apiblaze 0.21.25 → 0.21.27

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.25";
+    version = "0.21.27";
   }
 });
 
@@ -6366,16 +6366,16 @@ var init_files = __esm({
     "use strict";
     DEMO_FILES = {
       "README.md": "# Nino's Pizza: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Your API is live on the internet.** The backend runs on your laptop; APIblaze gives it a public\n   URL and an MCP address for AI assistants. A live ticker shows each request reaching your laptop.\n2. **An AI assistant uses it.** Ask it to book a table and watch the request arrive.\n3. **Included, no code:** only the owner can change a booking, each customer (Nino Pizza,\n   Gino Pizza) is separate, rate limits, sign-in, and drop-in widgets for API keys and roles.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | Its endpoints. APIblaze builds the AI tools and the ownership rules from it. |\n| `app.js` | The website's server. Calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\n`npx apiblaze@latest demo` also adds `lib/apiblaze-server.js` and `public/apiblaze-widgets.js`, the same\nhelpers you get from `npm i apiblaze`. Stop the demo with `npx apiblaze@latest demo stop`.\n",
-      "openapi.yaml": "openapi: 3.0.3\ninfo:\n  title: Nino's Pizza API\n  version: 1.0.0\n  description: Table bookings at Nino's Pizza. APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.\npaths:\n  /reservations:\n    get:\n      operationId: listReservations\n      summary: List my bookings\n      responses:\n        '200':\n          description: The caller's bookings\n          content:\n            application/json:\n              schema:\n                type: array\n                items: { $ref: '#/components/schemas/Reservation' }\n    post:\n      operationId: createReservation\n      summary: Book a table\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema: { $ref: '#/components/schemas/NewReservation' }\n      responses:\n        '201':\n          description: Booked\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n  /reservations/{id}:\n    parameters:\n      - { name: id, in: path, required: true, schema: { type: string } }\n    get:\n      operationId: getReservation\n      summary: Get one booking\n      responses:\n        '200':\n          description: The booking\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n    delete:\n      operationId: cancelReservation\n      summary: Cancel a booking\n      responses:\n        '204': { description: Cancelled }\ncomponents:\n  schemas:\n    NewReservation:\n      type: object\n      required: [table, time]\n      properties:\n        name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }\n        table: { type: integer, example: 4 }\n        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }\n        guests: { type: integer, example: 2, description: 'How many people' }\n    Reservation:\n      allOf:\n        - $ref: '#/components/schemas/NewReservation'\n        - type: object\n          properties:\n            id: { type: string, example: r1 }\n",
-      "backend.js": "// Nino's Pizza backend: book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || 1,\n      time: String(input.time || '19:30'), guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row);\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'DELETE') { bookings.delete(id); return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
-      "app.js": "// Nino's Pizza website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
-      "start.js": "// Starts the pizzeria on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('The pizzeria is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped the pizzeria (backend and website).');\n}\nfunction background() {\n  if (runningPid()) { console.log('The pizzeria is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started the pizzeria: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`Pizzeria running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
+      "openapi.yaml": "openapi: 3.0.3\ninfo:\n  title: ResiResi API\n  version: 1.0.0\n  description: Table bookings at restaurants (each restaurant is a tenant, like Nino Pizza and Gino Pizza). APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.\npaths:\n  /reservations:\n    get:\n      operationId: listReservations\n      summary: List my bookings\n      responses:\n        '200':\n          description: The caller's bookings\n          content:\n            application/json:\n              schema:\n                type: array\n                items: { $ref: '#/components/schemas/Reservation' }\n    post:\n      operationId: createReservation\n      summary: Book a table\n      description: Only the time is needed. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema: { $ref: '#/components/schemas/NewReservation' }\n      responses:\n        '201':\n          description: Booked\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n  /reservations/{id}:\n    parameters:\n      - { name: id, in: path, required: true, schema: { type: string } }\n    get:\n      operationId: getReservation\n      summary: Get one booking\n      responses:\n        '200':\n          description: The booking\n          content:\n            application/json:\n              schema: { $ref: '#/components/schemas/Reservation' }\n    delete:\n      operationId: cancelReservation\n      summary: Cancel a booking\n      responses:\n        '204': { description: Cancelled }\ncomponents:\n  schemas:\n    NewReservation:\n      type: object\n      required: [time]\n      properties:\n        name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }\n        table: { type: integer, example: 4, description: 'Optional: the restaurant picks a free table. Do not ask for it.' }\n        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }\n        guests: { type: integer, example: 2, description: 'How many people. Optional, 2 if not given.' }\n    Reservation:\n      allOf:\n        - $ref: '#/components/schemas/NewReservation'\n        - type: object\n          properties:\n            id: { type: string, example: r1 }\n",
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant picks the table: the lowest one still free at that time, at that restaurant.\nfunction freeTable(tenant, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, time),\n      time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
+      "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
       "public/index.html": `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Nino's Pizza demo</title>
+<title>ResiResi demo</title>
 <style>
   :root {
     --bg: #faf7f2; --card: #fff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9; --soft: #f3eee6;
@@ -6443,25 +6443,27 @@ var init_files = __esm({
   .next a { color: var(--accent); cursor: pointer; text-decoration: none; font-weight: 600; }
   .next code { font-family: var(--mono); font-size: 13px; }
   .stack { display: grid; gap: 16px; }
+  button.copy { font-size: 11.5px; padding: 1px 8px; border-radius: 8px; border: 1px solid var(--line); background: var(--card); color: var(--ink); cursor: pointer; vertical-align: 1px; }
+  button.copy:hover { border-color: var(--muted); }
 </style>
 </head>
 <body>
 <main>
   <div class="mode" role="group" aria-label="How the website reaches the backend">
     <button class="protected" id="mode-protected" aria-pressed="true">
-      <img src="/apiblaze-logo.svg" alt="APIblaze"><span><b>Protected and enhanced by APIblaze</b><small>keys, rules, tenants, AI tools</small></span>
+      <img src="/apiblaze-logo.svg" alt="APIblaze"><span><b>Protected and enhanced by APIblaze</b><small>on the internet, AI-ready (MCP), keys, sign-in, tenants, rules, limits</small></span>
     </button>
     <button class="direct" id="mode-direct" aria-pressed="false">
-      <span class="icon">\u26A0</span><span><b>Direct to localhost, unprotected</b><small>no APIblaze: anyone can do anything</small></span>
+      <span class="icon">\u26A0</span><span><b>Direct to localhost, unprotected</b><small>this laptop only: no public address, no AI access, no keys, no rules</small></span>
     </button>
   </div>
   <div class="live" id="live-protected">
-    <div>API <code id="api">\u2026</code> <span class="arrow">\u2014 APIblaze tunnel \u2192</span> <code id="local">localhost</code></div>
-    <div>MCP <code id="mcp">\u2026</code> <span>for AI assistants, at <span class="pz-name">Nino Pizza</span></span></div>
-    <div>Dev portal <a id="portal-top" target="_blank" rel="noopener"><code id="portal-url">\u2026</code></a> <span>sign in, get a key, try the API</span></div>
+    <div>API <code id="api">\u2026</code> <button class="copy" data-copy="#api">Copy</button> <span class="arrow">\u2014 APIblaze tunnel \u2192</span> <code id="local">localhost</code></div>
+    <div>MCP <code id="mcp">\u2026</code> <button class="copy" data-copy="#mcp">Copy</button> <span>for AI assistants, at <span class="pz-name">Nino Pizza</span></span></div>
+    <div>Dev portal <a id="portal-top" target="_blank" rel="noopener"><code id="portal-url">\u2026</code></a> <button class="copy" data-copy="#portal-url">Copy</button> <span>sign in, get a key, try the API</span></div>
   </div>
   <div class="live" id="live-direct" hidden>
-    <div>Calling <code id="local2">localhost</code> directly with the backend secret. No API keys, no rules, no tenants checked.</div>
+    <div>Calling <code id="local2">localhost</code> <button class="copy" data-copy="#local2">Copy</button> directly with the backend secret. Only this laptop can reach it: no public address, no MCP for AI assistants, no API keys or sign-in, no tenants, rules or limits.</div>
   </div>
 
