.json, /openapi.yaml, /docs/openapi.json on that port. Rules need one.").option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com); omitted \u2192 one short question with a generated default" : "Proxy name (becomes <name>.abz.run); omitted \u2192 one short question with a generated default").option("--team <id|name>", "Team to create under (defaults to your active team)").option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new)`).option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in). With --oauth <config>: BOTH doors, sign-in through your own app or issuer").option("--oauth [config]", "Sign-in door only (no API key). Same shapes as `create --oauth`.").option("--auto", "Every answer = the default: generated name, both doors, every resource locked, no admin, no agent. No prompts, no TTY needed.").option("--project <nameOrId>", "Re-attach this existing localhost project (skips the picker \u2014 for scripts)").option("-y, --yes", "Skip the confirmation when one project already points at this machine").option("-o, --capture-file <path>", "Stream full request/response traffic to a file (JSON lines)").option("--new-session", "Logged-out only: start a fresh anonymous workspace instead of reusing this machine's (each run = a throwaway proxy)").action(async (port, opts) => {
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {