apiblaze 0.21.27 → 0.21.29

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.27";
+    version = "0.21.29";
   }
 });
 
@@ -384,8 +384,8 @@ function dualAuth(opts = {}) {
 function bothDoorsBody(opts = {}) {
   return { auth_type: "api_key", requests_auth: dualAuth(opts), login: GITHUB_LOGIN };
 }
-async function apiFetch(path14, options = {}, auth) {
-  const url = `${DASHBOARD_BASE2}${path14}`;
+async function apiFetch(path16, options = {}, auth) {
+  const url = `${DASHBOARD_BASE2}${path16}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -411,12 +411,12 @@ async function apiFetch(path14, options = {}, auth) {
   }
   return res.json();
 }
-async function agentCall(path14, method, body) {
+async function agentCall(path16, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE2}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path14, method, body })
+    body: JSON.stringify({ path: path16, method, body })
   });
   let data = null;
   try {
@@ -896,11 +896,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path14) {
-  const q = path14.indexOf("?");
-  if (q < 0) return path14;
-  const base2 = path14.slice(0, q);
-  const query = path14.slice(q + 1);
+function maskPath(path16) {
+  const q = path16.indexOf("?");
+  if (q < 0) return path16;
+  const base2 = path16.slice(0, q);
+  const query = path16.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -1197,8 +1197,8 @@ function pageQuery(cursor, limit = PAGE_LIMIT) {
   if (cursor) qs.set("cursor", cursor);
   return qs.toString();
 }
-function withPage(path14, cursor, limit = PAGE_LIMIT) {
-  return `${path14}${path14.includes("?") ? "&" : "?"}${pageQuery(cursor, limit)}`;
+function withPage(path16, cursor, limit = PAGE_LIMIT) {
+  return `${path16}${path16.includes("?") ? "&" : "?"}${pageQuery(cursor, limit)}`;
 }
 var PAGE_LIMIT, MAX_HOPS;
 var init_paging = __esm({
@@ -1885,13 +1885,53 @@ var init_tunnel_client = __esm({
   }
 });
 
+// src/lib/env-local.ts
+function saveEnvLocal(dir, vars) {
+  const file2 = import_path3.default.join(dir, ".env.local");
+  try {
+    const existed = import_fs2.default.existsSync(file2);
+    const lines = existed ? import_fs2.default.readFileSync(file2, "utf8").split("\n") : [];
+    const left = new Map(Object.entries(vars));
+    const out = lines.map((line) => {
+      const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+      if (m && left.has(m[1])) {
+        const v = left.get(m[1]);
+        left.delete(m[1]);
+        return `${m[1]}=${v}`;
+      }
+      return line;
+    });
+    while (out.length && out[out.length - 1] === "") out.pop();
+    for (const [k, v] of left) out.push(`${k}=${v}`);
+    import_fs2.default.writeFileSync(file2, `${out.join("\n")}
+`, existed ? void 0 : { mode: 384 });
+    return { ok: true, gitignoreWarning: !gitIgnores(dir) };
+  } catch {
+    return { ok: false, gitignoreWarning: false };
+  }
+}
+function gitIgnores(dir) {
+  const gi = import_path3.default.join(dir, ".gitignore");
+  if (!import_fs2.default.existsSync(gi)) return !import_fs2.default.existsSync(import_path3.default.join(dir, ".git"));
+  const pats = import_fs2.default.readFileSync(gi, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  return pats.some((p) => [".env.local", "/.env.local", ".env*", "/.env*", ".env*.local", "*.local", ".env.*"].includes(p));
+}
+var import_fs2, import_path3;
+var init_env_local = __esm({
+  "src/lib/env-local.ts"() {
+    "use strict";
+    import_fs2 = __toESM(require("fs"));
+    import_path3 = __toESM(require("path"));
+  }
+});
+
 // src/lib/preapproval.ts
-async function iamCall(tenant2, path14, method = "GET", body) {
+async function iamCall(tenant2, path16, method = "GET", body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE5}/api/cli/iam`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ tenant: tenant2, path: path14, method, body })
+    body: JSON.stringify({ tenant: tenant2, path: path16, method, body })
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -1962,15 +2002,15 @@ function detectProvider(key) {
 }
 function loadLlmConfig() {
   try {
-    return JSON.parse(fs4.readFileSync(LLM_PATH, "utf-8"));
+    return JSON.parse(fs5.readFileSync(LLM_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveLlmConfig(cfg) {
-  fs4.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs4.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
-  fs4.chmodSync(LLM_PATH, 384);
+  fs5.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs5.writeFileSync(LLM_PATH, JSON.stringify(cfg, null, 2), "utf-8");
+  fs5.chmodSync(LLM_PATH, 384);
 }
 async function runLlmSetKey(keyArg, opts) {
   let key = keyArg?.trim();
@@ -2009,23 +2049,23 @@ async function runLlmShow() {
 }
 async function runLlmClearKey() {
   try {
-    fs4.unlinkSync(LLM_PATH);
+    fs5.unlinkSync(LLM_PATH);
     console.log(`${import_chalk10.default.green("\u2713")} Removed local LLM key.`);
   } catch {
     console.log(import_chalk10.default.gray("No LLM key was set."));
   }
 }
-var fs4, path5, import_chalk10, import_inquirer, LLM_PATH;
+var fs5, path6, import_chalk10, import_inquirer, LLM_PATH;
 var init_llm = __esm({
   "src/commands/llm.ts"() {
     "use strict";
-    fs4 = __toESM(require("fs"));
-    path5 = __toESM(require("path"));
+    fs5 = __toESM(require("fs"));
+    path6 = __toESM(require("path"));
     import_chalk10 = __toESM(require("chalk"));
     import_inquirer = __toESM(require("inquirer"));
     init_auth();
     init_traffic();
-    LLM_PATH = path5.join(getApiblazeDir(), "llm.json");
+    LLM_PATH = path6.join(getApiblazeDir(), "llm.json");
   }
 });
 
@@ -2216,7 +2256,7 @@ function claudeInteractive(spec2, prompt) {
   return { argv, status: r.status };
 }
 function codexConfigPath() {
-  return path6.join(process.env.CODEX_HOME || path6.join(os4.homedir(), ".codex"), "config.toml");
+  return path7.join(process.env.CODEX_HOME || path7.join(os4.homedir(), ".codex"), "config.toml");
 }
 function codexServerBlock(spec2) {
   const lines = [`[mcp_servers.${tomlStr(spec2.name)}]`, `url = ${tomlStr(spec2.url)}`];
@@ -2248,11 +2288,11 @@ function codexSectionRanges(lines, name) {
 function installIntoCodex(spec2) {
   const file2 = codexConfigPath();
   try {
-    fs5.mkdirSync(path6.dirname(file2), { recursive: true });
+    fs6.mkdirSync(path7.dirname(file2), { recursive: true });
     let text = "";
     let existed = true;
     try {
-      text = fs5.readFileSync(file2, "utf-8");
+      text = fs6.readFileSync(file2, "utf-8");
     } catch {
       existed = false;
     }
@@ -2275,11 +2315,11 @@ function installIntoCodex(spec2) {
     if (cleaned.length && !cleaned.endsWith("\n")) cleaned += "\n";
     if (cleaned.length && !cleaned.endsWith("\n\n")) cleaned += "\n";
     const tmp = `${file2}.tmp-${process.pid}`;
-    fs5.writeFileSync(tmp, cleaned + codexServerBlock(spec2), { encoding: "utf-8", mode: 384 });
-    fs5.renameSync(tmp, file2);
+    fs6.writeFileSync(tmp, cleaned + codexServerBlock(spec2), { encoding: "utf-8", mode: 384 });
+    fs6.renameSync(tmp, file2);
     if (!existed) {
       try {
-        fs5.chmodSync(file2, 384);
+        fs6.chmodSync(file2, 384);
       } catch {
       }
     }
@@ -2290,7 +2330,7 @@ function installIntoCodex(spec2) {
 }
 function codexSiblingApiblazeServers(keepName) {
   try {
-    const text = fs5.readFileSync(codexConfigPath(), "utf-8");
+    const text = fs6.readFileSync(codexConfigPath(), "utf-8");
     const lines = text.split("\n");
     const out = [];
     const header = /^\[mcp_servers\.(?:"([^"]+)"|([^\]]+))\]\s*(#.*)?$/;
@@ -2333,7 +2373,7 @@ async function mcpEndpointIsDead(url) {
 }
 function codexServerUrl(name) {
   try {
-    const lines = fs5.readFileSync(codexConfigPath(), "utf-8").split("\n");
+    const lines = fs6.readFileSync(codexConfigPath(), "utf-8").split("\n");
     const ranges = codexSectionRanges(lines, name);
     if (!ranges.length) return null;
     const body = lines.slice(ranges[0].start, ranges[0].end).join("\n");
@@ -2361,13 +2401,13 @@ function removeClaudeServer(name) {
 function removeCodexServer(name) {
   try {
     const file2 = codexConfigPath();
-    const lines = fs5.readFileSync(file2, "utf-8").split("\n");
+    const lines = fs6.readFileSync(file2, "utf-8").split("\n");
     const ranges = codexSectionRanges(lines, name);
     if (!ranges.length) return false;
     for (const r of [...ranges].reverse()) lines.splice(r.start, r.end - r.start);
     const tmp = `${file2}.tmp-${process.pid}`;
-    fs5.writeFileSync(tmp, lines.join("\n"), { encoding: "utf-8", mode: 384 });
-    fs5.renameSync(tmp, file2);
+    fs6.writeFileSync(tmp, lines.join("\n"), { encoding: "utf-8", mode: 384 });
+    fs6.renameSync(tmp, file2);
     return true;
   } catch {
     return false;
@@ -2388,7 +2428,7 @@ function directedPrompt(spec2, question) {
   return `Use the "${spec2.name}" MCP server (it exposes this API's tools) to answer: ${question}${ctx}`;
 }
 function agentInstructionFile(cli, dir = process.cwd()) {
-  return path6.join(dir, cli === "claude" ? "CLAUDE.md" : "AGENTS.md");
+  return path7.join(dir, cli === "claude" ? "CLAUDE.md" : "AGENTS.md");
 }
 function stripMarkedBlock(text, name) {
   const m = marker(name);
@@ -2422,12 +2462,12 @@ function writeAgentInstruction(cli, spec2, dir = process.cwd()) {
     ].join("\n");
     let text = "";
     try {
-      text = fs5.readFileSync(file2, "utf-8");
+      text = fs6.readFileSync(file2, "utf-8");
     } catch {
     }
     const cleaned = stripMarkedBlock(text, spec2.name);
     const sep = cleaned.length && !cleaned.endsWith("\n\n") ? cleaned.endsWith("\n") ? "\n" : "\n\n" : "";
-    fs5.writeFileSync(file2, cleaned + sep + block, "utf-8");
+    fs6.writeFileSync(file2, cleaned + sep + block, "utf-8");
     return file2;
   } catch {
     return null;
@@ -2436,10 +2476,10 @@ function writeAgentInstruction(cli, spec2, dir = process.cwd()) {
 function removeAgentInstruction(cli, name, dir = process.cwd()) {
   try {
     const file2 = agentInstructionFile(cli, dir);
-    const text = fs5.readFileSync(file2, "utf-8");
+    const text = fs6.readFileSync(file2, "utf-8");
     const cleaned = stripMarkedBlock(text, name);
     if (cleaned === text) return false;
-    fs5.writeFileSync(file2, cleaned.replace(/\n{3,}/g, "\n\n"), "utf-8");
+    fs6.writeFileSync(file2, cleaned.replace(/\n{3,}/g, "\n\n"), "utf-8");
     return true;
   } catch {
     return false;
@@ -2526,14 +2566,14 @@ async function installAndDemo(cli, spec2, getQuestion, log4 = console.log) {
   const question = await getQuestion();
   if (question) {
     const handoff = !!process.stdin.isTTY;
-    const ask2 = handoff ? cli.kind === "claude" ? claudeInteractive : codexInteractive : oneShot;
+    const ask3 = handoff ? cli.kind === "claude" ? claudeInteractive : codexInteractive : oneShot;
     log4(`
   ${import_chalk12.default.dim(handoff ? `Opening ${cli.label} with your question \u2014 you'll stay in that session:` : `Your question, through ${cli.label}:`)}`);
     const directed = directedPrompt(spec2, question);
     const shown = cli.kind === "claude" ? handoff ? ["claude", directed, "--allowedTools", `mcp__${spec2.name}__*`, "--append-system-prompt", "\u2026"] : ["claude", "-p", directed, "--allowedTools", `mcp__${spec2.name}__*`] : handoff ? ["codex", directed] : ["codex", "exec", "--skip-git-repo-check", directed];
     log4(`  ${import_chalk12.default.dim("$")} ${renderCommand(shown)}
 `);
-    const ans = ask2(spec2, directedPrompt(spec2, question));
+    const ans = ask3(spec2, directedPrompt(spec2, question));
     if (ans.status !== 0) log4(import_chalk12.default.yellow(`
   ${cli.label} exited with ${ans.status ?? "no status"} \u2014 the MCP stays installed.`));
   }
@@ -2553,13 +2593,13 @@ async function installAndDemo(cli, spec2, getQuestion, log4 = console.log) {
   log4(import_chalk12.default.red(`    ${import_chalk12.default.bold(off)}`));
   return true;
 }
-var fs5, os4, path6, import_child_process, import_chalk12, useShell, winQuote, run, detected, mcpLoginSupport, OURS, mask, tomlStr, shellQuote, marker;
+var fs6, os4, path7, import_child_process, import_chalk12, useShell, winQuote, run, detected, mcpLoginSupport, OURS, mask, tomlStr, shellQuote, marker;
 var init_external_mcp = __esm({
   "src/lib/external-mcp.ts"() {
     "use strict";
-    fs5 = __toESM(require("fs"));
+    fs6 = __toESM(require("fs"));
     os4 = __toESM(require("os"));
-    path6 = __toESM(require("path"));
+    path7 = __toESM(require("path"));
     import_child_process = require("child_process");
     import_chalk12 = __toESM(require("chalk"));
     useShell = process.platform === "win32";
@@ -2835,19 +2875,19 @@ var init_problem = __esm({
 // src/lib/consumer-auth.ts
 function loadConsumer() {
   try {
-    return JSON.parse(fs6.readFileSync(CONSUMER_PATH, "utf-8"));
+    return JSON.parse(fs7.readFileSync(CONSUMER_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveConsumer(creds) {
-  fs6.mkdirSync(APIBLAZE_DIR2, { recursive: true });
-  fs6.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
-  fs6.chmodSync(CONSUMER_PATH, 384);
+  fs7.mkdirSync(APIBLAZE_DIR2, { recursive: true });
+  fs7.writeFileSync(CONSUMER_PATH, JSON.stringify(creds, null, 2), "utf-8");
+  fs7.chmodSync(CONSUMER_PATH, 384);
 }
 function clearConsumer() {
   try {
-    fs6.unlinkSync(CONSUMER_PATH);
+    fs7.unlinkSync(CONSUMER_PATH);
     return true;
   } catch {
     return false;
@@ -2949,18 +2989,18 @@ async function validConsumerToken(creds) {
   if (Date.now() < creds.expiresAt - 3e4) return creds;
   return refreshConsumer(creds);
 }
-var fs6, os5, path7, crypto, import_child_process2, AUTH_BASE, APIBLAZE_DIR2, CONSUMER_PATH, DEVICE_GRANT;
+var fs7, os5, path8, crypto, import_child_process2, AUTH_BASE, APIBLAZE_DIR2, CONSUMER_PATH, DEVICE_GRANT;
 var init_consumer_auth = __esm({
   "src/lib/consumer-auth.ts"() {
     "use strict";
-    fs6 = __toESM(require("fs"));
+    fs7 = __toESM(require("fs"));
     os5 = __toESM(require("os"));
-    path7 = __toESM(require("path"));
+    path8 = __toESM(require("path"));
     crypto = __toESM(require("crypto"));
     import_child_process2 = require("child_process");
     AUTH_BASE = process.env.APIBLAZE_AUTH_BASE || "https://auth.apiblaze.com";
-    APIBLAZE_DIR2 = path7.join(os5.homedir(), ".apiblaze");
-    CONSUMER_PATH = path7.join(APIBLAZE_DIR2, "consumer.json");
+    APIBLAZE_DIR2 = path8.join(os5.homedir(), ".apiblaze");
+    CONSUMER_PATH = path8.join(APIBLAZE_DIR2, "consumer.json");
     DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
   }
 });
@@ -3021,12 +3061,12 @@ async function classifyTargetInput(input, failFn) {
   if (!isHttpUrl(t)) {
     let isFile = false;
     try {
-      isFile = fs7.existsSync(t) && fs7.statSync(t).isFile();
+      isFile = fs8.existsSync(t) && fs8.statSync(t).isFile();
     } catch {
       isFile = false;
     }
     if (isFile) {
-      const text2 = fs7.readFileSync(t, "utf-8");
+      const text2 = fs8.readFileSync(t, "utf-8");
       if (looksLikeSpecDoc(text2)) return { kind: "spec", specText: text2, source: t };
       failFn(
         `${t} exists but is not an OpenAPI/Swagger document (no openapi/swagger version field with paths).`,
@@ -3047,11 +3087,11 @@ async function classifyTargetInput(input, failFn) {
   if (text && looksLikeSpecDoc(text)) return { kind: "spec", specText: text, source: t };
   return { kind: "server" };
 }
-var fs7, import_yaml2, MAX_SPEC_BYTES;
+var fs8, import_yaml2, MAX_SPEC_BYTES;
 var init_spec_or_target = __esm({
   "src/lib/spec-or-target.ts"() {
     "use strict";
-    fs7 = __toESM(require("fs"));
+    fs8 = __toESM(require("fs"));
     import_yaml2 = require("yaml");
     MAX_SPEC_BYTES = 5 * 1024 * 1024;
   }
@@ -3124,7 +3164,7 @@ async function loadSpec(opts) {
     }
     let text;
     try {
-      text = fs8.readFileSync(opts.openapispec, "utf-8");
+      text = fs9.readFileSync(opts.openapispec, "utf-8");
     } catch {
       fail3(`Cannot read spec file: ${opts.openapispec}`);
     }
@@ -3326,13 +3366,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
   console.log(`  ${import_chalk15.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk15.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
-async function cpPost(anon, path14, body, summary) {
+async function cpPost(anon, path16, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
     if (!cred) throw new Error("Anonymous workspace credential missing.");
-    return cpFetch(cred.cp_key, path14, { method: "POST", body: JSON.stringify(body) });
+    return cpFetch(cred.cp_key, path16, { method: "POST", body: JSON.stringify(body) });
   }
-  return admin({ method: "POST", path: path14, body, summary });
+  return admin({ method: "POST", path: path16, body, summary });
 }
 async function provision(spec2, target2, opts) {
   const loggedIn = !!loadCredentials();
@@ -3882,17 +3922,17 @@ function renderUpsell(p, upsell, opts = {}) {
 }
 function loadApichats() {
   try {
-    const list = JSON.parse(fs8.readFileSync(apichatsPath(), "utf-8"));
+    const list = JSON.parse(fs9.readFileSync(apichatsPath(), "utf-8"));
     return Array.isArray(list) ? list : [];
   } catch {
     return [];
   }
 }
 function writeApichats(list) {
-  fs8.mkdirSync(getApiblazeDir(), { recursive: true });
-  fs8.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
+  fs9.mkdirSync(getApiblazeDir(), { recursive: true });
+  fs9.writeFileSync(apichatsPath(), JSON.stringify(list, null, 2), "utf-8");
   try {
-    fs8.chmodSync(apichatsPath(), 384);
+    fs9.chmodSync(apichatsPath(), 384);
   } catch {
   }
 }
@@ -4108,15 +4148,15 @@ function discoverLocalSpecs() {
   const found = [];
   for (const n of known) {
     try {
-      if (fs8.statSync(path8.join(cwd, n)).isFile()) found.push(n);
+      if (fs9.statSync(path9.join(cwd, n)).isFile()) found.push(n);
     } catch {
     }
   }
   try {
-    const files = fs8.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
+    const files = fs9.readdirSync(cwd).filter((f) => /\.(ya?ml|json)$/i.test(f) && !found.includes(f));
     for (const f of files.slice(0, 60)) {
       try {
-        const head = fs8.readFileSync(path8.join(cwd, f), "utf-8").slice(0, 4e3);
+        const head = fs9.readFileSync(path9.join(cwd, f), "utf-8").slice(0, 4e3);
         if (/["']?openapi["']?\s*:/i.test(head) || /["']?swagger["']?\s*:/i.test(head) || /^\s*paths\s*:/im.test(head) || /"paths"\s*:/.test(head)) {
           found.push(f);
         }
@@ -4763,12 +4803,12 @@ async function runApichat(opts) {
   if (mcpUrl2 && await maybeInstallExternalCli(p, opts)) return;
   await startChat(p, [], opts);
 }
-var fs8, path8, crypto2, import_child_process3, import_chalk15, import_ora2, import_yaml3, GENERATOR_HINT, revealAuth, apichatsPath;
+var fs9, path9, crypto2, import_child_process3, import_chalk15, import_ora2, import_yaml3, GENERATOR_HINT, revealAuth, apichatsPath;
 var init_apichat = __esm({
   "src/commands/apichat.ts"() {
     "use strict";
-    fs8 = __toESM(require("fs"));
-    path8 = __toESM(require("path"));
+    fs9 = __toESM(require("fs"));
+    path9 = __toESM(require("path"));
     crypto2 = __toESM(require("crypto"));
     import_child_process3 = require("child_process");
     import_chalk15 = __toESM(require("chalk"));
@@ -4792,7 +4832,7 @@ var init_apichat = __esm({
     init_consumer_auth();
     GENERATOR_HINT = "Pass --target <server-url | spec-file | spec-url>, or build a spec from real traffic:\n  apiblaze create --target <url>   then   apiblaze agent openapi <project>";
     revealAuth = false;
-    apichatsPath = () => path8.join(getApiblazeDir(), "apichats.json");
+    apichatsPath = () => path9.join(getApiblazeDir(), "apichats.json");
   }
 });
 
@@ -5247,7 +5287,7 @@ async function loadOpenapiSource(ref) {
     text = await res.text();
   } else {
     try {
-      text = import_fs2.default.readFileSync(ref, "utf8");
+      text = import_fs3.default.readFileSync(ref, "utf8");
     } catch {
       fail4(`Cannot read the OpenAPI spec "${ref}" \u2014 it is not a readable file, and not an http(s) URL.`);
     }
@@ -5760,7 +5800,18 @@ async function printDevOutcome(o, port) {
   console.log(BRAND === "mcpblaze" ? mcpLine : restLine);
   console.log(BRAND === "mcpblaze" ? restLine : mcpLine);
   if (o.auth.doors.includes("api_key") && o.apiKey) {
-    console.log(`    ${import_chalk19.default.dim("Key ")}  ${import_chalk19.default.bold.green(o.apiKey)}   ${import_chalk19.default.dim("shown once \xB7 your server sends it as X-API-Key, naming the user in X-End-User-Id")}`);
+    const saved = process.stdout.isTTY ? null : saveEnvLocal(process.cwd(), {
+      APIBLAZE_URL: rest,
+      APIBLAZE_MCP_URL: agents,
+      APIBLAZE_SERVER_KEY: o.apiKey,
+      ...o.tenant ? { APIBLAZE_TENANT: o.tenant } : {}
+    });
+    if (saved?.ok) {
+      console.log(`    ${import_chalk19.default.dim("Key ")}  saved to .env.local as APIBLAZE_SERVER_KEY, never printed   ${import_chalk19.default.dim("your server sends it as X-API-Key, naming the user in X-End-User-Id")}`);
+      if (saved.gitignoreWarning) console.log(import_chalk19.default.yellow("    .env.local is not in .gitignore: add it before you commit."));
+    } else {
+      console.log(`    ${import_chalk19.default.dim("Key ")}  ${import_chalk19.default.bold.green(o.apiKey)}   ${import_chalk19.default.dim("shown once \xB7 your server sends it as X-API-Key, naming the user in X-End-User-Id")}`);
+    }
   }
   console.log(`    ${import_chalk19.default.dim("Included")}  ${["API keys", "sign-in", lockedPhrase, "rate limits", adminBit].filter(Boolean).join(import_chalk19.default.dim(" \xB7 "))}`);
   if (isVerbose() && !o.adminEmail) console.log(import_chalk19.default.dim(`    No admin yet: npx ${B.cli}@latest admins add you@example.com --tenant ${o.tenant ?? "<tenant>"}`));
@@ -6136,7 +6187,7 @@ Create an ${B.thing}`));
   if (opts.config) {
     let raw = "";
     try {
-      raw = import_fs2.default.readFileSync(opts.config, "utf8");
+      raw = import_fs3.default.readFileSync(opts.config, "utf8");
     } catch {
       fail4(`Cannot read --config file: ${opts.config}`);
     }
@@ -6303,11 +6354,12 @@ Create an ${B.thing}`));
     claim: { claimCode: result.claim_code || cred?.claim_code, claimUrl: result.claim_url }
   });
 }
-var import_fs2, import_yaml4, import_chalk19, import_ora6, VALID_AUTH, BOTH_DOORS, MANAGED_GITHUB, API_KEY, OPEN, PROVIDERS, ISSUER_PROVIDERS, SECRET_REQUIRED_TYPES, OAUTH_SHAPES, EMAIL_RE, AGENT_NAME;
+var import_fs3, import_yaml4, import_chalk19, import_ora6, VALID_AUTH, BOTH_DOORS, MANAGED_GITHUB, API_KEY, OPEN, PROVIDERS, ISSUER_PROVIDERS, SECRET_REQUIRED_TYPES, OAUTH_SHAPES, EMAIL_RE, AGENT_NAME;
 var init_create = __esm({
   "src/commands/create.ts"() {
     "use strict";
-    import_fs2 = __toESM(require("fs"));
+    import_fs3 = __toESM(require("fs"));
+    init_env_local();
     init_tenant_choice();
     init_random_name();
     init_apichat();
@@ -6678,24 +6730,24 @@ ready.then((c) => {
 
 // src/lib/log-view.ts
 function statusColor(status2) {
-  if (status2 < 300) return import_chalk25.default.green;
-  if (status2 < 400) return import_chalk25.default.blue;
-  if (status2 < 500) return import_chalk25.default.yellow;
-  return import_chalk25.default.red;
+  if (status2 < 300) return import_chalk22.default.green;
+  if (status2 < 400) return import_chalk22.default.blue;
+  if (status2 < 500) return import_chalk22.default.yellow;
+  return import_chalk22.default.red;
 }
 function methodColor(method) {
   switch ((method || "").toUpperCase()) {
     case "GET":
-      return import_chalk25.default.green;
+      return import_chalk22.default.green;
     case "POST":
-      return import_chalk25.default.blue;
+      return import_chalk22.default.blue;
     case "PUT":
     case "PATCH":
-      return import_chalk25.default.yellow;
+      return import_chalk22.default.yellow;
     case "DELETE":
-      return import_chalk25.default.red;
+      return import_chalk22.default.red;
     default:
-      return import_chalk25.default.white;
+      return import_chalk22.default.white;
   }
 }
 function clock(ts2) {
@@ -6706,12 +6758,12 @@ function routeCell(route) {
   return (r.length > ROUTE_W ? `\u2026${r.slice(-(ROUTE_W - 1))}` : r).padEnd(ROUTE_W);
 }
 function formatRow(r) {
-  const time = import_chalk25.default.dim(clock(r.ts));
+  const time = import_chalk22.default.dim(clock(r.ts));
   const method = methodColor(r.method)(String(r.method || "\u2014").padEnd(6));
   const route = routeCell(String(r.route || "\u2014"));
   const status2 = statusColor(r.status)(String(r.status ?? "\u2014").padStart(3));
-  const ms2 = import_chalk25.default.dim(`${r.duration_ms}ms`.padStart(8));
-  const step = r.error_step ? import_chalk25.default.dim(` ${r.error_step}`) : "";
+  const ms2 = import_chalk22.default.dim(`${r.duration_ms}ms`.padStart(8));
+  const step = r.error_step ? import_chalk22.default.dim(` ${r.error_step}`) : "";
   return `${time}  ${method} ${route} ${status2} ${ms2}${step}`;
 }
 function printRow(r, json) {
@@ -6765,13 +6817,13 @@ async function runTailSession(opts) {
     if (!held.length && !heldRowsDropped && !heldNotesDropped) return;
     const rows = held.filter((h) => h.kind === "row").length;
     const total = rows + heldRowsDropped;
-    if (total) console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
+    if (total) console.log(import_chalk22.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
     for (const h of held) {
       if (h.kind === "row") printRow(h.row, opts.json);
       else console.error(h.msg);
     }
     if (heldRowsDropped || heldNotesDropped) {
-      console.log(import_chalk25.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
+      console.log(import_chalk22.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
     }
     held.length = 0;
     heldRowsDropped = 0;
@@ -6785,7 +6837,7 @@ async function runTailSession(opts) {
       activeSocket?.close();
     } catch {
     }
-    if (!opts.json) console.log(import_chalk25.default.dim("\nStopped."));
+    if (!opts.json) console.log(import_chalk22.default.dim("\nStopped."));
     process.exit(0);
   }
   function onKeypress(_s, key) {
@@ -6813,17 +6865,17 @@ async function runTailSession(opts) {
   async function openInspector() {
     if (paused) return;
     if (recent.length === 0) {
-      console.log(import_chalk25.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
+      console.log(import_chalk22.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
       return;
     }
     paused = true;
     unbindKeys();
     try {
       const { default: inquirer3 } = await import("inquirer");
-      console.log(import_chalk25.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
+      console.log(import_chalk22.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
       for (; ; ) {
         const choices = recent.slice(-TAIL_INSPECT_CHOICES).reverse().map((r) => ({ name: formatRow(r), value: r.request_id }));
-        choices.push({ name: import_chalk25.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
+        choices.push({ name: import_chalk22.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
         const { picked } = await inquirer3.prompt([{
           type: "list",
           name: "picked",
@@ -6834,12 +6886,12 @@ async function runTailSession(opts) {
         if (picked === "__resume__") break;
         const row = recent.find((r) => r.request_id === picked);
         if (row) printDetail(row, opts.detail);
-        else console.log(import_chalk25.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
+        else console.log(import_chalk22.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
       }
     } finally {
       paused = false;
       flushHeld();
-      console.log(import_chalk25.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
+      console.log(import_chalk22.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
       bindKeys();
     }
   }
@@ -6849,12 +6901,12 @@ async function runTailSession(opts) {
     if (reconnects >= MAX_RECONNECTS) {
       paused = false;
       flushHeld();
-      console.error(import_chalk25.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
+      console.error(import_chalk22.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
       process.exit(1);
     }
     const delay = Math.min(1e3 * 2 ** reconnects, 15e3);
     reconnects++;
-    diag(import_chalk25.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
+    diag(import_chalk22.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
     setTimeout(() => {
       if (!closed) void connect();
     }, delay);
@@ -6865,7 +6917,7 @@ async function runTailSession(opts) {
       url = await opts.mintTicket();
     } catch (err) {
       if (!everConnected) {
-        console.error(import_chalk25.default.red(`Could not start tail: ${err.message}`));
+        console.error(import_chalk22.default.red(`Could not start tail: ${err.message}`));
         process.exit(1);
       }
       lastFailure = `ticket mint failed: ${err.message}`;
@@ -6878,7 +6930,7 @@ async function runTailSession(opts) {
     } catch (err) {
       lastFailure = `bad tail URL: ${err.message}`;
       if (!everConnected) {
-        console.error(import_chalk25.default.red(`Could not start tail: ${lastFailure}`));
+        console.error(import_chalk22.default.red(`Could not start tail: ${lastFailure}`));
         process.exit(1);
       }
       scheduleReconnect();
@@ -6893,9 +6945,9 @@ async function runTailSession(opts) {
       lastInbound = Date.now();
       lastFailure = "";
       if (isReconnect) {
-        diag(import_chalk25.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
+        diag(import_chalk22.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
       } else {
-        diag(import_chalk25.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
+        diag(import_chalk22.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
       }
       bindKeys();
       pingTimer = setInterval(() => {
@@ -6922,7 +6974,7 @@ async function runTailSession(opts) {
         return;
       }
       if (frame?.type === "ceiling") {
-        diag(import_chalk25.default.yellow(
+        diag(import_chalk22.default.yellow(
           `\u26A0 volume ceiling \u2014 ${Number(frame.dropped_this_hour) || 0} rows dropped this hour; errors keep streaming.`
         ));
         return;
@@ -6998,10 +7050,10 @@ async function fetchPage(fetchWindow3, params, notices) {
       return { rows, nextCursor: res.next_cursor ?? void 0 };
     }
     if (hop >= MAX_EMPTY_HOPS) {
-      console.error(import_chalk25.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
+      console.error(import_chalk22.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
       return { rows: [], nextCursor: res.next_cursor, fuseTripped: true };
     }
-    if (hop === 0) console.error(import_chalk25.default.dim("searching older history\u2026"));
+    if (hop === 0) console.error(import_chalk22.default.dim("searching older history\u2026"));
     cursor = res.next_cursor;
   }
 }
@@ -7039,18 +7091,18 @@ async function runPlainList(opts, notices) {
     }
   }
   if (rows.length === 0) {
-    console.log(import_chalk25.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+    console.log(import_chalk22.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
     return;
   }
   const now = Date.now();
   for (const d of groupIntoDays(rows)) {
-    console.log(import_chalk25.default.bold(dayLabel(d.dayMs, now)));
+    console.log(import_chalk22.default.bold(dayLabel(d.dayMs, now)));
     for (const r of d.rows) console.log(`  ${formatRow(r)}`);
     console.log("");
   }
   const errs = rows.filter((r) => r.status >= 400).length;
   const tail = fuseTripped ? " \xB7 stopped early (long empty span) \u2014 older requests may still exist" : more ? " \xB7 showing the most recent \u2014 `--json` streams the rest" : "";
-  console.log(import_chalk25.default.dim(
+  console.log(import_chalk22.default.dim(
     `${rows.length} request${rows.length === 1 ? "" : "s"} \xB7 ${errs} error${errs === 1 ? "" : "s"}${tail}`
   ));
 }
@@ -7069,7 +7121,7 @@ async function runHistoryBrowser(opts) {
       for (const r of page.rows) console.log(JSON.stringify(r));
       any = any || page.rows.length > 0;
       if (page.fuseTripped || !page.nextCursor) {
-        if (!any && !page.fuseTripped) console.error(import_chalk25.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+        if (!any && !page.fuseTripped) console.error(import_chalk22.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
         return;
       }
       cursor2 = page.nextCursor;
@@ -7090,7 +7142,7 @@ async function runHistoryBrowser(opts) {
     scanRows = first.rows;
     scanCursor = first.nextCursor;
     if (scanRows.length === 0) {
-      console.log(import_chalk25.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+      console.log(import_chalk22.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
       return;
     }
   }
@@ -7101,10 +7153,10 @@ async function runHistoryBrowser(opts) {
     const now2 = Date.now();
     const oldestKey = days[days.length - 1]?.key;
     const choices = days.map((d) => ({
-      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk25.default.red(`  ${d.errors} errors`) : ""}`,
+      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk22.default.red(`  ${d.errors} errors`) : ""}`,
       value: d.key
     }));
-    if (scanCursor) choices.push({ name: import_chalk25.default.dim("\u2026 older days"), value: "__older__" });
+    if (scanCursor) choices.push({ name: import_chalk22.default.dim("\u2026 older days"), value: "__older__" });
     const { chosenDay } = await inquirer3.prompt([{
       type: "list",
       name: "chosenDay",
@@ -7124,7 +7176,7 @@ async function runHistoryBrowser(opts) {
         scanCursor = void 0;
       } else {
         scanCursor = more.nextCursor;
-        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk25.default.dim("That was everything \u2014 no older requests."));
+        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk22.default.dim("That was everything \u2014 no older requests."));
       }
       continue;
     }
@@ -7146,11 +7198,11 @@ async function runHistoryBrowser(opts) {
       cursor
     }, notices);
     if (page.rows.length === 0 && pageRows.length === 0) {
-      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
+      console.log(import_chalk22.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
       return;
     }
     if (page.rows.length === 0) {
-      console.log(import_chalk25.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
+      console.log(import_chalk22.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
       moreCursor = void 0;
     } else {
       pageRows = page.rows;
@@ -7161,8 +7213,8 @@ async function runHistoryBrowser(opts) {
       name: formatRow(r),
       value: r.request_id
     }));
-    if (moreCursor) choices.push({ name: import_chalk25.default.dim("\u2026 load more"), value: "__more__" });
-    choices.push({ name: import_chalk25.default.dim("quit"), value: "__quit__" });
+    if (moreCursor) choices.push({ name: import_chalk22.default.dim("\u2026 load more"), value: "__more__" });
+    choices.push({ name: import_chalk22.default.dim("quit"), value: "__quit__" });
     for (; ; ) {
       const { picked } = await inquirer3.prompt([{
         type: "list",
@@ -7197,19 +7249,19 @@ function wrapCells(items, width) {
 ${PANE_INDENT}`);
 }
 function renderHeaders(h) {
-  if (!h) return import_chalk25.default.dim("\u2014");
+  if (!h) return import_chalk22.default.dim("\u2014");
   const width = process.stdout.columns || 100;
   if (h.values) {
     const e = Object.entries(h.values);
-    if (!e.length) return import_chalk25.default.dim("none");
+    if (!e.length) return import_chalk22.default.dim("none");
     const rank = (k) => {
       const i = HEADER_PRIORITY.indexOf(k.toLowerCase());
       return i === -1 ? NOISE_HEADER.test(k) ? 999 : 500 : i;
     };
-    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk25.default.dim(k + ":")} ${v}`).join(`
+    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk22.default.dim(k + ":")} ${v}`).join(`
 ${PANE_INDENT}`);
   }
-  if (!h.names?.length) return import_chalk25.default.dim("none");
+  if (!h.names?.length) return import_chalk22.default.dim("none");
   const names = [...h.names];
   const noise = names.filter((n) => NOISE_HEADER.test(n));
   const shown = names.filter((n) => !NOISE_HEADER.test(n)).sort((a, b) => {
@@ -7217,77 +7269,77 @@ ${PANE_INDENT}`);
     const ib = HEADER_PRIORITY.indexOf(b.toLowerCase());
     return (ia === -1 ? 500 : ia) - (ib === -1 ? 500 : ib) || a.localeCompare(b);
   });
-  const body = shown.length ? wrapCells(shown, width) : import_chalk25.default.dim("(all forwarding headers)");
+  const body = shown.length ? wrapCells(shown, width) : import_chalk22.default.dim("(all forwarding headers)");
   const tail = noise.length ? `
-${PANE_INDENT}${import_chalk25.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
-  return `${body}${tail}  ${import_chalk25.default.dim("(names only)")}`;
+${PANE_INDENT}${import_chalk22.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
+  return `${body}${tail}  ${import_chalk22.default.dim("(names only)")}`;
 }
 function renderBody(b) {
-  if (!b) return import_chalk25.default.dim("\u2014");
+  if (!b) return import_chalk22.default.dim("\u2014");