   <div class="bar">
@@ -6495,7 +6497,7 @@ var init_files = __esm({
       </div>
       <div class="card chatcard"><div id="chat"></div><div class="note" id="chat-off" hidden>The assistant only reaches your app through APIblaze (its MCP address). Switch back to <b>Protected</b> to chat.</div></div>
     </div>
-    <p class="next"><span id="foot-protected">Every request here reaches your laptop through APIblaze: <code id="logs-cmd">npx apiblaze@latest logs</code> shows them live.</span><span id="foot-direct" hidden>Every request here goes straight to <code class="local3">localhost</code>, skipping APIblaze: nothing checks who is asking.</span> Next: <a id="go-admin">the admin side \u2192</a></p>
+    <p class="next"><span id="foot-protected">Every request here reaches your laptop through APIblaze: <code id="logs-cmd">npx apiblaze@latest logs</code> shows them live.</span><span id="foot-direct" hidden>Every request here goes straight to <code class="local3">localhost</code>: nobody outside this laptop can reach it, AI assistants cannot use it, and nothing checks who is asking.</span> Next: <a id="go-admin">the admin side \u2192</a></p>
   </section>
 
   <!-- ADMIN: what each pizzeria's admin sees -->
@@ -6517,11 +6519,10 @@ const theme = { accent: '#e4572e' };
 // Every switch (pizzeria, tab, person) is a fresh page load, the choice kept in the address:
 // ?pizzeria=gino&as=ben#admin. Nothing half-mounted is ever left behind.
 const params = new URLSearchParams(location.search);
-const state = { direct: false, pizzeria: params.get('pizzeria') || 'nino', tab: location.hash === '#admin' ? 'admin' : 'app' };
+const state = { direct: false, pizzeria: params.get('pizzeria') || 'nino', tab: (params.get('tab') || (location.hash === '#admin' ? 'admin' : 'app')) === 'admin' ? 'admin' : 'app' };
 function reloadWith(next) {
-  const p = new URLSearchParams({ pizzeria: next.pizzeria ?? state.pizzeria, as: next.as ?? $('#as').value });
-  location.href = \`\${location.pathname}?\${p}\${(next.tab ?? state.tab) === 'admin' ? '#admin' : ''}\`;
-  if ((next.tab ?? state.tab) !== state.tab && !next.pizzeria && !next.as) location.reload(); // a hash-only change does not reload by itself
+  const p = new URLSearchParams({ pizzeria: next.pizzeria ?? state.pizzeria, as: next.as ?? $('#as').value, tab: next.tab ?? state.tab });
+  location.assign(\`\${location.pathname}?\${p}\`);
 }
 let cfg = null;
 const ready = fetch('/api/config').then((r) => r.json()).then((c) => { cfg = c; return c; });
@@ -6531,6 +6532,15 @@ const me = () => $('#as').value;
 const pz = () => (cfg?.pizzerias || []).find((p) => p.id === state.pizzeria) || { label: 'Nino Pizza', admin: 'Ana' };
 const anaBooking = {};
 
+// Copy buttons: every address on the page.
+document.querySelectorAll('button.copy').forEach((b) => b.onclick = async () => {
+  const el = $(b.dataset.copy);
+  const text = (el.textContent || '').trim().replace(/^localhost/, 'http://localhost');
+  try { await navigator.clipboard.writeText(text); }
+  catch { const r = document.createRange(); r.selectNodeContents(el); const sel = getSelection(); sel.removeAllRanges(); sel.addRange(r); document.execCommand('copy'); sel.removeAllRanges(); }
+  b.textContent = 'Copied'; setTimeout(() => { b.textContent = 'Copy'; }, 1200);
+});
+
 // \u2500\u2500 mode (which site this is), pizzeria, tab \u2500\u2500
 // The two websites are two servers: the protected one through APIblaze and the unprotected one
 // straight to the backend. The switch at the top goes from one to the other.
@@ -6540,7 +6550,7 @@ function setMode(direct) {
   $('#live-protected').hidden = direct; $('#live-direct').hidden = !direct;
   $('#foot-protected').hidden = direct; $('#foot-direct').hidden = !direct;
 }
-function goTo(url) { if (url) location.href = url + location.search + location.hash; }
+function goTo(url) { if (url) location.assign(url + location.search); }
 $('#mode-protected').onclick = () => { if (state.direct) goTo(cfg.protectedUrl); };
 $('#mode-direct').onclick = () => { if (!state.direct) goTo(cfg.directUrl); };
 function setTab(tab) {
@@ -6570,7 +6580,8 @@ async function refresh() {
   const rows = Array.isArray(r.body) ? r.body : [];
   if (me() === 'ana') anaBooking[state.pizzeria] = rows.length ? rows[0].id : null;
   const ul = $('#list'); ul.replaceChildren();
-  if (r.status && r.status !== 200) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'Could not load reservations (HTTP ' + r.status + ').'; ul.append(li); }
+  if (r.status === 402) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'This demo has used its free requests. For a fresh one, run: npx apiblaze@latest demo'; ul.append(li); }
+  else if (r.status && r.status !== 200) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'Could not load reservations (HTTP ' + r.status + ').'; ul.append(li); }
   else if (!rows.length) { const li = document.createElement('li'); li.className = 'empty'; li.textContent = 'No reservations yet.'; ul.append(li); }
   for (const b of rows) {
     const li = document.createElement('li');
@@ -6586,7 +6597,7 @@ async function refresh() {
 $('#book').onclick = async () => {
   const guests = Math.max(1, Number($('#guests').value) || 2);
   const time = $('#time').value || '19:30';
-  await act('book', { body: { guests, time, table: 4 } });
+  await act('book', { body: { guests, time } }); // the restaurant picks the table
   refresh();
 };
 $('#ben-cancel').onclick = async () => {
@@ -6599,7 +6610,16 @@ $('#ben-cancel').onclick = async () => {
 };
 $('#as').onchange = () => reloadWith({ as: $('#as').value });
 if (params.get('as')) $('#as').value = params.get('as');
-setInterval(() => { if (state.tab === 'app') refresh(); }, 2000); // the assistant's bookings appear here
+// The assistant's bookings appear here. Every 2 s the page asks this laptop (free) whether a
+// booking changed, and re-lists through APIblaze only when one did: an idle page spends nothing.
+let lastChange = null;
+setInterval(async () => {
+  if (state.tab !== 'app' || document.hidden) return;
+  const c = await fetch('/api/changes').then((x) => x.json()).catch(() => null);
+  if (!c) return;
+  if (lastChange !== null && c.n !== lastChange) refresh();
+  lastChange = c.n;
+}, 2000);
 
 // \u2500\u2500 chat \u2500\u2500
 let chatKey = '';
@@ -7486,6 +7506,25 @@ function writeRegistry(rows) {
   } catch {
   }
 }
+function registerDemo(dir, pid = 0) {
+  writeRegistry([...readRegistry().filter((r) => r.dir !== dir), { dir, pid }]);
+}
+async function waitPorts(ports, ms2 = 1e4) {
+  const listening = (port) => new Promise((resolve4) => {
+    const sock = import_net.default.connect({ port, host: "127.0.0.1" });
+    sock.once("connect", () => {
+      sock.destroy();
+      resolve4(true);
+    });
+    sock.once("error", () => resolve4(false));
+  });
+  const until = Date.now() + ms2;
+  for (; ; ) {
+    if ((await Promise.all(ports.map(listening))).every(Boolean)) return true;
+    if (Date.now() > until) return false;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+}
 async function stopTunnels() {
   const rows = readRegistry();
   let stopped = 0;
@@ -7632,6 +7671,24 @@ async function waitThrough(apiUrl, serverKey) {
   }
   throw new DemoError(`The demo is running but ${B.product} cannot reach it yet (last answer ${last}).`, `Run again: ${LATEST} demo`);
 }
+async function confirmStep(opts, question) {
+  if (opts.yes || !interactive()) return true;
+  console.log();
+  return ask(`${import_chalk27.default.bold("?")} ${question} ${import_chalk27.default.dim("(Y/n)")} `);
+}
+async function busy(text, fn, minMs = 0) {
+  if (!process.stdout.isTTY) return fn();
+  const t = Date.now();
+  const spinner = (0, import_ora10.default)({ text: import_chalk27.default.dim(text), indent: 3, discardStdin: false }).start();
+  try {
+    const out = await fn();
+    const left = minMs - (Date.now() - t);
+    if (left > 0) await new Promise((r) => setTimeout(r, left));
+    return out;
+  } finally {
+    spinner.stop();
+  }
+}
 async function ask(question) {
   const readline3 = await import("readline");
   const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
@@ -7649,7 +7706,7 @@ function openBrowser3(url) {
   }
 }
 async function offerBrowserAndLogs(dir, opts) {
-  if (opts.open === false || !interactive()) return;
+  if (opts.open === false || opts.yes || !interactive()) return;
   const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
   const url = `http://localhost:${env.APP_PORT}`;
   console.log();
@@ -7697,9 +7754,9 @@ async function runDemo(opts = {}) {
   }
 }
 function printTable(rows) {
-  const width = Math.max(100, Math.min(process.stdout.columns || 140, 200));
-  const leftW = 64;
-  const rightW = Math.max(30, width - leftW - 8);
+  const width = Math.max(100, Math.min(process.stdout.columns || 140, 220));
+  const leftW = Math.min(64, Math.max(...rows.map((r) => `\u2713 ${r.label.padEnd(17)} ${r.what}`.length)));
+  const rightW = Math.max(40, width - leftW - 8);
   const wrap2 = (text) => {
     const out = [];
     let line = "";
@@ -7713,13 +7770,13 @@ function printTable(rows) {
     return out;
   };
   const head = (l, r) => console.log(`   ${import_chalk27.default.dim(l.padEnd(leftW))}  ${import_chalk27.default.dim(r)}`);
-  head("What APIblaze set up", `The command that does the same: ${LATEST} \u2026`);
+  head(`What ${B.product} set up`, "The command that does the same");
   head("\u2500".repeat(leftW), "\u2500".repeat(Math.min(rightW, 60)));
   for (const r of rows) {
     const left = `${import_chalk27.default.green("\u2713")} ${import_chalk27.default.bold(r.label.padEnd(17))} ${r.what}`;
     const leftPlain = `\u2713 ${r.label.padEnd(17)} ${r.what}`;
     const right = r.cmds.length ? r.cmds.flatMap(wrap2) : ["\u2014"];
-    console.log(`   ${left}${" ".repeat(Math.max(1, leftW - leftPlain.length))}  ${import_chalk27.default.cyan(right[0])}`);
+    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk27.default.cyan(right[0])}`);
     for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk27.default.cyan(extra)}`);
   }
 }
@@ -7731,6 +7788,10 @@ async function startDemo(opts) {
   const cdDir = rel === "." ? "" : `cd ${rel} && `;
   const shell = (c, note = "") => console.log(`   ${import_chalk27.default.dim("$")} ${import_chalk27.default.cyan(c)}${note ? `   ${import_chalk27.default.dim(note)}` : ""}`);
   const ok = (text, note = "") => console.log(`   ${import_chalk27.default.green("\u2713")} ${text}${note ? `   ${import_chalk27.default.dim(note)}` : ""}`);
+  const stopHere = (lines) => {
+    console.log();
+    for (const l of lines) console.log(`  ${l}`);
+  };
   await stopDemos();
   writeApp(dir);
   const appPort = await freePort(3e3);
@@ -7740,56 +7801,74 @@ async function startDemo(opts) {
   const ninoTenant = `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`;
   const backendSecret = import_crypto.default.randomBytes(18).toString("base64url");
   const openapi = DEMO_FILES["openapi.yaml"];
-  const L = (c) => c;
+  const L = (c) => `${LATEST} ${c}`;
   writeEnv(dir, { BACKEND_SECRET: backendSecret, DEMO_NINO_TENANT: ninoTenant, APP_PORT: appPort, BACKEND_PORT: backendPort, DIRECT_PORT: directPort });
   console.log();
-  console.log(import_chalk27.default.bold(`1. The app: Nino's Pizza, a table-booking app on this laptop, in ${rel}`) + import_chalk27.default.dim("   (no APIblaze yet)"));
-  console.log("   Its routes, from openapi.yaml:");
-  for (const r2 of routesOf(openapi)) console.log(`     ${r2.method.padEnd(7)}${r2.path.padEnd(21)}${import_chalk27.default.dim(r2.summary)}`);
+  console.log(import_chalk27.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk27.default.dim(`   (no ${B.product} yet)`));
+  console.log(`   Written to ${rel}. Its routes, from openapi.yaml:`);
+  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk27.default.dim(r.summary)}`);
   console.log(import_chalk27.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
   shell(`${cdDir}npm run start`, "npm run stop \xB7 npm run restart");
-  if (!appCtl(dir, "--background")) throw new DemoError("The pizzeria app could not start.", `Run again: ${LATEST} demo`);
+  if (!appCtl(dir, "--background")) throw new DemoError("The ResiResi app could not start.", `Run again: ${LATEST} demo`);
+  registerDemo(dir);
+  const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort, directPort]), 1800);
+  if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path4.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`);
   ok(`${import_chalk27.default.bold("Reservation backend")}: localhost:${backendPort}`, "unprotected");
   ok(`${import_chalk27.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk27.default.bold(`http://localhost:${directPort}`)}`);
   console.log("   Book a table directly, the way the unprotected front-end does:");
   console.log(import_chalk27.default.cyan(`     curl -X POST http://localhost:${backendPort}/reservations \\`));
   console.log(import_chalk27.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path4.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
   console.log(import_chalk27.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
-  console.log(import_chalk27.default.cyan(`       -H "content-type: application/json" -d '{"table":4,"time":"19:30","guests":2}'`));
+  console.log(import_chalk27.default.cyan(`       -H "content-type: application/json" -d '{"time":"19:30","guests":2}'`));
+  if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
+    return stopHere([
+      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk27.default.dim(`(${cdDir}npm run stop stops it)`)}`,
+      `Run the whole demo again any time: ${LATEST} demo`
+    ]);
+  }
   console.log();
   console.log(import_chalk27.default.bold(`2. ${B.product}, in front of it`));
   const tCreate = Date.now();
-  const r = await createProxy2(name, backendPort, openapi, ninoTenant);
-  const cpKey = r.cp_key;
-  const teamId = r.team_id;
-  const keys = r.api_keys ?? {};
-  const serverKey = r.apiKey ?? keys.dev ?? Object.values(keys)[0];
-  const project = r.project_id ?? name;
-  const version2 = r.api_version || "1.0.0";
-  const rr = r;
-  const tenant2 = rr.tenant ?? tenantFromPortal(rr.portal ?? rr.devPortal) ?? "";
-  const missing = [!cpKey && "workspace key", !teamId && "team", !serverKey && "API key", !tenant2 && "tenant"].filter(Boolean);
-  if (missing.length) throw new DemoError(`${B.product} did not return everything the demo needs (${missing.join(", ")}).`, `Run again: ${LATEST} demo`);
-  const createSecs = ((Date.now() - tCreate) / 1e3).toFixed(1);
-  adoptWorkspace(cpKey, teamId, rr.claim_code);
-  const cp = (p, init) => cpFetch(cpKey, p, init).then(() => true).catch(() => false);
+  const setup = await busy(`Creating the proxy, its tenants, admins, rules and limits\u2026`, async () => {
+    const r = await createProxy2(name, backendPort, openapi, ninoTenant);
+    const cpKey2 = r.cp_key;
+    const teamId2 = r.team_id;
+    const keys = r.api_keys ?? {};
+    const serverKey2 = r.apiKey ?? keys.dev ?? Object.values(keys)[0];
+    const project2 = r.project_id ?? name;
+    const version3 = r.api_version || "1.0.0";
+    const rr = r;
+    const tenant3 = rr.tenant ?? tenantFromPortal(rr.portal ?? rr.devPortal) ?? "";
+    const missing = [!cpKey2 && "workspace key", !teamId2 && "team", !serverKey2 && "API key", !tenant3 && "tenant"].filter(Boolean);
+    if (missing.length) throw new DemoError(`${B.product} did not return everything the demo needs (${missing.join(", ")}).`, `Run again: ${LATEST} demo`);
+    const createSecs2 = ((Date.now() - tCreate) / 1e3).toFixed(1);
+    adoptWorkspace(cpKey2, teamId2, rr.claim_code);
+    const cp = (p, init) => cpFetch(cpKey2, p, init).then(() => true).catch(() => false);
+    const gino2 = (rr.tenants ?? []).find((t) => t.api_key);
+    const [adminOk2, ginaOk2, { limited: limited2, secretOk }] = await Promise.all([
+      cp(`/teams/${encodeURIComponent(teamId2)}/tenants/${encodeURIComponent(tenant3)}/admin-emails`, { method: "POST", body: JSON.stringify({ email: DEMO_ADMIN_EMAIL }) }),
+      gino2?.tenant ? cp(`/teams/${encodeURIComponent(teamId2)}/tenants/${encodeURIComponent(gino2.tenant)}/admin-emails`, { method: "POST", body: JSON.stringify({ email: DEMO_GINO_ADMIN_EMAIL }) }) : Promise.resolve(false),
+      (async () => {
+        const lim = await cp(`/projects/${encodeURIComponent(project2)}/${encodeURIComponent(version3)}/limits`, { method: "PUT", body: JSON.stringify({ consumerRps: DEMO_RPS, endUserRps: DEMO_RPS }) });
+        const sec = await cp(`/projects/${encodeURIComponent(project2)}/${encodeURIComponent(version3)}/transforms`, {
+          method: "POST",
+          body: JSON.stringify({
+            name: "set header x-target-api-key",
+            phase: "request",
+            enabled: true,
+            action: { type: "hardcode", destination: "header:x-target-api-key", value: backendSecret, value_secret: true }