   const meta = [b.content_type, b.size != null ? `${b.size}B` : null, b.truncated ? "truncated" : null].filter(Boolean).join(" \xB7 ");
-  if (b.not_captured) return import_chalk25.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
+  if (b.not_captured) return import_chalk22.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
   const isShape = b.value === void 0 && b.shape !== void 0;
   const content = b.value !== void 0 ? b.value : b.shape;
   if (content === null || content === void 0 || content === "" || content === "empty") {
-    return import_chalk25.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
+    return import_chalk22.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
   }
   const text = typeof content === "string" ? content : JSON.stringify(content, null, 2);
-  const head = isShape ? import_chalk25.default.dim("shape only (values not captured)\n      ") : "";
+  const head = isShape ? import_chalk22.default.dim("shape only (values not captured)\n      ") : "";
   return head + text.split("\n").join("\n      ");
 }
 function pane(title, tone, view, empty) {
   console.log(`  ${tone(title)}`);
   if (empty !== void 0) {
-    console.log(`    ${import_chalk25.default.dim(empty)}`);
+    console.log(`    ${import_chalk22.default.dim(empty)}`);
     return;
   }
   const v = view ?? {};
-  if (v.url) console.log(`    ${import_chalk25.default.dim("target")}   ${v.url}`);
+  if (v.url) console.log(`    ${import_chalk22.default.dim("target")}   ${v.url}`);
   if (v.status != null) {
-    console.log(`    ${import_chalk25.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk25.default.dim(" " + v.status_text) : ""}`);
+    console.log(`    ${import_chalk22.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk22.default.dim(" " + v.status_text) : ""}`);
   }
-  if (v.raw_path) console.log(`    ${import_chalk25.default.dim("path")}     ${v.raw_path}`);
+  if (v.raw_path) console.log(`    ${import_chalk22.default.dim("path")}     ${v.raw_path}`);
   if (v.query && Object.keys(v.query).length) {
-    console.log(`    ${import_chalk25.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
+    console.log(`    ${import_chalk22.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
   }
-  if (v.jwt !== void 0) console.log(`    ${import_chalk25.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
-  console.log(`    ${import_chalk25.default.dim("headers")}  ${renderHeaders(v.headers)}`);
-  console.log(`    ${import_chalk25.default.dim("body")}     ${renderBody(v.body)}`);
+  if (v.jwt !== void 0) console.log(`    ${import_chalk22.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
+  console.log(`    ${import_chalk22.default.dim("headers")}  ${renderHeaders(v.headers)}`);
+  console.log(`    ${import_chalk22.default.dim("body")}     ${renderBody(v.body)}`);
 }
 function printDetail(r, mode = "producer") {
   const v = r.views;
   console.log("");
-  console.log(import_chalk25.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk25.default.dim(`  ${r.duration_ms}ms`));
+  console.log(import_chalk22.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk22.default.dim(`  ${r.duration_ms}ms`));
   const cost = typeof r.cost_cents === "number" && r.cost_cents > 0 ? ` \xB7 ${r.cost_cents}\xA2` : "";
-  console.log(import_chalk25.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
+  console.log(import_chalk22.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
   console.log("");
   if (!v) {
-    console.log(import_chalk25.default.dim("  No view detail captured for this request.\n"));
+    console.log(import_chalk22.default.dim("  No view detail captured for this request.\n"));
     return;
   }
-  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk25.default.cyan, v.request);
+  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk22.default.cyan, v.request);
   if (mode === "producer") {
     pane(
       "Request (after) \u2014 APIblaze \u2192 upstream",
-      import_chalk25.default.cyan,
+      import_chalk22.default.cyan,
       v.forwarded_request,
       v.forwarded_request ? void 0 : "Request did not reach an upstream."
     );
     pane(
       "Response (before) \u2014 upstream \u2192 APIblaze",
-      import_chalk25.default.magenta,
+      import_chalk22.default.magenta,
       v.upstream_response,
       v.upstream_response ? void 0 : "No upstream response."
     );
   }
-  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk25.default.magenta, v.response);
+  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk22.default.magenta, v.response);
   console.log("");
 }
-var import_chalk25, readline, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
+var import_chalk22, readline, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
 var init_log_view = __esm({
   "src/lib/log-view.ts"() {
     "use strict";
-    import_chalk25 = __toESM(require("chalk"));
+    import_chalk22 = __toESM(require("chalk"));
     readline = __toESM(require("readline"));
     ROUTE_W = 34;
     WindowNotices = class {
@@ -7299,15 +7351,15 @@ var init_log_view = __esm({
       note(res) {
         if (res.history_unavailable && !this.saidUnavailable) {
           this.saidUnavailable = true;
-          console.error(import_chalk25.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
+          console.error(import_chalk22.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
         }
         if ((res.history_markers?.length ?? 0) > 0 && !this.saidGap) {
           this.saidGap = true;
-          console.error(import_chalk25.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
+          console.error(import_chalk22.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
         }
         if ((res.dropped_this_hour ?? 0) > 0 && !this.saidDropped) {
           this.saidDropped = true;
-          console.error(import_chalk25.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
+          console.error(import_chalk22.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
         }
       }
     };
@@ -7394,7 +7446,7 @@ async function resolve(projectArg, versionArg, opts) {
   return { projectId, projectName: match.projectName, version: version2, tenant: tenant2 };
 }
 function otherPlaneHint() {
-  if (loadConsumer()) console.log(import_chalk26.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
+  if (loadConsumer()) console.log(import_chalk23.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
 }
 function fetchWindow(projectId, version2, tenant2) {
   return (params) => {
@@ -7413,8 +7465,8 @@ function fetchWindow(projectId, version2, tenant2) {
 async function runLogsTail(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk23.default.bold("API Producer logs") + import_chalk23.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk23.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
   }
   await runTailSession({
@@ -7435,8 +7487,8 @@ async function runLogsTail(projectArg, versionArg, opts) {
 async function runLogsList(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk26.default.bold("API Producer logs") + import_chalk26.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk26.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk23.default.bold("API Producer logs") + import_chalk23.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk23.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
     console.log("");
   }
@@ -7448,11 +7500,11 @@ async function runLogsList(projectArg, versionArg, opts) {
     detail: "producer"
   });
 }
-var import_chalk26, activeCaller, viaCaller;
+var import_chalk23, activeCaller, viaCaller;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_chalk26 = __toESM(require("chalk"));
+    import_chalk23 = __toESM(require("chalk"));
     init_caller();
     init_auth();
     init_consumer_auth();
@@ -7482,7 +7534,7 @@ function demoName() {
 }
 function portFree(port) {
   return new Promise((resolve4) => {
-    const s = import_net.default.createServer();
+    const s = import_net2.default.createServer();
     s.once("error", () => resolve4(false));
     s.once("listening", () => s.close(() => resolve4(true)));
     s.listen(port, "127.0.0.1");
@@ -7494,15 +7546,15 @@ async function freePort(from, avoid = []) {
 }
 function readRegistry() {
   try {
-    return JSON.parse(import_fs5.default.readFileSync(registryFile(), "utf8"));
+    return JSON.parse(import_fs6.default.readFileSync(registryFile(), "utf8"));
   } catch {
     return [];
   }
 }
 function writeRegistry(rows) {
   try {
-    import_fs5.default.mkdirSync(import_path4.default.dirname(registryFile()), { recursive: true });
-    import_fs5.default.writeFileSync(registryFile(), JSON.stringify(rows));
+    import_fs6.default.mkdirSync(import_path5.default.dirname(registryFile()), { recursive: true });
+    import_fs6.default.writeFileSync(registryFile(), JSON.stringify(rows));
   } catch {
   }
 }
@@ -7511,7 +7563,7 @@ function registerDemo(dir, pid = 0) {
 }
 async function waitPorts(ports, ms2 = 1e4) {
   const listening = (port) => new Promise((resolve4) => {
-    const sock = import_net.default.connect({ port, host: "127.0.0.1" });
+    const sock = import_net2.default.connect({ port, host: "127.0.0.1" });
     sock.once("connect", () => {
       sock.destroy();
       resolve4(true);
@@ -7546,8 +7598,8 @@ async function stopTunnels() {
   return stopped;
 }
 function appCtl(dir, arg) {
-  if (!import_fs5.default.existsSync(import_path4.default.join(dir, "start.js"))) return false;
-  const r = (0, import_child_process4.spawnSync)(process.execPath, [import_path4.default.join(dir, "start.js"), arg], { cwd: dir, stdio: "ignore", timeout: 15e3 });
+  if (!import_fs6.default.existsSync(import_path5.default.join(dir, "start.js"))) return false;
+  const r = (0, import_child_process4.spawnSync)(process.execPath, [import_path5.default.join(dir, "start.js"), arg], { cwd: dir, stdio: "ignore", timeout: 15e3 });
   return r.status === 0;
 }
 async function stopDemos() {
@@ -7558,47 +7610,47 @@ async function stopDemos() {
   return n;
 }
 function writeApp(dir) {
-  import_fs5.default.mkdirSync(dir, { recursive: true });
-  for (const entry of import_fs5.default.readdirSync(dir)) import_fs5.default.rmSync(import_path4.default.join(dir, entry), { recursive: true, force: true });
+  import_fs6.default.mkdirSync(dir, { recursive: true });
+  for (const entry of import_fs6.default.readdirSync(dir)) import_fs6.default.rmSync(import_path5.default.join(dir, entry), { recursive: true, force: true });
   for (const [rel, text] of Object.entries(DEMO_FILES)) {
-    const f = import_path4.default.join(dir, rel);
-    import_fs5.default.mkdirSync(import_path4.default.dirname(f), { recursive: true });
-    import_fs5.default.writeFileSync(f, text);
+    const f = import_path5.default.join(dir, rel);
+    import_fs6.default.mkdirSync(import_path5.default.dirname(f), { recursive: true });
+    import_fs6.default.writeFileSync(f, text);
   }
-  import_fs5.default.writeFileSync(import_path4.default.join(dir, "package.json"), JSON.stringify({
+  import_fs6.default.writeFileSync(import_path5.default.join(dir, "package.json"), JSON.stringify({
     name: "nino-pizza-demo",
     private: true,
     scripts: { start: "node start.js --background", stop: "node start.js --stop", restart: "node start.js --restart", dev: "node start.js" }
   }, null, 2) + "\n");
-  import_fs5.default.writeFileSync(import_path4.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
-  for (const [from, to] of [[import_path4.default.join(__dirname, "server", "index.js"), import_path4.default.join(dir, "lib", "apiblaze-server.js")], [import_path4.default.join(__dirname, "browser", "widgets.js"), import_path4.default.join(dir, "public", "apiblaze-widgets.js")]]) {
-    if (!import_fs5.default.existsSync(from)) continue;
-    import_fs5.default.mkdirSync(import_path4.default.dirname(to), { recursive: true });
-    import_fs5.default.copyFileSync(from, to);
+  import_fs6.default.writeFileSync(import_path5.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
+  for (const [from, to] of [[import_path5.default.join(__dirname, "server", "index.js"), import_path5.default.join(dir, "lib", "apiblaze-server.js")], [import_path5.default.join(__dirname, "browser", "widgets.js"), import_path5.default.join(dir, "public", "apiblaze-widgets.js")]]) {
+    if (!import_fs6.default.existsSync(from)) continue;
+    import_fs6.default.mkdirSync(import_path5.default.dirname(to), { recursive: true });
+    import_fs6.default.copyFileSync(from, to);
   }
 }
 function saveState(dir, s) {
-  const d = import_path4.default.join(dir, STATE_DIR);
-  import_fs5.default.mkdirSync(d, { recursive: true });
-  import_fs5.default.writeFileSync(import_path4.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
+  const d = import_path5.default.join(dir, STATE_DIR);
+  import_fs6.default.mkdirSync(d, { recursive: true });
+  import_fs6.default.writeFileSync(import_path5.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
 }
 function loadState(dir) {
   try {
-    return JSON.parse(import_fs5.default.readFileSync(import_path4.default.join(dir, STATE_DIR, "state.json"), "utf8"));
+    return JSON.parse(import_fs6.default.readFileSync(import_path5.default.join(dir, STATE_DIR, "state.json"), "utf8"));
   } catch {
     return null;
   }
 }
 function writeEnv(dir, v) {
   const lines = Object.entries(v).map(([k, val]) => `${k}=${val}`);
-  import_fs5.default.writeFileSync(import_path4.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
+  import_fs6.default.writeFileSync(import_path5.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
 ${lines.join("\n")}
 `, { mode: 384 });
 }
 function readEnvFile(file2) {
   const out = {};
   try {
-    for (const line of import_fs5.default.readFileSync(file2, "utf8").split("\n")) {
+    for (const line of import_fs6.default.readFileSync(file2, "utf8").split("\n")) {
       const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
       if (m) out[m[1]] = m[2];
     }
@@ -7608,20 +7660,20 @@ function readEnvFile(file2) {
 }
 function demoDir() {
   const here = process.cwd();
-  if (import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json"))) return here;
-  return import_path4.default.resolve(here, DIR_NAME);
+  if (import_fs6.default.existsSync(import_path5.default.join(here, STATE_DIR, "state.json"))) return here;
+  return import_path5.default.resolve(here, DIR_NAME);
 }
 function adoptWorkspace(cpKey, teamId, claimCode) {
   const prev = loadAnonCred();
   if (prev?.cp_key && prev.team_id && prev.team_id !== teamId) {