+          })
+        });
+        return { limited: lim, secretOk: sec };
+      })()
+    ]);
+    if (!secretOk) throw new DemoError(`Could not give ${B.product} the backend secret.`, `Run again: ${LATEST} demo`);
+    return { cpKey: cpKey2, teamId: teamId2, serverKey: serverKey2, project: project2, version: version3, tenant: tenant3, gino: gino2, createSecs: createSecs2, adminOk: adminOk2, ginaOk: ginaOk2, limited: limited2, claimCode: rr.claim_code, applied: rr.secure?.applied ?? [] };
+  });
+  const { cpKey, teamId, serverKey, project, version: version2, tenant: tenant2, gino, createSecs, adminOk, ginaOk, limited } = setup;
   const apiUrl = restUrl(project, version2, "dev", { anon: true });
-  const gino = (rr.tenants ?? []).find((t) => t.api_key);
   const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
-  const adminOk = await cp(`/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/admin-emails`, { method: "POST", body: JSON.stringify({ email: DEMO_ADMIN_EMAIL }) });
-  const ginaOk = gino?.tenant ? await cp(`/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(gino.tenant)}/admin-emails`, { method: "POST", body: JSON.stringify({ email: DEMO_GINO_ADMIN_EMAIL }) }) : false;
-  const limited = await cp(`/projects/${encodeURIComponent(project)}/${encodeURIComponent(version2)}/limits`, { method: "PUT", body: JSON.stringify({ consumerRps: DEMO_RPS, endUserRps: DEMO_RPS }) });
-  const secretOk = await cp(`/projects/${encodeURIComponent(project)}/${encodeURIComponent(version2)}/transforms`, {
-    method: "POST",
-    body: JSON.stringify({
-      name: "set header x-target-api-key",
-      phase: "request",
-      enabled: true,
-      action: { type: "hardcode", destination: "header:x-target-api-key", value: backendSecret, value_secret: true }
-    })
-  });
-  if (!secretOk) throw new DemoError(`Could not give ${B.product} the backend secret.`, `Run again: ${LATEST} demo`);
-  const applied = (rr.secure?.applied ?? []).map((k) => k.replace(/^\//, "").split("/")[0]);
+  const applied = setup.applied.map((k) => k.replace(/^\//, "").split("/")[0]);
   const tools = routesOf(openapi).map((x) => x.op).filter(Boolean);
   writeEnv(dir, {
     APIBLAZE_NAME: project,
@@ -7808,7 +7887,7 @@ async function startDemo(opts) {
     BACKEND_PORT: backendPort,
     DIRECT_PORT: directPort
   });
-  const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort, apiUrl, claimCode: rr.claim_code };
+  const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort, apiUrl, claimCode: setup.claimCode };
   saveState(dir, state);
   printTable([
     { label: "Proxy", what: `${project} (${createSecs} s, no account)`, cmds: [L(`dev --port ${backendPort} --openapi ./openapi.yaml --name ${name} --tenant ${ninoTenant} --auto`)] },
@@ -7828,18 +7907,36 @@ async function startDemo(opts) {
     { label: "Backend secret", what: "added to every call APIblaze forwards", cmds: [L(`transform ${project} set-header x-target-api-key --value-env BACKEND_SECRET --secret`)] },
     { label: "Keys", what: "saved to .env.local, never printed", cmds: [] }
   ]);
+  if (!await confirmStep(opts, `Ok to create a tunnel allowing ${project} to forward requests to localhost:${backendPort}?`)) {
+    return stopHere([
+      `Stopped before the tunnel. The proxy exists but cannot reach this laptop yet.`,
+      `Open the tunnel any time: ${LATEST} demo start`
+    ]);
+  }
   console.log();
   console.log(import_chalk27.default.bold("3. Live on the internet"));
   shell(`${LATEST} dev --port ${backendPort} --project ${project} --auto`, "the tunnel, in the background");
-  await spawnTunnel(dir, state);
-  await waitThrough(apiUrl, serverKey);
+  await busy(`Opening the tunnel to localhost:${backendPort} and checking it with a real call\u2026`, async () => {
+    await spawnTunnel(dir, state);
+    await waitThrough(apiUrl, serverKey);
+  }, 1200);
   ok(`${import_chalk27.default.bold("Tunnel")}: the public address reaches localhost:${backendPort} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
   printAddresses(dir);
+  if (!await confirmStep(opts, "Ok to launch the protected website, which will use the proxy to reach the backend?")) {
+    return stopHere([
+      `Stopped before the protected website. The API and MCP addresses above work now.`,
+      `Start the website any time: ${cdDir}npm run restart`
+    ]);
+  }
   console.log();
   console.log(import_chalk27.default.bold(`4. The protected website, through ${B.product}`));
   shell(`${cdDir}npm run restart`, "picks up the keys in .env.local");
-  appCtl(dir, "--stop");
-  appCtl(dir, "--background");
+  const siteUp = await busy("Starting the protected website\u2026", async () => {
+    appCtl(dir, "--stop");
+    appCtl(dir, "--background");
+    return waitPorts([appPort, directPort, backendPort]);
+  }, 1500);
+  if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path4.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`);
   ok(`${import_chalk27.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk27.default.bold(`http://localhost:${appPort}`)}`);
   ok(`${import_chalk27.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
   console.log();
@@ -7858,7 +7955,7 @@ async function spawnTunnel(dir, state) {
   const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
   child.unref();
   saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
-  writeRegistry([...readRegistry().filter((r) => r.dir !== dir), { dir, pid: child.pid ?? 0 }]);
+  registerDemo(dir, child.pid ?? 0);
   await waitTunnel(dir);
 }
 async function runDemoStart(opts = {}) {
@@ -7883,7 +7980,7 @@ async function runDemoStart(opts = {}) {
   console.log(`${import_chalk27.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk27.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
   printAddresses(dir);
   const appUp = await fetch(`http://127.0.0.1:${env.APP_PORT}/api/config`).then(() => true).catch(() => false);
-  if (!appUp) console.log(import_chalk27.default.yellow(`   The pizzeria app is not running: cd ${import_path4.default.relative(process.cwd(), dir) || "."} && npm run start`));
+  if (!appUp) console.log(import_chalk27.default.yellow(`   ResiResi is not running: cd ${import_path4.default.relative(process.cwd(), dir) || "."} && npm run start`));
   await offerBrowserAndLogs(dir, opts);
 }
 async function runDemoLogs() {
@@ -7899,7 +7996,7 @@ async function runDemoLogs() {
 }
 async function runDemoStop() {
   const n = await stopTunnels();
-  console.log(n ? `${import_chalk27.default.green("\u2713")} Stopped the tunnel. The pizzeria app still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
+  console.log(n ? `${import_chalk27.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
 }
 async function serveTunnel(dir) {
   const state = loadState(dir);
@@ -7957,7 +8054,7 @@ async function serveTunnel(dir) {
   await new Promise(() => {
   });
 }
-var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_chalk27, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
+var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_chalk27, import_ora10, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
@@ -7967,6 +8064,7 @@ var init_demo = __esm({
     import_child_process4 = require("child_process");
     import_crypto = __toESM(require("crypto"));
     import_chalk27 = __toESM(require("chalk"));
+    import_ora10 = __toESM(require("ora"));
     init_api();
     init_tunnel_client();
     init_auth();
@@ -8083,7 +8181,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     if (a.callbacks.trim()) clientBody.authorizedCallbackUrls = a.callbacks.split(/\s*,\s*/).map((s) => s.trim()).filter(Boolean);
     if (a.scopes.trim() && opt.own) providerBody.scopes = a.scopes.split(/\s+/).filter(Boolean);
   }
-  const spinner = (0, import_ora20.default)("Setting up login...").start();
+  const spinner = (0, import_ora21.default)("Setting up login...").start();
   try {
     const client = await admin({ method: "POST", path: `${base2}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
     const clientId = client?.clientId ?? client?.client_id;
@@ -8113,12 +8211,12 @@ async function createTenantInteractive(teamId) {
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk51, import_ora20, PROVIDERS2, DEFAULT_SCOPES;
+var import_chalk51, import_ora21, PROVIDERS2, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
     import_chalk51 = __toESM(require("chalk"));
-    import_ora20 = __toESM(require("ora"));
+    import_ora21 = __toESM(require("ora"));
     init_admin();
     PROVIDERS2 = [
       { id: "apiblaze", label: "APIblaze (via GitHub) \u2014 zero setup, recommended", own: false },
@@ -8167,7 +8265,7 @@ async function pickTenant(teamId, opts = {}) {
   const active = loadCredentials()?.activeTenant;
   let q = opts.initialQuery ?? "";
   for (; ; ) {
-    const spinner = (0, import_ora21.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const spinner = (0, import_ora22.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
     const page = await fetchPage2(teamId, q).finally(() => spinner.stop());
     if (!page.total && !q) {
       if (opts.allowCreate) {
@@ -8217,12 +8315,12 @@ async function createTenantInline(teamId) {
   const { createTenantInteractive: createTenantInteractive2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
   return createTenantInteractive2(teamId);
 }
-var import_chalk52, import_ora21, PAGE;
+var import_chalk52, import_ora22, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
     "use strict";
     import_chalk52 = __toESM(require("chalk"));
-    import_ora21 = __toESM(require("ora"));
+    import_ora22 = __toESM(require("ora"));
     init_admin();
     init_auth();
     PAGE = 15;
@@ -8296,7 +8394,7 @@ async function journey(label3, work, home, checks) {
   for (let i = 0; i < 10; i++) codes.push((await http(`${api}/reservations`, { headers: as("ana") })).status);
   add("free-requests", !codes.includes(402) && codes.every((c) => c === 200), `codes ${codes.join(",")}`);
   add("no-stale-tunnel", !codes.includes(503), codes.includes(503) ? "503 tunnel-offline seen" : "none");
-  const booked = await http(`${api}/reservations`, { method: "POST", headers: as("ana"), body: JSON.stringify({ name: "Ana", table: 4, time: "19:30" }) });
+  const booked = await http(`${api}/reservations`, { method: "POST", headers: as("ana"), body: JSON.stringify({ time: "19:30" }) });
   const id = booked.body?.id;
   const benCancel = id ? await http(`${api}/reservations/${id}`, { method: "DELETE", headers: as("ben") }) : { status: 0 };
   const anaOpen = id ? await http(`${api}/reservations/${id}`, { headers: as("ana") }) : { status: 0 };
@@ -9591,7 +9689,7 @@ async function runWhoami(opts = {}) {
 
 // src/commands/team.ts
 var import_chalk30 = __toESM(require("chalk"));
-var import_ora10 = __toESM(require("ora"));
+var import_ora11 = __toESM(require("ora"));
 init_auth();
 init_api();
 init_admin();
@@ -9620,7 +9718,7 @@ async function createAndActivate(creds, name) {
   if (!creds.apiblazeUserId) {
     fail5("Your login is missing its user id.", "Run `apiblaze login` again, then retry.");
   }
-  const spinner = (0, import_ora10.default)(`Creating team "${name}"...`).start();
+  const spinner = (0, import_ora11.default)(`Creating team "${name}"...`).start();
   let created;
   try {
     created = await admin({
@@ -10032,7 +10130,7 @@ async function runAuthz(projectArg, apiVersionArg) {
 
 // src/commands/rule.ts
 var import_chalk35 = __toESM(require("chalk"));
-var import_ora11 = __toESM(require("ora"));
+var import_ora12 = __toESM(require("ora"));
 init_auth();
 init_api();
 init_create();
@@ -10054,7 +10152,7 @@ async function runRule(projectArg, ruleText, opts) {
   if (!rule) return proposeFromSpecBranch(ctx, opts);
   const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
   maybeWarnNoTraffic(sampleTotal, projectArg);
-  const spinner = (0, import_ora11.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
+  const spinner = (0, import_ora12.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
   const messages = [{
     role: "user",
     content: `Author this authorization rule and generate the COMPLETE proposal (OpenFGA model + per-route rules) NOW for every affected route. Do not ask clarifying questions; make reasonable assumptions and state them briefly. Rule: "${rule}"`
@@ -10082,7 +10180,7 @@ async function runRule(projectArg, ruleText, opts) {
 async function proposeFromSpecBranch(ctx, opts) {
   const { projectId, apiVersion, projectArg } = ctx;
   const interactive2 = !!process.stdin.isTTY;
-  const spinner = (0, import_ora11.default)("Reading the spec for things to protect\u2026").start();
+  const spinner = (0, import_ora12.default)("Reading the spec for things to protect\u2026").start();
   const first = await agentCall(`/projects/${projectId}/${apiVersion}/authz/propose`, "POST", {});
   if (first.status >= 400) {
     spinner.fail(`Could not work out what to protect (${first.status}): ${first.data?.details ?? first.data?.error ?? ""}`);
@@ -10499,7 +10597,7 @@ async function runMcpUi(project, tool, opts) {
 
 // src/commands/delete.ts
 var import_chalk39 = __toESM(require("chalk"));
-var import_ora12 = __toESM(require("ora"));
+var import_ora13 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 
@@ -10590,7 +10688,7 @@ async function settleDelete(accepted, opts) {
 async function runDelete(project, version2, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, version2);
-  const spinner = (0, import_ora12.default)("Checking delete impact...").start();
+  const spinner = (0, import_ora13.default)("Checking delete impact...").start();
   let impact;
   try {
     impact = await admin({
@@ -10625,7 +10723,7 @@ async function runDelete(project, version2, opts) {
       }
     }
   }
-  const s2 = (0, import_ora12.default)("Deleting...").start();
+  const s2 = (0, import_ora13.default)("Deleting...").start();
   let accepted;
   try {
     accepted = await admin({
@@ -10751,7 +10849,7 @@ async function runExport(projectArg, versionArg, opts) {
 
 // src/commands/recipe-search.ts
 var import_chalk42 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_ora14 = __toESM(require("ora"));
 init_caller();
 
 // src/lib/recipes.ts
@@ -10937,7 +11035,7 @@ function upstreamHosts(recipe) {
 
 // src/commands/recipe-search.ts
 async function runRecipeSearch(query, opts) {
-  const spinner = !opts.json ? (0, import_ora13.default)("Searching recipes...").start() : null;
+  const spinner = !opts.json ? (0, import_ora14.default)("Searching recipes...").start() : null;
   let hits;
   try {
     hits = await searchRecipes(query ?? "", opts.limit ? Number(opts.limit) : void 0);
@@ -10972,7 +11070,7 @@ async function runRecipeShow(nameArg, opts) {
   const wantsSection = !!(opts.transforms || opts.settings || opts.auth || opts.openapi);
   const caller = resolveCaller();
   const head = ref.revision === void 0 ? await getRecipeHead(ref).catch(() => null) : null;
-  const spinner = !opts.json ? (0, import_ora13.default)(`Reading ${ref.name}...`).start() : null;
+  const spinner = !opts.json ? (0, import_ora14.default)(`Reading ${ref.name}...`).start() : null;
   let recipe;
   try {
     recipe = await fetchRecipeFile(ref, caller);
@@ -11792,7 +11890,7 @@ async function teamTenants(caller, teamId) {
 