     try {
-      import_fs5.default.writeFileSync(import_path4.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
+      import_fs6.default.writeFileSync(import_path5.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
     } catch {
     }
   }
   saveAnonCred(cpKey, teamId, claimCode);
 }
-async function createProxy2(name, backendPort, openapi, tenantName) {
+async function createProxy2(name, backendPort2, openapi, tenantName) {
   const auth = resolveAuth({});
   const proposed = await proposeFromSpec(openapi).catch(() => null);
   const families = proposed?.status === 200 && Array.isArray(proposed.data?.families) ? proposed.data.families.filter((f) => !f.skipped_reason).map((f) => f.key) : [];
@@ -7631,7 +7683,7 @@ async function createProxy2(name, backendPort, openapi, tenantName) {
     auth_type: auth.auth,
     ...auth.bodyPatch,
     openapi,
-    environments: { dev: { target: `http://localhost:${backendPort}`, description: `the ${B.cli} demo on this machine` } },
+    environments: { dev: { target: `http://localhost:${backendPort2}`, description: `the ${B.cli} demo on this machine` } },
     // Two customers of the same app, each with its own key: the proxy's own tenant is Nino
     // Pizza; the server adds Gino Pizza and returns its key.
     tenant: tenantName,
@@ -7674,12 +7726,12 @@ async function waitThrough(apiUrl, serverKey) {
 async function confirmStep(opts, question) {
   if (opts.yes || !interactive()) return true;
   console.log();
-  return ask(`${import_chalk27.default.bold("?")} ${question} ${import_chalk27.default.dim("(Y/n)")} `);
+  return ask(`${import_chalk24.default.bold("?")} ${question} ${import_chalk24.default.dim("(Y/n)")} `);
 }
 async function busy(text, fn, minMs = 0) {
   if (!process.stdout.isTTY) return fn();
   const t = Date.now();
-  const spinner = (0, import_ora10.default)({ text: import_chalk27.default.dim(text), indent: 3, discardStdin: false }).start();
+  const spinner = (0, import_ora9.default)({ text: import_chalk24.default.dim(text), indent: 3, discardStdin: false }).start();
   try {
     const out = await fn();
     const left = minMs - (Date.now() - t);
@@ -7707,12 +7759,12 @@ function openBrowser3(url) {
 }
 async function offerBrowserAndLogs(dir, opts) {
   if (opts.open === false || opts.yes || !interactive()) return;
-  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  const env = readEnvFile(import_path5.default.join(dir, ".env.local"));
   const url = `http://localhost:${env.APP_PORT}`;
   console.log();
   if (await ask(`  Open ${url} in your browser? (Y/n) `)) openBrowser3(url);
   if (await ask(`  Show the requests reaching ${B.product} here, live? (Y/n) `)) {
-    console.log(import_chalk27.default.dim(`  $ ${logsCommand(env)}`));
+    console.log(import_chalk24.default.dim(`  $ ${logsCommand(env)}`));
     const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
     await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
   }
@@ -7742,17 +7794,31 @@ function routesOf(openapi) {
   return out;
 }
 async function runDemo(opts = {}) {
-  if (opts.serve) return serveTunnel(import_path4.default.resolve(opts.serve));
+  if (opts.serve) return serveTunnel(import_path5.default.resolve(opts.serve));
   try {
     await startDemo(opts);
   } catch (err) {
     const e = err instanceof DemoError ? err : new DemoError(`The demo could not start (${err.message}).`, `Run again: ${LATEST} demo`);
     await stopDemos().catch(() => 0);
-    console.log(`${import_chalk27.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk24.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
 }
+function titleCard(lines) {
+  const inner = Math.max(...lines.map((l) => l.length)) + 12;
+  const center = (t) => {
+    const left = Math.floor((inner - t.length) / 2);
+    return " ".repeat(left) + t + " ".repeat(inner - t.length - left);
+  };
+  const edge = import_chalk24.default.magenta;
+  console.log();
+  console.log(`  ${edge(`\u256D${"\u2500".repeat(inner)}\u256E`)}`);
+  console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
+  lines.forEach((l, i) => console.log(`  ${edge("\u2502")}${i === 0 ? import_chalk24.default.bold(center(l)) : import_chalk24.default.dim(center(l))}${edge("\u2502")}`));
+  console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
+  console.log(`  ${edge(`\u2570${"\u2500".repeat(inner)}\u256F`)}`);
+}
 function printTable(rows) {
   const width = Math.max(100, Math.min(process.stdout.columns || 140, 220));
   const leftW = Math.min(64, Math.max(...rows.map((r) => `\u2713 ${r.label.padEnd(17)} ${r.what}`.length)));
@@ -7769,68 +7835,82 @@ function printTable(rows) {
     if (line) out.push(line);
     return out;
   };
-  const head = (l, r) => console.log(`   ${import_chalk27.default.dim(l.padEnd(leftW))}  ${import_chalk27.default.dim(r)}`);
-  head(`What ${B.product} set up`, "The command that does the same");
+  const head = (l, r) => console.log(`   ${import_chalk24.default.dim(l.padEnd(leftW))}  ${import_chalk24.default.dim(r)}`);
+  head(`What ${B.product} set up`, "The command that does this");
   head("\u2500".repeat(leftW), "\u2500".repeat(Math.min(rightW, 60)));
   for (const r of rows) {
-    const left = `${import_chalk27.default.green("\u2713")} ${import_chalk27.default.bold(r.label.padEnd(17))} ${r.what}`;
+    const left = `${import_chalk24.default.green("\u2713")} ${import_chalk24.default.bold(r.label.padEnd(17))} ${r.what}`;
     const leftPlain = `\u2713 ${r.label.padEnd(17)} ${r.what}`;
     const right = r.cmds.length ? r.cmds.flatMap(wrap2) : ["\u2014"];
-    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk27.default.cyan(right[0])}`);
-    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk27.default.cyan(extra)}`);
+    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk24.default.cyan(right[0])}`);
+    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk24.default.cyan(extra)}`);
   }
 }
 async function startDemo(opts) {
   const t0 = Date.now();
   const here = process.cwd();
-  const dir = import_fs5.default.existsSync(import_path4.default.join(here, STATE_DIR, "state.json")) ? here : import_path4.default.resolve(here, DIR_NAME);
-  const rel = import_path4.default.relative(here, dir) || ".";
+  const dir = import_fs6.default.existsSync(import_path5.default.join(here, STATE_DIR, "state.json")) ? here : import_path5.default.resolve(here, DIR_NAME);
+  const rel = import_path5.default.relative(here, dir) || ".";
   const cdDir = rel === "." ? "" : `cd ${rel} && `;
-  const shell = (c, note = "") => console.log(`   ${import_chalk27.default.dim("$")} ${import_chalk27.default.cyan(c)}${note ? `   ${import_chalk27.default.dim(note)}` : ""}`);
-  const ok = (text, note = "") => console.log(`   ${import_chalk27.default.green("\u2713")} ${text}${note ? `   ${import_chalk27.default.dim(note)}` : ""}`);
+  const shell = (c, note = "") => console.log(`   ${import_chalk24.default.dim("$")} ${import_chalk24.default.cyan(c)}${note ? `   ${import_chalk24.default.dim(note)}` : ""}`);
+  const ok = (text, note = "") => console.log(`   ${import_chalk24.default.green("\u2713")} ${text}${note ? `   ${import_chalk24.default.dim(note)}` : ""}`);
   const stopHere = (lines) => {
     console.log();
     for (const l of lines) console.log(`  ${l}`);
   };
+  titleCard(["Restaurant Reservation Service Demo", `ResiResi, with ${B.product} in front`]);
   await stopDemos();
   writeApp(dir);
   const appPort = await freePort(3e3);
-  const backendPort = await freePort(3001, [appPort]);
-  const directPort = await freePort(3002, [appPort, backendPort]);
+  const backendPort2 = await freePort(3001, [appPort]);
+  const directPort = await freePort(3002, [appPort, backendPort2]);
   const name = demoName();
   const ninoTenant = `ninopizza${import_crypto.default.randomBytes(2).toString("hex")}`;
   const backendSecret = import_crypto.default.randomBytes(18).toString("base64url");
   const openapi = DEMO_FILES["openapi.yaml"];
+  try {
+    const specPath = import_path5.default.join(dir, "openapi.yaml");
+    import_fs6.default.writeFileSync(specPath, import_fs6.default.readFileSync(specPath, "utf8").replace(/^paths:/m, `servers:
+  - url: http://localhost:${backendPort2}
+paths:`));
+  } catch {
+  }
   const L = (c) => `${LATEST} ${c}`;
-  writeEnv(dir, { BACKEND_SECRET: backendSecret, DEMO_NINO_TENANT: ninoTenant, APP_PORT: appPort, BACKEND_PORT: backendPort, DIRECT_PORT: directPort });
+  writeEnv(dir, { BACKEND_SECRET: backendSecret, DEMO_NINO_TENANT: ninoTenant, APP_PORT: appPort, BACKEND_PORT: backendPort2, DIRECT_PORT: directPort });
   console.log();
-  console.log(import_chalk27.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk27.default.dim(`   (no ${B.product} yet)`));
+  console.log(import_chalk24.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk24.default.dim(`   (no ${B.product} yet)`));
   console.log(`   Written to ${rel}. Its routes, from openapi.yaml:`);
-  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk27.default.dim(r.summary)}`);
-  console.log(import_chalk27.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
+  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk24.default.dim(r.summary)}`);
+  console.log(import_chalk24.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
+  if (!await confirmStep(opts, `Ok to serve the backend on localhost:${backendPort2}?`)) {
+    return stopHere([
+      `Stopped before starting anything. ResiResi is written to ${rel}.`,
+      `Start it any time: ${cdDir}npm run start  ${import_chalk24.default.dim("\xB7")}  or run the whole demo again: ${LATEST} demo`
+    ]);
+  }
   shell(`${cdDir}npm run start`, "npm run stop \xB7 npm run restart");
   if (!appCtl(dir, "--background")) throw new DemoError("The ResiResi app could not start.", `Run again: ${LATEST} demo`);
   registerDemo(dir);
-  const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort, directPort]), 1800);
-  if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path4.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`);
-  ok(`${import_chalk27.default.bold("Reservation backend")}: localhost:${backendPort}`, "unprotected");
-  ok(`${import_chalk27.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk27.default.bold(`http://localhost:${directPort}`)}`);
+  const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort2, directPort]), 1800);
+  if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path5.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`);
+  ok(`${import_chalk24.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
+  ok(`${import_chalk24.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk24.default.bold(`http://localhost:${directPort}`)}`);
   console.log("   Book a table directly, the way the unprotected front-end does:");
-  console.log(import_chalk27.default.cyan(`     curl -X POST http://localhost:${backendPort}/reservations \\`));
-  console.log(import_chalk27.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path4.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
-  console.log(import_chalk27.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
-  console.log(import_chalk27.default.cyan(`       -H "content-type: application/json" -d '{"time":"19:30","guests":2}'`));
+  console.log(import_chalk24.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
+  console.log(import_chalk24.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path5.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
+  console.log(import_chalk24.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
+  console.log(import_chalk24.default.cyan(`       -H "content-type: application/json" -d '{"time":"19:30","guests":2}'`));
   if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
     return stopHere([
-      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk27.default.dim(`(${cdDir}npm run stop stops it)`)}`,
+      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk24.default.dim(`(${cdDir}npm run stop stops it)`)}`,
       `Run the whole demo again any time: ${LATEST} demo`
     ]);
   }
   console.log();
-  console.log(import_chalk27.default.bold(`2. ${B.product}, in front of it`));
+  console.log(import_chalk24.default.bold(`2. ${B.product}, in front of it`));
   const tCreate = Date.now();
   const setup = await busy(`Creating the proxy, its tenants, admins, rules and limits\u2026`, async () => {
-    const r = await createProxy2(name, backendPort, openapi, ninoTenant);
+    const r = await createProxy2(name, backendPort2, openapi, ninoTenant);
     const cpKey2 = r.cp_key;
     const teamId2 = r.team_id;
     const keys = r.api_keys ?? {};
@@ -7884,17 +7964,19 @@ async function startDemo(opts) {
     BACKEND_SECRET: backendSecret,
     DEMO_NINO_TENANT: ninoTenant,
     APP_PORT: appPort,
-    BACKEND_PORT: backendPort,
+    BACKEND_PORT: backendPort2,
     DIRECT_PORT: directPort
   });
-  const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort, apiUrl, claimCode: setup.claimCode };
+  const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort: backendPort2, apiUrl, claimCode: setup.claimCode };
   saveState(dir, state);
   printTable([
-    { label: "Proxy", what: `${project} (${createSecs} s, no account)`, cmds: [L(`dev --port ${backendPort} --openapi ./openapi.yaml --name ${name} --tenant ${ninoTenant} --auto`)] },
+    // `create` from the spec in the folder (it names localhost:<backend port> under servers:); step 3's
+    // `dev --project` then opens the tunnel to that same proxy and creates nothing.
+    { label: "Proxy", what: `${project} (${createSecs} s, no account)`, cmds: [L(`create --target ./openapi.yaml --name ${name} --tenant ${ninoTenant} --auto`)] },
     {
       label: "Customers/Tenants",
       what: gino ? "Nino Pizza and Gino Pizza, own API keys" : "Nino Pizza, its own API key",
-      cmds: gino?.tenant ? [L(`tenant create --name "Gino Pizza" --slug ${gino.tenant}`), L(`tenant attach ${project} --tenant ${gino.tenant}`), L(`apikeys mint --tenant ${gino.tenant} --backend --env dev`)] : []
+      cmds: gino?.tenant ? [L(`tenant create --name "Gino Pizza" --slug ${gino.tenant}`), L(`tenant attach ${project} --tenant ${gino.tenant}`)] : []
     },
     ...adminOk ? [{
       label: "Admins",
@@ -7902,25 +7984,29 @@ async function startDemo(opts) {
       cmds: [L(`admins add ${DEMO_ADMIN_EMAIL} --tenant ${tenant2}`), ...ginaOk && gino?.tenant ? [L(`admins add ${DEMO_GINO_ADMIN_EMAIL} --tenant ${gino.tenant}`)] : []]
     }] : [],