 // src/commands/recipe-publish.ts
 var import_chalk44 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_ora15 = __toESM(require("ora"));
 init_caller();
 init_auth();
 async function runRecipePublish(projectArg, opts) {
@@ -11816,7 +11914,7 @@ async function runRecipePublish(projectArg, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, projectArg, opts.apiversion);
-  const spinner = !opts.json ? (0, import_ora14.default)(`Reading ${proj2.projectId} v${proj2.apiVersion}...`).start() : null;
+  const spinner = !opts.json ? (0, import_ora15.default)(`Reading ${proj2.projectId} v${proj2.apiVersion}...`).start() : null;
   let prep;
   try {
     prep = await prepare(caller, proj2.projectId, proj2.apiVersion, ref.name, opts.tenant);
@@ -11918,7 +12016,7 @@ async function runRecipePublish(projectArg, opts) {
       return;
     }
   }
-  const spin2 = !opts.json ? (0, import_ora14.default)(`Publishing ${ref.name}...`).start() : null;
+  const spin2 = !opts.json ? (0, import_ora15.default)(`Publishing ${ref.name}...`).start() : null;
   let out;
   try {
     out = await producer(caller, {
@@ -12050,7 +12148,7 @@ async function runRecipeWithdraw(nameArg, opts) {
     console.error(import_chalk44.default.red("Withdrawing needs a typed confirmation and there is no terminal to ask on."));
     process.exit(1);
   }
-  const spinner = !opts.json ? (0, import_ora14.default)("Withdrawing...").start() : null;
+  const spinner = !opts.json ? (0, import_ora15.default)("Withdrawing...").start() : null;
   let out;
   try {
     out = await producer(caller, {
@@ -12171,14 +12269,14 @@ async function runConsumerLogsList(opts) {
 
 // src/commands/config.ts
 var import_chalk46 = __toESM(require("chalk"));
-var import_ora15 = __toESM(require("ora"));
+var import_ora16 = __toESM(require("ora"));
 init_caller();
 init_paging();
 async function patchConfig(project, opts, body, summary) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const spinner = (0, import_ora15.default)(summary + "...").start();
+  const spinner = (0, import_ora16.default)(summary + "...").start();
   try {
     const out = await producer(caller, {
       method: "PATCH",
@@ -12233,7 +12331,7 @@ async function runRename(project, opts) {
 
 // src/commands/limits.ts
 var import_chalk47 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_ora17 = __toESM(require("ora"));
 init_caller();
 init_admin();
 init_resolve();
@@ -12371,7 +12469,7 @@ async function runLimitsSet(project, opts) {
   const needsCurrent = opts.quota !== void 0 && opts.period === void 0 || opts.period !== void 0 && opts.quota === void 0 || opts.credentialQuota !== void 0;
   const current = needsCurrent ? (await getLimits(caller, proj2).catch(() => null))?.limits ?? null : null;
   const body = buildLimitsPatch(opts, current);
-  const spinner = (0, import_ora16.default)(`Update limits for ${proj2.projectName}...`).start();
+  const spinner = (0, import_ora17.default)(`Update limits for ${proj2.projectName}...`).start();
   let r;
   try {
     r = await producer(caller, { method: "PUT", path: limitsPath(proj2), body, summary: `Set limits ${JSON.stringify(body)}` });
@@ -12408,7 +12506,7 @@ async function runLimitsRequestMax(project, opts) {
   if (rps === void 0) throw new UsageError("--rps <n> is required: the ceiling you are asking for, in requests per second.");
   const { caller, proj: proj2 } = await resolve2(project, opts);
   const body = { requested_rps: rps, ...opts.useCase ? { use_case: opts.useCase } : {} };
-  const spinner = (0, import_ora16.default)(`Request a ${rps}/s ceiling for ${proj2.projectName}...`).start();
+  const spinner = (0, import_ora17.default)(`Request a ${rps}/s ceiling for ${proj2.projectName}...`).start();
   let r;
   try {
     r = await producer(caller, { method: "POST", path: `${limitsPath(proj2)}/ceiling-request`, body, summary: `Request ceiling ${rps}/s` });
@@ -12489,7 +12587,7 @@ async function runThrottleAlias(project, opts) {
 
 // src/commands/billing.ts
 var import_chalk48 = __toESM(require("chalk"));
-var import_ora17 = __toESM(require("ora"));
+var import_ora18 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_brand();
@@ -12747,7 +12845,7 @@ async function runBillingRebuy(mode, opts) {
       throw new UsageError(`--amount must be between $${TOPUP_MIN_USD} and $${TOPUP_MAX_USD} (one card charge).`);
     }
   }
-  const spinner = (0, import_ora17.default)(`Auto-rebuy ${which}...`).start();
+  const spinner = (0, import_ora18.default)(`Auto-rebuy ${which}...`).start();
   let r;
   try {
     r = await admin({ method: "PUT", path: `/credits/auto-rebuy?teamId=${encodeURIComponent(teamId)}`, body, summary: `Auto-rebuy ${which}` });
@@ -12762,7 +12860,7 @@ async function runBillingRebuy(mode, opts) {
 
 // src/commands/transform.ts
 var import_chalk49 = __toESM(require("chalk"));
-var import_ora18 = __toESM(require("ora"));
+var import_ora19 = __toESM(require("ora"));
 init_caller();
 var HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 var ruleNameFor = (header) => `set header ${header.toLowerCase()}`;
@@ -12826,7 +12924,7 @@ async function runTransformSetHeader(project, header, opts) {
   };
   const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
   const summary = `${existing ? "Update" : "Add"} transform: send ${header} to the upstream`;
-  const spinner = opts.json ? null : (0, import_ora18.default)(summary + "...").start();
+  const spinner = opts.json ? null : (0, import_ora19.default)(summary + "...").start();
   try {
     const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action: action2, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action: action2, phase: "request", enabled: true }, summary });
     spinner?.succeed(`${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}${opts.secret ? " (stored encrypted)" : ""}.`);
@@ -12916,7 +13014,7 @@ async function runTransformMap(project, source, destination, opts) {
 
 // src/commands/config-browse.ts
 var import_chalk58 = __toESM(require("chalk"));
-var import_ora26 = __toESM(require("ora"));
+var import_ora27 = __toESM(require("ora"));
 init_admin();
 init_paging();
 init_auth();
@@ -12924,7 +13022,7 @@ init_resolve();
 
 // src/commands/domain.ts
 var import_chalk50 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_ora20 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 var KINDS = ["api", "mcp", "portal", "auth"];
@@ -12978,7 +13076,7 @@ async function runDomainAdd(project, opts) {
     process.exit(1);
   }
   const scope = await scopeFor(project, opts);
-  const spinner = (0, import_ora19.default)(`Registering ${opts.domain}...`).start();
+  const spinner = (0, import_ora20.default)(`Registering ${opts.domain}...`).start();
   try {
     const body = scope.kind === "project" ? { hostname: opts.domain, api_version: scope.apiVersion, kind, ...opts.tenant ? { tenant_name: opts.tenant.toLowerCase() } : {} } : { hostname: opts.domain, kind };
     const out = await admin({
@@ -13053,7 +13151,7 @@ async function runDomainRemove(project, opts) {
     process.exit(1);
   }
   const scope = await scopeFor(project, opts);
-  const spinner = (0, import_ora19.default)("Removing domain...").start();
+  const spinner = (0, import_ora20.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
@@ -13070,7 +13168,7 @@ async function runDomainSetBase(project, opts) {
   const env = opts.env ?? "prod";
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora19.default)("Setting base domain...").start();
+  const spinner = (0, import_ora20.default)("Setting base domain...").start();
   try {
     await admin({
       method: "PUT",
@@ -13087,7 +13185,7 @@ async function runDomainSetBase(project, opts) {
 