     ...applied.length ? [{ label: "Rules", what: "only who made a reservation can change it", cmds: [L(`rule ${project} "${RULE_SENTENCE}"`)] }] : [],
-    { label: "AI (MCP Tools)", what: `${tools.length} tools, one per route`, cmds: ["(part of dev, above)"] },
+    { label: "AI (MCP Tools)", what: `${tools.length} tools, one per route`, cmds: ["(part of create, above)"] },
     ...limited ? [{ label: "Limits", what: `${DEMO_RPS} calls a second per customer`, cmds: [L(`limits set ${project} --rate ${DEMO_RPS} --end-user-rate ${DEMO_RPS}`)] }] : [],
     { label: "Backend secret", what: "added to every call APIblaze forwards", cmds: [L(`transform ${project} set-header x-target-api-key --value-env BACKEND_SECRET --secret`)] },
-    { label: "Keys", what: "saved to .env.local, never printed", cmds: [] }
+    {
+      label: "Keys",
+      what: "saved to .env.local, never printed",
+      cmds: [L(`apikeys mint --tenant ${tenant2} --backend --env dev`), ...gino?.tenant ? [L(`apikeys mint --tenant ${gino.tenant} --backend --env dev`)] : []]
+    }
   ]);
-  if (!await confirmStep(opts, `Ok to create a tunnel allowing ${project} to forward requests to localhost:${backendPort}?`)) {
+  if (!await confirmStep(opts, `Ok to create a tunnel allowing ${project} to forward requests to localhost:${backendPort2}?`)) {
     return stopHere([
       `Stopped before the tunnel. The proxy exists but cannot reach this laptop yet.`,
       `Open the tunnel any time: ${LATEST} demo start`
     ]);
   }
   console.log();
-  console.log(import_chalk27.default.bold("3. Live on the internet"));
-  shell(`${LATEST} dev --port ${backendPort} --project ${project} --auto`, "the tunnel, in the background");
-  await busy(`Opening the tunnel to localhost:${backendPort} and checking it with a real call\u2026`, async () => {
+  console.log(import_chalk24.default.bold("3. Live on the internet"));
+  shell(`${LATEST} dev --port ${backendPort2} --project ${project} --auto`, "the tunnel, in the background");
+  await busy(`Opening the tunnel to localhost:${backendPort2} and checking it with a real call\u2026`, async () => {
     await spawnTunnel(dir, state);
     await waitThrough(apiUrl, serverKey);
   }, 1200);
-  ok(`${import_chalk27.default.bold("Tunnel")}: the public address reaches localhost:${backendPort} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
+  ok(`${import_chalk24.default.bold("Tunnel")}: the public address reaches localhost:${backendPort2} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
   printAddresses(dir);
   if (!await confirmStep(opts, "Ok to launch the protected website, which will use the proxy to reach the backend?")) {
     return stopHere([
@@ -7929,29 +8015,29 @@ async function startDemo(opts) {
     ]);
   }
   console.log();
-  console.log(import_chalk27.default.bold(`4. The protected website, through ${B.product}`));
+  console.log(import_chalk24.default.bold(`4. The protected website, through ${B.product}`));
   shell(`${cdDir}npm run restart`, "picks up the keys in .env.local");
   const siteUp = await busy("Starting the protected website\u2026", async () => {
     appCtl(dir, "--stop");
     appCtl(dir, "--background");
-    return waitPorts([appPort, directPort, backendPort]);
+    return waitPorts([appPort, directPort, backendPort2]);
   }, 1500);
-  if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path4.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`);
-  ok(`${import_chalk27.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk27.default.bold(`http://localhost:${appPort}`)}`);
-  ok(`${import_chalk27.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
+  if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path5.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`);
+  ok(`${import_chalk24.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk24.default.bold(`http://localhost:${appPort}`)}`);
+  ok(`${import_chalk24.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
   console.log();
-  console.log(import_chalk27.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path4.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
+  console.log(import_chalk24.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path5.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
   await offerBrowserAndLogs(dir, opts);
 }
 function printAddresses(dir) {
-  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
-  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk27.default.dim(note)}` : ""}`);
+  const env = readEnvFile(import_path5.default.join(dir, ".env.local"));
+  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk24.default.dim(note)}` : ""}`);
   row("Public API", env.APIBLAZE_URL ?? "", `${B.product} tunnel \u2192 localhost:${env.BACKEND_PORT}`);
   row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor (Nino Pizza)");
   if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
 }
 async function spawnTunnel(dir, state) {
-  const log4 = import_fs5.default.openSync(import_path4.default.join(dir, STATE_DIR, "tunnel.log"), "a");
+  const log4 = import_fs6.default.openSync(import_path5.default.join(dir, STATE_DIR, "tunnel.log"), "a");
   const child = (0, import_child_process4.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
   child.unref();
   saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
@@ -7962,9 +8048,9 @@ async function runDemoStart(opts = {}) {
   const t0 = Date.now();
   const dir = demoDir();
   const state = loadState(dir);
-  const env = readEnvFile(import_path4.default.join(dir, ".env.local"));
+  const env = readEnvFile(import_path5.default.join(dir, ".env.local"));
   if (!state || !env.APIBLAZE_SERVER_KEY) {
-    console.log(`${import_chalk27.default.red("\u2717")} There is no demo here to start.`);
+    console.log(`${import_chalk24.default.red("\u2717")} There is no demo here to start.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
@@ -7973,30 +8059,30 @@ async function runDemoStart(opts = {}) {
     await spawnTunnel(dir, state);
   } catch (err) {
     const e = err instanceof DemoError ? err : new DemoError(`The tunnel could not start (${err.message}).`, `Start over: ${LATEST} demo`);
-    console.log(`${import_chalk27.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk24.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
-  console.log(`${import_chalk27.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk27.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
+  console.log(`${import_chalk24.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk24.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
   printAddresses(dir);
   const appUp = await fetch(`http://127.0.0.1:${env.APP_PORT}/api/config`).then(() => true).catch(() => false);
-  if (!appUp) console.log(import_chalk27.default.yellow(`   ResiResi is not running: cd ${import_path4.default.relative(process.cwd(), dir) || "."} && npm run start`));
+  if (!appUp) console.log(import_chalk24.default.yellow(`   ResiResi is not running: cd ${import_path5.default.relative(process.cwd(), dir) || "."} && npm run start`));
   await offerBrowserAndLogs(dir, opts);
 }
 async function runDemoLogs() {
-  const env = readEnvFile(import_path4.default.join(demoDir(), ".env.local"));
+  const env = readEnvFile(import_path5.default.join(demoDir(), ".env.local"));
   if (!env.APIBLAZE_NAME) {
-    console.log(`${import_chalk27.default.red("\u2717")} There is no demo here.`);
+    console.log(`${import_chalk24.default.red("\u2717")} There is no demo here.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
-  console.log(import_chalk27.default.dim(`$ ${logsCommand(env)}`));
+  console.log(import_chalk24.default.dim(`$ ${logsCommand(env)}`));
   const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
   await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
 }
 async function runDemoStop() {
   const n = await stopTunnels();
-  console.log(n ? `${import_chalk27.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
+  console.log(n ? `${import_chalk24.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
 }
 async function serveTunnel(dir) {
   const state = loadState(dir);
@@ -8054,17 +8140,17 @@ async function serveTunnel(dir) {
   await new Promise(() => {
   });
 }
-var import_fs5, import_path4, import_net, import_child_process4, import_crypto, import_chalk27, import_ora10, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
+var import_fs6, import_path5, import_net2, import_child_process4, import_crypto, import_chalk24, import_ora9, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
-    import_fs5 = __toESM(require("fs"));
-    import_path4 = __toESM(require("path"));
-    import_net = __toESM(require("net"));
+    import_fs6 = __toESM(require("fs"));
+    import_path5 = __toESM(require("path"));
+    import_net2 = __toESM(require("net"));
     import_child_process4 = require("child_process");
     import_crypto = __toESM(require("crypto"));
-    import_chalk27 = __toESM(require("chalk"));
-    import_ora10 = __toESM(require("ora"));
+    import_chalk24 = __toESM(require("chalk"));
+    import_ora9 = __toESM(require("ora"));
     init_api();
     init_tunnel_client();
     init_auth();
@@ -8088,7 +8174,7 @@ var init_demo = __esm({
     ADJ = ["brave", "calm", "clever", "eager", "happy", "jolly", "lucky", "merry", "noble", "quick", "sunny", "swift", "witty", "zesty", "bright", "gentle"];
     NOUN = ["otter", "falcon", "panda", "heron", "koala", "lemur", "puffin", "robin", "tiger", "walrus", "wombat", "badger", "comet", "maple", "river", "finch"];
     pick2 = (a) => a[import_crypto.default.randomInt(a.length)];
-    registryFile = () => import_path4.default.join(getApiblazeDir(), "demo-runs.json");
+    registryFile = () => import_path5.default.join(getApiblazeDir(), "demo-runs.json");
     alive = (pid) => {
       try {
         process.kill(pid, 0);
@@ -8353,7 +8439,7 @@ function runCli(args, cwd, home, timeoutMs) {
 function readEnv(file2) {
   const out = {};
   try {
-    for (const line of import_fs8.default.readFileSync(file2, "utf8").split("\n")) {
+    for (const line of import_fs10.default.readFileSync(file2, "utf8").split("\n")) {
       const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
       if (m) out[m[1]] = m[2];
     }
@@ -8386,7 +8472,7 @@ async function journey(label3, work, home, checks) {
     `exit ${run2.code} in ${Math.round(run2.ms / 1e3)} s${leaked ? " \xB7 PRINTED A SECRET" : ""}${run2.code !== 0 ? ` \xB7 ${run2.out.trim().split("\n").slice(-2).join(" / ")}` : ""}`
   );
   if (run2.code !== 0) return null;
-  const env = readEnv(import_path5.default.join(work, `${B.cli}-demo`, ".env.local"));
+  const env = readEnv(import_path7.default.join(work, `${B.cli}-demo`, ".env.local"));
   const api = env.APIBLAZE_URL;
   const nino = env.APIBLAZE_SERVER_KEY;
   const as = (user, key = nino) => ({ "x-api-key": key, "x-end-user-id": user, "content-type": "application/json" });
@@ -8451,11 +8537,11 @@ async function journey(label3, work, home, checks) {
 }
 async function runOpAnon(o = {}) {
   const t0 = Date.now();
-  const root = import_fs8.default.mkdtempSync(import_path5.default.join(import_os2.default.tmpdir(), `${B.cli}-op-anon-`));
-  const home = import_path5.default.join(root, "home");
-  const work = import_path5.default.join(root, "work");
-  import_fs8.default.mkdirSync(home);
-  import_fs8.default.mkdirSync(work);
+  const root = import_fs10.default.mkdtempSync(import_path7.default.join(import_os2.default.tmpdir(), `${B.cli}-op-anon-`));
+  const home = import_path7.default.join(root, "home");
+  const work = import_path7.default.join(root, "work");
+  import_fs10.default.mkdirSync(home);
+  import_fs10.default.mkdirSync(work);
   const checks = [];
   const log4 = (s) => {
     if (!o.json) console.log(s);
@@ -8466,21 +8552,21 @@ async function runOpAnon(o = {}) {
     await journey("rerun", work, home, checks);
   } finally {
     const stop = await runCli(["demo", "stop"], work, home, 3e4);
-    const demoFolder = import_path5.default.join(work, `${B.cli}-demo`);
-    if (import_fs8.default.existsSync(import_path5.default.join(demoFolder, "start.js"))) {
+    const demoFolder = import_path7.default.join(work, `${B.cli}-demo`);
+    if (import_fs10.default.existsSync(import_path7.default.join(demoFolder, "start.js"))) {
       await new Promise((res) => {
-        const c = (0, import_child_process5.spawn)(process.execPath, [import_path5.default.join(demoFolder, "start.js"), "--stop"], { cwd: demoFolder, stdio: "ignore" });
+        const c = (0, import_child_process5.spawn)(process.execPath, [import_path7.default.join(demoFolder, "start.js"), "--stop"], { cwd: demoFolder, stdio: "ignore" });
         c.on("close", () => res());
       });
     }
-    const env = readEnv(import_path5.default.join(work, `${B.cli}-demo`, ".env.local"));
+    const env = readEnv(import_path7.default.join(work, `${B.cli}-demo`, ".env.local"));
     let portsFree = true;
     for (const p of [env.APP_PORT, env.BACKEND_PORT].filter(Boolean)) {
       const r = await http(`http://127.0.0.1:${p}/`, { timeoutMs: 2e3 });
       if (r.status !== 0) portsFree = false;
     }
     checks.push({ id: "stop", ok: stop.code === 0 && portsFree, detail: `exit ${stop.code}${portsFree ? "" : " \xB7 ports still answering"}` });
-    import_fs8.default.rmSync(root, { recursive: true, force: true });
+    import_fs10.default.rmSync(root, { recursive: true, force: true });
   }
   for (const c of checks) log4(`  ${c.skipped ? import_chalk70.default.yellow("\u2013") : c.ok ? import_chalk70.default.green("\u2713") : import_chalk70.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk70.default.dim(c.detail)}`);
   const failed = checks.filter((c) => !c.ok).length;
@@ -8493,13 +8579,13 @@ async function runOpAnon(o = {}) {
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
 }
-var import_fs8, import_os2, import_path5, import_child_process5, import_chalk70, SECRET;
+var import_fs10, import_os2, import_path7, import_child_process5, import_chalk70, SECRET;
 var init_op_anon = __esm({
   "src/commands/op-anon.ts"() {
     "use strict";
-    import_fs8 = __toESM(require("fs"));
+    import_fs10 = __toESM(require("fs"));
     import_os2 = __toESM(require("os"));
-    import_path5 = __toESM(require("path"));
+    import_path7 = __toESM(require("path"));
     import_child_process5 = require("child_process");
     import_chalk70 = __toESM(require("chalk"));
     init_brand();
@@ -8508,7 +8594,7 @@ var init_op_anon = __esm({
 });
 