 // src/commands/tenant.ts
 var import_chalk53 = __toESM(require("chalk"));
-var import_ora22 = __toESM(require("ora"));
+var import_ora23 = __toESM(require("ora"));
 init_admin();
 init_caller();
 init_resolve();
@@ -13154,7 +13252,7 @@ async function runTenantCreate(opts) {
   }
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
-  const spinner = (0, import_ora22.default)("Creating tenant...").start();
+  const spinner = (0, import_ora23.default)("Creating tenant...").start();
   try {
     const out = await producer(caller, {
       method: "POST",
@@ -13177,15 +13275,19 @@ async function runTenantAttach(project, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const spinner = (0, import_ora22.default)("Attaching tenant...").start();
+  const spinner = (0, import_ora23.default)("Attaching tenant...").start();
   try {
     const out = await producer(caller, {
       method: "POST",
       path: `/projects/${proj2.projectId}/${proj2.apiVersion}/tenants`,
-      body: { tenant_name: opts.tenant, ...opts.authConfig ? { auth_config_id: opts.authConfig } : {} },
+      // `login: {}`: the tenant's dev portal gets the same zero-config sign-in a new proxy's
+      // first tenant gets (reused if the tenant already has one). Without it the portal
+      // answers "No app clients found".
+      body: { tenant_name: opts.tenant, ...opts.authConfig ? { auth_config_id: opts.authConfig } : {}, ...opts.login === false ? {} : { login: {} } },
       summary: `Attach tenant ${opts.tenant} \u2192 ${proj2.projectName} v${proj2.apiVersion}`
     });
     spinner.succeed(`Attached ${opts.tenant} to ${proj2.projectName} v${proj2.apiVersion}.`);
+    if (out?.login_app_client_id) console.log(import_chalk53.default.dim(`  Its dev portal signs people in: https://${opts.tenant}.portal.apiblaze.com/${proj2.apiVersion}`));
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Attach failed.");
@@ -13210,7 +13312,7 @@ async function runTenantDelete(slug, opts) {
       return;
     }
   }
-  const spinner = (0, import_ora22.default)(hard ? "Trashing tenant..." : "Deleting tenant...").start();
+  const spinner = (0, import_ora23.default)(hard ? "Trashing tenant..." : "Deleting tenant...").start();
   try {
     await admin({
       method: "DELETE",
@@ -13261,7 +13363,7 @@ async function runTenantCors(opts) {
   const { teamId } = await resolveTeam(opts.team);
   const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   const cors = origins.length ? { allowed_origins: origins } : null;
-  const spinner = (0, import_ora22.default)("Updating CORS...").start();
+  const spinner = (0, import_ora23.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
@@ -13278,7 +13380,7 @@ async function runTenantCors(opts) {
 
 // src/commands/tenant-drill.ts
 var import_chalk54 = __toESM(require("chalk"));
-var import_ora23 = __toESM(require("ora"));
+var import_ora24 = __toESM(require("ora"));
 var import_crypto2 = require("crypto");
 init_admin();
 init_auth();
@@ -13318,7 +13420,7 @@ async function tenantHome(teamId, tenant2) {
 Tenant ${tenant2}`));
   console.log(import_chalk54.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
-    const spinner = (0, import_ora23.default)("Reading tenant state...").start();
+    const spinner = (0, import_ora24.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
       admin({ method: "GET", path: `${base2}/iam`, summary: "Read IAM toggle" }).catch(() => null),
       admin({ method: "GET", path: `${base2}/cors`, summary: "Read tenant CORS" }).catch(() => null),
@@ -13385,7 +13487,7 @@ Tenant ${tenant2}`));
 async function loginMethodsMenu(teamId, tenant2, base2) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora23.default)("Loading login methods...").start();
+    const spinner = (0, import_ora24.default)("Loading login methods...").start();
     const [rawClients, rawIssuers, rawOpaque] = await Promise.all([
       admin({ method: "GET", path: `${base2}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
       admin({ method: "GET", path: `${base2}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
@@ -13584,7 +13686,7 @@ async function clientHome(base2, summary) {
   const id = summary.clientId ?? summary.client_id;
   const cBase = `${base2}/app-clients/${encodeURIComponent(id)}`;
   for (; ; ) {
-    const spinner = (0, import_ora23.default)("Reading app client...").start();
+    const spinner = (0, import_ora24.default)("Reading app client...").start();
     const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
     spinner.stop();
     const cb = c.authorizedCallbackUrls ?? c.authorized_callback_urls ?? [];
@@ -13679,7 +13781,7 @@ var DEFAULT_SCOPES2 = {
 async function providersMenu(cBase, clientLabel) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora23.default)("Loading providers...").start();
+    const spinner = (0, import_ora24.default)("Loading providers...").start();
     const raw = await admin({ method: "GET", path: `${cBase}/providers`, summary: "List login providers" }).catch(() => []);
     spinner.stop();
     const providers = Array.isArray(raw) ? raw : [];
@@ -13770,7 +13872,7 @@ async function providersMenu(cBase, clientLabel) {
 // src/commands/spec.ts
 var fs15 = __toESM(require("fs"));
 var import_chalk55 = __toESM(require("chalk"));
-var import_ora24 = __toESM(require("ora"));
+var import_ora25 = __toESM(require("ora"));
 init_admin();
 init_api();
 init_resolve();
@@ -13798,7 +13900,7 @@ async function runSpecSet(project, opts) {
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora24.default)("Uploading spec...").start();
+  const spinner = (0, import_ora25.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -13843,7 +13945,7 @@ async function runSpecCarry(project, opts) {
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora24.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
+  const spinner = (0, import_ora25.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
   const res = await agentCall(`/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/carry`, "POST", {
     method: opts.method.toUpperCase(),
     from_resource: opts.from,
@@ -13866,7 +13968,7 @@ async function runSpecDeleteRule(project, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
   const encoded = opts.route.replace(/\{/g, "%7B").replace(/\}/g, "%7D");
-  const spinner = (0, import_ora24.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
+  const spinner = (0, import_ora25.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
   const res = await agentCall(
     `/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/${opts.method.toUpperCase()}${encoded.startsWith("/") ? encoded : `/${encoded}`}`,
     "DELETE"
@@ -13881,7 +13983,7 @@ async function runSpecDeleteRule(project, opts) {
 
 // src/commands/agent.ts
 var import_chalk57 = __toESM(require("chalk"));
-var import_ora25 = __toESM(require("ora"));
+var import_ora26 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
@@ -14117,7 +14219,7 @@ async function runAgent(opts) {
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora25.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora26.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -14139,7 +14241,7 @@ async function runAgent(opts) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora25.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora26.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -14557,7 +14659,7 @@ async function patchSetting(proj2, s, value, cfg) {
     if (!tenant2) throw new Error(`Could not tell which tenant ${proj2.projectName} serves \u2014 pass it via \`apiblaze config ${proj2.projectName} --tenant <slug>\` is not supported yet; run \`apiblaze projects\` and check the project has a tenant.`);
     body.tenant = tenant2;
   }
-  const spinner = (0, import_ora26.default)(`Set ${s.key}...`).start();
+  const spinner = (0, import_ora27.default)(`Set ${s.key}...`).start();
   try {
     await admin({
       method,
@@ -14973,7 +15075,7 @@ async function transformsMenu(proj2) {
         };
       }
       const condition = await buildCondition(ans.phase);
-      const spinner = (0, import_ora26.default)("Creating rule...").start();
+      const spinner = (0, import_ora27.default)("Creating rule...").start();
       try {
         await admin({
           method: "POST",
@@ -15166,7 +15268,7 @@ async function agentsMenu(proj2, opts) {
 