 // src/index.ts
-var import_fs9 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_commander = require("commander");
 var import_chalk72 = __toESM(require("chalk"));
 init_package();
@@ -8517,7 +8603,7 @@ init_types();
 init_login();
 
 // src/commands/dev.ts
-var import_fs3 = __toESM(require("fs"));
+var import_fs4 = __toESM(require("fs"));
 init_package();
 init_version_guard();
 var import_chalk20 = __toESM(require("chalk"));
@@ -8839,7 +8925,7 @@ async function runDev(options) {
   let recordSink;
   let captureStream;
   if (options.captureFile) {
-    captureStream = import_fs3.default.createWriteStream(options.captureFile, { flags: "a" });
+    captureStream = import_fs4.default.createWriteStream(options.captureFile, { flags: "a" });
     recordSink = (r) => captureStream.write(JSON.stringify(r) + "\n");
   }
   let restore = [];
@@ -9026,12 +9112,199 @@ ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 init_create();
 
 // src/commands/skill.ts
-var import_fs4 = __toESM(require("fs"));
-var import_path3 = __toESM(require("path"));
-var import_chalk22 = __toESM(require("chalk"));
+var import_fs7 = __toESM(require("fs"));
+var import_path6 = __toESM(require("path"));
+var import_chalk25 = __toESM(require("chalk"));
 init_brand();
+
+// src/lib/detect-backend.ts
+var import_fs5 = __toESM(require("fs"));
+var import_path4 = __toESM(require("path"));
+var import_net = __toESM(require("net"));
+var NODE_SERVERS = [
+  ["express", "Express", 3e3],
+  ["fastify", "Fastify", 3e3],
+  ["koa", "Koa", 3e3],
+  ["hono", "Hono", 3e3],
+  ["@nestjs/core", "NestJS", 3e3],
+  ["@hapi/hapi", "hapi", 3e3],
+  ["restify", "Restify", 8080],
+  ["elysia", "Elysia", 3e3],
+  ["next", "Next.js", 3e3],
+  ["nuxt", "Nuxt", 3e3],
+  ["@remix-run/node", "Remix", 3e3]
+];
+var NODE_FRONTENDS = [["vite", "Vite"], ["react-scripts", "Create React App"], ["@angular/core", "Angular"], ["svelte", "Svelte"]];
+var PY_SERVERS = [
+  [/\bfastapi\b/i, "FastAPI", 8e3],
+  [/\bdjango\b/i, "Django", 8e3],
+  [/\bflask\b/i, "Flask", 5e3],
+  [/\bstarlette\b/i, "Starlette", 8e3],
+  [/\baiohttp\b/i, "aiohttp", 8080]
+];
+var GO_SERVERS = [[/gin-gonic\/gin/, "Gin"], [/labstack\/echo/, "Echo"], [/go-chi\/chi/, "chi"], [/gofiber\/fiber/, "Fiber"]];
+var RUBY_SERVERS = [[/^\s*gem ['"]rails['"]/m, "Rails", 3e3], [/^\s*gem ['"]sinatra['"]/m, "Sinatra", 4567]];
+var SPEC_NAMES = ["openapi.yaml", "openapi.yml", "openapi.json", "swagger.yaml", "swagger.yml", "swagger.json"];
+var SPEC_DIRS = [".", "api", "spec", "specs", "docs", "openapi", "src"];
+var COMMON_PORTS = [3e3, 3001, 4e3, 5e3, 8e3, 8080, 8787];
+var SPEC_PATHS = ["/openapi.json", "/openapi.yaml", "/docs/openapi.json", "/swagger.json", "/api/openapi.json"];
+function readText(file2, max = 256 * 1024) {
+  try {
+    const st = import_fs5.default.statSync(file2);
+    if (!st.isFile() || st.size > max) return null;
+    return import_fs5.default.readFileSync(file2, "utf8");
+  } catch {
+    return null;
+  }
+}
+function findSpecFile(dir) {
+  for (const d of SPEC_DIRS) {
+    for (const n of SPEC_NAMES) {
+      const rel = d === "." ? n : `${d}/${n}`;
+      const text = readText(import_path4.default.join(dir, rel));
+      if (text && /\b(openapi|swagger)\s*["']?\s*:/.test(text)) {
+        const m = /\b(?:localhost|127\.0\.0\.1):(\d{2,5})\b/.exec(text);
+        return { file: `./${rel}`, ...m ? { port: Number(m[1]) } : {} };
+      }
+    }
+  }
+  return void 0;
+}
+function portFromScripts(scripts) {
+  for (const s of Object.values(scripts)) {
+    const m = /(?:--port[= ]|-p |PORT=)(\d{2,5})\b/.exec(s);
+    if (m) return Number(m[1]);
+  }
+  return void 0;
+}
+function fromNode(dir, out) {
+  const text = readText(import_path4.default.join(dir, "package.json"));
+  if (!text) return;
+  let pkg = {};
+  try {
+    pkg = JSON.parse(text);
+  } catch {
+    return;
+  }
+  const deps = { ...pkg.devDependencies ?? {}, ...pkg.dependencies ?? {} };
+  const scripts = pkg.scripts ?? {};
+  const server = NODE_SERVERS.find(([dep]) => dep in deps);
+  if (server) {
+    out.framework = server[1];
+    out.source = "package.json";
+    out.defaultPort = server[2];
+  } else if (/\bnode\s+\S+\.(c|m)?js\b/.test(Object.values(scripts).join(" "))) {
+    out.framework = "a Node server";
+    out.source = "package.json";
+    out.defaultPort = 3e3;
+  } else {
+    const fe = NODE_FRONTENDS.find(([dep]) => dep in deps);
+    if (fe) out.frontendOnly = fe[1];
+    return;
+  }
+  out.configuredPort = portFromScripts(scripts);
+  out.start = scripts.dev ? "npm run dev" : scripts.start ? "npm start" : void 0;
+}
+function fromPython(dir, out) {
+  for (const f of ["requirements.txt", "pyproject.toml", "Pipfile"]) {
+    const text = readText(import_path4.default.join(dir, f));
+    if (!text) continue;
+    const hit = PY_SERVERS.find(([re]) => re.test(text));
+    if (hit) {
+      out.framework = hit[1];
+      out.source = f;
+      out.defaultPort = hit[2];
+      return;
+    }
+  }
+}
+function fromOthers(dir, out) {
+  const gomod = readText(import_path4.default.join(dir, "go.mod"));
+  if (gomod) {
+    const hit = GO_SERVERS.find(([re]) => re.test(gomod));
+    out.framework = hit ? hit[1] : "a Go server";
+    out.source = "go.mod";
+    out.defaultPort = 8080;
+    return;
+  }
+  const gemfile = readText(import_path4.default.join(dir, "Gemfile"));
+  if (gemfile) {
+    const hit = RUBY_SERVERS.find(([re]) => re.test(gemfile));
+    if (hit) {
+      out.framework = hit[1];
+      out.source = "Gemfile";
+      out.defaultPort = hit[2];
+      return;
+    }
+  }
+  for (const f of ["pom.xml", "build.gradle", "build.gradle.kts"]) {
+    const text = readText(import_path4.default.join(dir, f));
+    if (text && /spring-boot/.test(text)) {
+      out.framework = "Spring Boot";
+      out.source = f;
+      out.defaultPort = 8080;
+      return;
+    }
+  }
+}
+function portAnswers(port, timeoutMs = 300) {
+  return new Promise((resolve4) => {
+    const sock = import_net.default.connect({ port, host: "127.0.0.1" });
+    const done = (v) => {
+      sock.destroy();
+      resolve4(v);
+    };
+    sock.setTimeout(timeoutMs, () => done(false));
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+  });
+}
+async function liveSpec(port) {
+  for (const p of SPEC_PATHS) {
+    try {
+      const r = await fetch(`http://localhost:${port}${p}`, { signal: AbortSignal.timeout(800) });
+      if (!r.ok) continue;
+      const text = (await r.text()).slice(0, 4096);
+      if (/\b(openapi|swagger)\s*["']?\s*:/.test(text)) return `http://localhost:${port}${p}`;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function detectBackend(dir, opts = {}) {
+  const out = {};
+  try {
+    if (import_fs5.default.existsSync(import_path4.default.join(dir, ".demo", "state.json"))) out.isDemo = true;
+    fromNode(dir, out);
+    if (!out.framework) fromPython(dir, out);
+    if (!out.framework) fromOthers(dir, out);
+    const spec2 = findSpecFile(dir);
+    if (spec2) {
+      out.specFile = spec2.file;
+      if (spec2.port && !out.configuredPort) out.configuredPort = spec2.port;
+    }
+  } catch {
+  }
+  const preferred = [...new Set([out.configuredPort, out.defaultPort].filter((p) => !!p))];
+  const ports = [.../* @__PURE__ */ new Set([...preferred, ...opts.ports ?? COMMON_PORTS])];
+  const answering = await Promise.all(ports.map(async (p) => await portAnswers(p) ? p : 0));
+  const up = answering.filter(Boolean);
+  const mine = preferred.find((p) => up.includes(p));
+  if (mine && (out.framework || out.specFile)) out.listening = mine;
+  else if (!out.framework && !out.specFile && up.length) out.strayPorts = up;
+  if (out.listening) out.specUrl = await liveSpec(out.listening);
+  return out;
+}
+function hasBackend(f) {
+  return !f.isDemo && !!(f.framework || f.specFile);
+}
+function backendPort(f) {
+  return f.listening ?? f.configuredPort ?? f.defaultPort;
+}
+
+// src/commands/skill.ts
 var SKILL_NAME = "ship-safely";
-var SKILL_RELATIVE_PATH = import_path3.default.join(".claude", "skills", SKILL_NAME, "SKILL.md");
+var SKILL_RELATIVE_PATH = import_path6.default.join(".claude", "skills", SKILL_NAME, "SKILL.md");
 var CP_TOOLS = [
   "describe_server",
   "propose_rules",
@@ -9046,9 +9319,82 @@ var CP_TOOLS = [
 function withLatest(md) {
   return md.replace(/npx (apiblaze|mcpblaze)(?![@\w-])/g, "npx $1@latest");
 }
-function heroMarkdown() {
+function pitchText() {
+  const kind = BRAND === "mcpblaze" ? "MCP and API" : "API and MCP";
+  return `${B.product} is a serverless ${kind} gateway. Put it in front of your backend and it's ready for traffic from people and AI agents. Callers sign in with API keys or OAuth, each can only do what their credentials allow, bots get throttled, and every customer gets their own space. Seconds, not weeks, even for an app on your laptop.`;
+}
+function appName(f) {
+  const fw = f.framework ?? "an API";
+  if (/^an? /.test(fw)) return fw[0].toUpperCase() + fw.slice(1);
+  return `${/^[AEIOU]/i.test(fw) ? "An" : "A"} ${fw} app`;
+}
+function folderReport(f, opts = {}) {
+  const P = B.product;
+  const demoQuestion = "Want me to show you on a sample app? About 30 seconds, nothing to install.";
+  if (f.isDemo) {
+    return { lines: [`This is the ${P} demo folder (ResiResi). It is already behind ${P}; \`npx ${B.cli}@latest demo start\` reopens its tunnel.`], question: demoQuestion, ownApi: false };
+  }
+  if (!hasBackend(f)) {
+    const extra = [
+      f.frontendOnly ? ` It is a ${f.frontendOnly} frontend with no server of its own.` : "",
+      // A person may know what that is; an agent would only be distracted by it.
+      opts.forPerson && f.strayPorts?.length ? ` Something answers on localhost:${f.strayPorts[0]}, but nothing in this folder points at it.` : ""
+    ].join("");
+    return { lines: [`No backend here: no server framework in the project files and no OpenAPI spec.${extra}`], question: demoQuestion, ownApi: false };
+  }
+  const port = backendPort(f);
+  const spec2 = f.specFile ? `Spec: ${f.specFile}.` : f.specUrl ? `It serves its spec at ${f.specUrl}.` : "No OpenAPI spec yet.";
+  const from = f.source ? ` (${f.source})` : "";
+  if (f.listening) {
+    return {
+      lines: [`${appName(f)}${from}, answering on localhost:${f.listening} right now. ${spec2}`],
+      question: `Want me to put your API on port ${f.listening} behind ${P}? About 30 seconds, no sign-up.`,
+      ownApi: true
+    };
+  }
+  const starts = f.start ? ` It starts with \`${f.start}\`` : " Its start command is not in its files";
+  const listens = port ? ` and listens on ${port}.` : ".";
+  return {
+    lines: [`${appName(f)}${from}, not running.${starts}${listens} ${spec2}`],
+    question: `Want me to start your app and put it behind ${P}? About a minute, no sign-up.`,
+    ownApi: true
+  };
+}
+function heroMarkdown(found) {
   const P = B.product;
   const run2 = `npx ${B.cli}@latest`;
+  const report = found ? folderReport(found) : null;
+  const port = found ? backendPort(found) : void 0;
+  const folder = report ? `## This folder, checked by the CLI just now: read no files to decide what to offer
+
+${report.lines.map((l) => `- ${l}`).join("\n")}
+` : `## First, the folder
+
+Run \`${run2} skills\` in the project folder and follow what it prints: it checks the folder
+and gives the exact question to ask.
+`;
+  const question = report?.question ?? "<the question it prints>";
+  const ownApi = report?.ownApi && found ? (() => {
+    const specArg = found.specFile ? ` --openapi ${found.specFile}` : "";
+    const steps = [`Say one line: "Putting your API behind ${P}, about 30 seconds."`];
+    if (!found.listening) {
+      steps.push(`Start it first as its own detached process${found.start ? `: \`nohup ${found.start} > app.log 2>&1 < /dev/null &\`` : ", with its usual start command"}. Wait until localhost:${port ?? "<port>"} answers.`);
+    }
+    if (!found.specFile && !found.specUrl) {
+      steps.push('Write `./openapi.yaml` from its route files first: every path and method, and the id each POST returns. Say "Writing an OpenAPI spec from your code."');
+    }
+    const spec2 = found.specFile ? specArg : !found.specUrl ? " --openapi ./openapi.yaml" : "";
+    steps.push(`Open the tunnel as its own detached process, never \`cmd &\` inside a shell call that ends:
+   \`nohup ${run2} dev --port ${port ?? "<port>"}${spec2} --auto > ${B.cli}-dev.log 2>&1 < /dev/null &\`
+   Then read ${B.cli}-dev.log until it says "is live on the internet" (about 20 seconds). It saves the key to .env.local itself.`);
+    steps.push(`Tell them in plain words, with the two addresses it printed: their API is on the internet at the API address, and AI assistants can use it at the MCP address. API keys, sign-in, rules for who can change what, and rate limits are already on. Say "saved your key to .env.local". Leave the tunnel running.`);
+    steps.push(`Ask one question: **"Want it ready for real customers: their own API keys, sign-in, and only-the-owner-can-change rules?"** If yes, run \`${run2} skills ship\` and follow it from "Adopt".`);
+    return `
+## Their API: they say yes to putting it behind ${P}
+
+${steps.map((t, i) => `${i + 1}. ${t}`).join("\n")}
+`;
+  })() : "";
   return `---
 name: ${SKILL_NAME}
 description: Use when the user asks what ${P} (or ${B.cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share or expose an API; wants API keys, sign-in, per-user data, rate limits or quotas; wants AI agents to use their app safely; or says users can reach each other's records.
@@ -9056,17 +9402,16 @@ description: Use when the user asks what ${P} (or ${B.cli}) does or can do for t
 