 // src/commands/group.ts
 var import_chalk59 = __toESM(require("chalk"));
-var import_ora27 = __toESM(require("ora"));
+var import_ora28 = __toESM(require("ora"));
 init_auth();
 init_consumer_auth();
 init_admin();
@@ -15305,7 +15407,7 @@ async function runGroupCreate(name, opts) {
       }
     }
   }
-  const spinner = (0, import_ora27.default)(`Creating group ${name}...`).start();
+  const spinner = (0, import_ora28.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
     spinner.succeed(`Group ${import_chalk59.default.bold(name)} created in ${t.tenant}.`);
@@ -15317,7 +15419,7 @@ async function runGroupCreate(name, opts) {
 async function runGroupDelete(name, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, name);
-  const spinner = (0, import_ora27.default)(`Deleting group ${name}...`).start();
+  const spinner = (0, import_ora28.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
     spinner.succeed(`Group ${import_chalk59.default.bold(name)} deleted.`);
@@ -15350,7 +15452,7 @@ async function runGroupAddUser(userRef, groupName, opts) {
   const g = await groupByName(t, groupName);
   const u = await userByRefOrCreate(t, userRef);
   const role = opts.role === "admin" ? "admin" : "member";
-  const spinner = (0, import_ora27.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  const spinner = (0, import_ora28.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
     spinner.succeed(`${import_chalk59.default.bold(label2(u))} added to ${import_chalk59.default.bold(g.name)} as ${role}.`);
@@ -15362,7 +15464,7 @@ async function runGroupAddUser(userRef, groupName, opts) {
 async function runGroupRemoveUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
-  const spinner = (0, import_ora27.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  const spinner = (0, import_ora28.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
     spinner.succeed(`${import_chalk59.default.bold(label2(u))} removed from ${import_chalk59.default.bold(g.name)}.`);
@@ -15374,7 +15476,7 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
 async function runGroupAddGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora27.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  const spinner = (0, import_ora28.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
     spinner.succeed(`${import_chalk59.default.bold(child.name)} is now a subgroup of ${import_chalk59.default.bold(parent.name)}.`);
@@ -15386,7 +15488,7 @@ async function runGroupAddGroup(childName, parentName, opts) {
 async function runGroupRemoveGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora27.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  const spinner = (0, import_ora28.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
     spinner.succeed(`${import_chalk59.default.bold(child.name)} un-nested from ${import_chalk59.default.bold(parent.name)}.`);
@@ -15417,7 +15519,7 @@ init_admins();
 
 // src/commands/preapprove.ts
 var import_chalk60 = __toESM(require("chalk"));
-var import_ora28 = __toESM(require("ora"));
+var import_ora29 = __toESM(require("ora"));
 init_preapproval();
 async function runPreapprove(who, opts) {
   const tenant2 = await resolveProducerTenant(opts.tenant);
@@ -15441,13 +15543,13 @@ async function runPreapprove(who, opts) {
     throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
   }
   if (opts.remove) {
-    const spinner2 = (0, import_ora28.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const spinner2 = (0, import_ora29.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
     if (removed) spinner2.succeed(`${import_chalk60.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
     else spinner2.warn(`No pre-approval rule for ${import_chalk60.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
-  const spinner = (0, import_ora28.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  const spinner = (0, import_ora29.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
@@ -15466,7 +15568,7 @@ init_llm();
 
 // src/commands/consumer.ts
 var import_chalk61 = __toESM(require("chalk"));
-var import_ora29 = __toESM(require("ora"));
+var import_ora30 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_caller();
@@ -15512,7 +15614,7 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora29.default)("Finding the login app...").start();
+    const s2 = (0, import_ora30.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
@@ -15573,7 +15675,7 @@ async function runConsumerTokens(opts) {
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora29.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora30.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, withPage("/apikeys", null));
   if (list.status >= 400) {
     spinner.stop();
@@ -15630,7 +15732,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora29.default)("Creating key...").start();
+  const s2 = (0, import_ora30.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -15644,7 +15746,7 @@ async function runConsumerApikeys(opts) {
 
 // src/commands/sidecar.ts
 var import_chalk62 = __toESM(require("chalk"));
-var import_ora30 = __toESM(require("ora"));
+var import_ora31 = __toESM(require("ora"));
 var fs16 = __toESM(require("fs"));
 var path12 = __toESM(require("path"));
 init_admin();
@@ -15691,7 +15793,7 @@ function installSidecarPackage(root) {
   }
   const has = (f) => fs16.existsSync(path12.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora30.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora31.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
@@ -15840,7 +15942,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora30.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora31.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -15897,7 +15999,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora30.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora31.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -15943,7 +16045,7 @@ async function runSidecar(opts) {
 
 // src/commands/origins.ts
 var import_chalk63 = __toESM(require("chalk"));
-var import_ora31 = __toESM(require("ora"));
+var import_ora32 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -15994,7 +16096,7 @@ async function runOriginsApprove(origin, opts) {
       console.error(import_chalk63.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora31.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora32.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -16005,7 +16107,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora31.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora32.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -16022,7 +16124,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora31.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora32.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -16033,7 +16135,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora31.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora32.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -17611,7 +17713,7 @@ program.command("create").description(`Put an app that is already DEPLOYED behin
   }
 });
 program.command("integration").description(`What to add to your frontend and frontend-server for ${B.cli === "mcpblaze" ? "an MCP server" : "a proxy"} \u2014 the same kit the ${B.product} MCP hands an agent: widgets, the call-through with the key + X-End-User-Id, what your backend must trust, env vars, what stays open`).argument("<name>", `The ${B.thingShort} (project name)`).option("--stack <stack>", "nextjs | express | fastapi | other", "nextjs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--json", "Print the raw kit as JSON").action(action((name, opts) => runIntegration(name, opts)));
-program.command("demo").description(`See what ${B.product} does in 30 seconds: a small booking app on this machine, with ${B.product} in front of it (no login, no prompts)`).argument("[action]", "stop \xB7 start / restart (the same demo again: same addresses and keys) \xB7 logs (follow the requests reaching your laptop)").option("--no-open", "Do not open the browser").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
+program.command("demo").description(`See what ${B.product} does in a minute: a small booking app on this machine, with ${B.product} in front of it (no login)`).argument("[action]", "stop \xB7 start / restart (the same demo again: same addresses and keys) \xB7 logs (follow the requests reaching your laptop)").option("--no-open", "Do not open the browser").option("-y, --yes", "Skip the questions: set everything up, open nothing (an AI assistant is never asked)").addOption(new import_commander.Option("--serve <dir>", "internal: run the demo servers and tunnel").hideHelp()).action(async (actionArg, opts) => {
   if (actionArg === "stop") return runDemoStop();
   if (actionArg === "start" || actionArg === "restart") return runDemoStart(opts);
   if (actionArg === "logs") return runDemoLogs();
@@ -17774,7 +17876,7 @@ tenant.command("manage").description("Browse & edit one tenant: settings, login
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
 tenant.command("list").description("List tenants in your team (--q searches server-side)").option("--q <search>", "Filter by tenant name or display name").option("--limit <n>", "Page size (max 200)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
 tenant.command("create").description("Create a tenant in your team (tenant names are lowercase alphanumeric and globally unique)").requiredOption("--name <name>", "Tenant name \u2014 becomes the slug ({name}.portal.apiblaze.com) unless --slug overrides; also the display label").option("--slug <tenant_name>", "Explicit tenant slug when it should differ from --name").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
-tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
+tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--no-login", "Do not give the tenant a dev-portal sign-in (by default it gets the zero-config GitHub one, unless it already has one)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
 tenant.command("delete").description("Move a tenant to the trash (reversible); --purge destroys it and everything under it").argument("<slug>", "Tenant slug to delete").option("--team <id|name>", "Team (defaults to active team)").option("-y, --yes", "Skip the confirmation prompt").option("--purge", "Permanently destroy the tenant and all its data (cannot be undone)").option("--no-wait", "With --purge: return as soon as the teardown is accepted instead of waiting for it to finish").option("--json", "Output machine-readable JSON").action(action((slug, opts) => runTenantDelete(slug, opts)));
 tenant.command("cors").description("Set the CORS allow-list for a tenant").requiredOption("--tenant <slug>", "Tenant slug").option("--origins <list>", 'Comma-separated origins (or "*"); empty clears').option("--team <id|name>", "Team (defaults to active team)").action(action((opts) => runTenantCors(opts)));
 var admins = new import_commander.Command("admins").description("Manage who can administer a tenant's users & groups (the first-admin bootstrap the widget needs)").option("--tenant <slug>", "Tenant slug (e.g. nino)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--json", "Output machine-readable JSON").action(action((opts) => runAdminsList(opts)));