 # ${P}
 
-## Explain: they ask what ${P} does
+${folder}
+## Explain: they ask what ${P} does or can do for them
 
-Run nothing. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
+Run nothing else. Say exactly this and nothing else: no list of use cases, no commands, no options. Then stop:
 
-"${P} puts the app on your laptop on the internet in one command. It gets a public address,
-plus an address AI assistants like me can use to work with it. API keys, sign-in and
-who-can-change-what come built in, with no code. Want me to show you in about 30 seconds?"
+"${pitchText()} ${question}"
 
-Do not use the words proxy, MCP, tenant, OpenAPI or header unless the user does first.
-
-## Demo: they say yes, or ask to see or try it
+Do not use the words proxy, tenant, OpenAPI or header unless the user does first.
+${ownApi}
+## Demo: they say yes to the sample app, or ask to see or try it
 
 1. Say one line: "Starting the demo, about 30 seconds."
 2. Run exactly this, in the foreground. It needs no login and asks nothing. It sets
@@ -9083,10 +9428,17 @@ Rules for the demo: keep each update to one line. Do not narrate steps, read the
 files, open logs, run other commands, or write code. Never show a key: the demo saves it
 in \`.env.local\` and never prints it.
 
-## Their own app: they say yes to that
+## Their own app: they say yes after the demo
 
 Their app runs on this machine \u2192 it will use \`${run2} dev\`; it is deployed \u2192 \`${run2} create\`.
-Run \`${run2} skills --ship\` and follow what it prints.
+Run \`${run2} skills ship\` and follow what it prints.
+
+## One thing at a time, later
+
+When they ask about one thing, read only its page: \`${run2} skills keys\` (API keys) \xB7
+\`signin\` (OAuth sign-in and the developer portal) \xB7 \`rules\` (who can change what) \xB7
+\`limits\` (rate limits and quotas) \xB7 \`mcp\` (AI agents) \xB7 \`widgets\` (keys, users and chat on
+their site) \xB7 \`ship\` (the whole procedure for their own app).
 `;
 }
 function shipMarkdown() {
@@ -9299,8 +9651,11 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    read the log. If it stops, re-run the SAME command: the same \`--name\` reattaches and
    creates nothing. Never pick a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
    \`npx ${cli} create --target <url-or-spec> --name <name> --auto <door flags>\`. Both print the
-   URL, the MCP URL (the "agents:" line), what is locked, and the bootstrap key ONCE \u2014 that key
-   goes in the frontend-server's env, never a browser, a repo or an agent config. The tenant is
+   URL, the MCP URL (the "agents:" line) and what is locked. Run by you (no terminal), \`dev\`
+   saves the bootstrap key to \`.env.local\` as \`APIBLAZE_SERVER_KEY\` and never prints it;
+   \`create\` prints it ONCE \u2014 save it there yourself. Either way say only "saved your key to
+   .env.local": that key goes in the frontend-server's env, never a browser, a repo, an agent
+   config or the chat. The tenant is
    not labelled: read it from the \`admins add \u2026 --tenant <tenant>\` hint (it is also the middle
    of the MCP hostname). Save \`APIBLAZE_URL\`, \`APIBLAZE_SERVER_KEY\`, \`APIBLAZE_TENANT\` in
    the frontend-server's env (\`.env.local\` for Next.js). Then prove it with three curls and
@@ -9335,6 +9690,8 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    - the command to chat with their API: \`npx ${cli} apichat <name>\` (add
      \`--xenduserid ana\` when \xA75b is on).
    Then ask once: "Would you like me to add the self-serve API key widget to your site?"
+   After that answer, offer once: "Want me to save this as a skill in your project, so I know
+   ${P} next time?" Yes \u2192 \`npx ${cli} skills --install\`.
 
 ## Report like this
 
@@ -9410,36 +9767,184 @@ through one MCP: \`claude mcp add --transport http ${BRAND} ${B.controlPlaneMcp}
 ${CP_TOOLS.join(", ")} \u2014 the same steps, one tool each.
 `;
 }
+function sectionOf(md, heading) {
+  const at = md.indexOf(`
+${heading}`);
+  if (at < 0) return "";
+  const next = md.indexOf("\n## ", at + heading.length + 1);
+  return md.slice(at + 1, next < 0 ? void 0 : next).trim();
+}
+var TOPICS = ["ship", "keys", "signin", "rules", "limits", "mcp", "widgets"];
+function topicMarkdown(topic) {
+  const P = B.product;
+  const cli = B.cli;
+  const legacy = legacySkillMarkdown();
+  const page = (title, body) => withLatest(`# ${title}
+
+${body.trim()}
+`);
+  switch (topic) {
+    case "ship":
+      return shipMarkdown();
+    case "keys":
+      return page(`API keys with ${P}`, `
+Every ${B.thingShort} has a key door. Three kinds of key for a tenant (one of their customers), one flag each:
+- \`npx ${cli} apikeys mint --tenant <tenant> --backend\`: a server key. Their server sends it as
+  \`X-API-Key\` and names the person in \`X-End-User-Id\`.
+- \`--client\`: a key that cannot name a user (a public client, a script).
+- \`--for <email>\`: bound to one person, like an agent or a CI job. Calls count as that person, and
+  ownership rules trust it. It is a DIFFERENT identity from a bare \`X-End-User-Id\` string: rows
+  created as "ana" through the header are not owned by ana@example.com's key.
+
+Their customers get a key per tenant from the self-serve keys widget (\`npx ${cli} skills widgets\`):
+each customer mints their own, in their own tenant. The bootstrap key is only for their own server.
+Never show a key in the chat: save it to \`.env.local\` and say "saved your key to .env.local".`);
+    case "signin":
+      return page(`Sign-in (OAuth) with ${P}`, `
+${sectionOf(legacy, "## Sign-in shapes")}
+
+Each tenant has its own developer portal, where people sign in and get a key:
+\`https://<tenant>.portal.apiblaze.com/<version>\`. A tenant added later gets the same sign-in:
+\`npx ${cli} tenant attach <name> --tenant <tenant>\`.
+
+Tenant admins, by email, even before that person ever signs in:
+\`npx ${cli} admins add <email> --tenant <tenant>\` \xB7 \`admins list --tenant <tenant>\` \xB7 \`admins remove <email> --tenant <tenant>\`.`);
+    case "rules":
+      return page("Who can change what", `
+- With a spec, \`dev\` and \`create\` lock every resource to the person who created it.
+- \`npx ${cli} rule <name>\` shows the rules. \`npx ${cli} rule <name> "<sentence>"\` adds one in plain
+  words, for example "Only the person who made a reservation can change or cancel it". Both need
+  a login (\`npx ${cli} login\`); an anonymous workspace keeps the creator locks \`dev\` applied.
+- \`npx ${cli} identified <name> require\`: every call must name a person (\`X-End-User-Id\` or a
+  sign-in token). \`allow-anon\` undoes it.
+- \`npx ${cli} config <name> authorization.enforce_authorization false\` turns enforcement off
+  without losing the rules.
+- The gateway locks single records. Lists are the backend's job: filter every collection GET by
+  \`x-abz-tenant-id\` AND \`x-abz-user-id\`, since a user id is not unique across tenants.`);
+    case "limits":
+      return page("Rate limits and quotas", `
+Every new ${B.thingShort} has a rate limit of 10 requests/s per consumer (100 per 10 s) and a quota
+of 3,000 a day. Say so in those words (rate limit, quota).
+- \`npx ${cli} limits get <name>\` shows them.
+- \`npx ${cli} limits set <name> --rate <n> --quota <n> --period daily\`, plus \`--spend-cap <usd>\` for
+  a monthly spend cap.
+- Rates are per consumer key and approximate per location. A rate above the self-serve ceiling is
+  refused with the exact \`limits request-max\` command to run: relay it, do not retry.
+- It works logged out; an anonymous workspace is capped until claimed.`);
+    case "mcp":
+      return page(`AI agents (MCP) with ${P}`, `
+- Every ${B.thingShort} has an MCP address for AI agents, one per tenant: use the "MCP" line that
+  \`dev\` or \`create\` printed. Its tools are the spec's operations.
+- Agents sign in with the tenant's sign-in (OAuth), or use a person-bound key:
+  \`npx ${cli} apikeys mint --tenant <tenant> --for <email>\`. Never hand an agent a server key: it
+  names no person, so protected routes refuse it.
+- Chat with the API from the terminal: \`npx ${cli} apichat <name>\` (add \`--xenduserid ana\` when calls
+  must name a person). Connect an agent: \`npx ${cli} apichat <name> --install-mcp claude\`.
+
+${sectionOf(legacy, "## No shell? The control-plane MCP")}`);
+    case "widgets":
+      return page(`Keys, users and chat on their site`, sectionOf(legacy, "## Wiring a real site").replace(/^## Wiring a real site\n+/, ""));
+    default:
+      return null;
+  }
+}
+function readByAgent(opts) {
+  if (opts.agent) return true;
+  if (process.env.CLAUDECODE || process.env.APIBLAZE_AGENT) return true;
+  return !(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function ask2(question) {
+  const readline3 = await import("readline");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((res) => rl.question(question, res));
+  rl.close();
+  return !/^n/i.test(answer.trim());
+}
+async function runForPerson(found) {
+  const P = B.product;
+  const run2 = `npx ${B.cli}@latest`;
+  console.log();
+  console.log(`  ${import_chalk25.default.bold(pitchText().split(". ")[0] + ".")}`);
+  console.log(`  ${pitchText().split(". ").slice(1).join(". ")}`);
+  console.log();
+  console.log(import_chalk25.default.dim(`  With an AI assistant? Tell it: "Tell me what ${B.cli} can do for me using ${run2} skills"`));
+  console.log();
+  const report = folderReport(found, { forPerson: true });
+  for (const l of report.lines) console.log(`  ${l.replace(/`/g, "")}`);
+  const port = backendPort(found);
+  if (report.ownApi && found.listening) {
+    const args = ["dev", "--port", String(found.listening), ...found.specFile ? ["--openapi", found.specFile] : []];
+    if (!await ask2(`  ${import_chalk25.default.bold("?")} Put your API on port ${found.listening} behind ${P} now? ${import_chalk25.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk25.default.cyan(`${run2} ${args.join(" ")}`)}`);
+      return;
+    }
+    console.log(import_chalk25.default.dim(`  $ ${run2} ${args.join(" ")}`));
+    const { spawnSync: spawnSync4 } = await import("child_process");
+    const r = spawnSync4(process.execPath, [process.argv[1], ...args], { stdio: "inherit" });
+    process.exitCode = r.status ?? 0;
+    return;
+  }
+  if (report.ownApi) {
+    console.log(`  Start it${found.start ? ` (${found.start})` : ""}, then put it on the internet:`);
+    console.log(`    ${import_chalk25.default.cyan(`${run2} dev --port ${port ?? "<port>"}${found.specFile ? ` --openapi ${found.specFile}` : ""}`)}`);
+    return;
+  }
+  if (!await ask2(`  ${import_chalk25.default.bold("?")} See it on a sample app first? ${import_chalk25.default.dim("(Y/n)")} `)) {
+    console.log(`  Your own app, when it runs: ${import_chalk25.default.cyan(`${run2} dev --port <port>`)}`);
+    return;
+  }
+  const { runDemo: runDemo2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
+  await runDemo2({});
+}
 async function runSkill(opts = {}) {
-  if (!opts.install) {
-    process.stdout.write(opts.ship ? shipMarkdown() : heroMarkdown());
+  if (opts.install) return installSkill(opts);
+  if (opts.static) {
+    process.stdout.write(skillMarkdown());
+    return;
+  }
+  const topic = opts.ship ? "ship" : opts.topic;
+  if (topic) {
+    const md = topicMarkdown(topic);
+    if (!md) {
+      console.error(`Unknown page "${topic}". Pages: ${TOPICS.join(" \xB7 ")}`);
+      process.exit(1);
+    }
+    process.stdout.write(md);
     return;
   }
+  const found = await detectBackend(process.cwd());
+  if (readByAgent(opts)) {
+    process.stdout.write(heroMarkdown(found));
+    return;
+  }
+  await runForPerson(found);
+}
+function installSkill(opts) {
   const md = skillMarkdown();
-  const target2 = import_path3.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
-  if (import_fs4.default.existsSync(target2) && !opts.force) {
-    console.error(import_chalk22.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
+  const target2 = import_path6.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
+  if (import_fs7.default.existsSync(target2) && !opts.force) {
+    console.error(import_chalk25.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
     process.exit(1);
   }
-  import_fs4.default.mkdirSync(import_path3.default.dirname(target2), { recursive: true });
-  import_fs4.default.writeFileSync(target2, md, "utf8");
-  console.log(`${import_chalk22.default.green("\u2713")} Installed the ${import_chalk22.default.bold(SKILL_NAME)} skill: ${import_chalk22.default.bold(target2)}`);
-  console.log(import_chalk22.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli} dev / create for you.`));
+  import_fs7.default.mkdirSync(import_path6.default.dirname(target2), { recursive: true });
+  import_fs7.default.writeFileSync(target2, md, "utf8");
+  console.log(`${import_chalk25.default.green("\u2713")} Installed the ${import_chalk25.default.bold(SKILL_NAME)} skill: ${import_chalk25.default.bold(target2)}`);
+  console.log(import_chalk25.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
 }
 
 // src/commands/integration.ts
-var import_chalk23 = __toESM(require("chalk"));
-var import_ora9 = __toESM(require("ora"));
+var import_chalk26 = __toESM(require("chalk"));
+var import_ora10 = __toESM(require("ora"));
 init_caller();
 init_api();
 init_brand();
 function file(f, indent2 = "     ") {
-  console.log(`   ${import_chalk23.default.cyan(f.file)}`);
+  console.log(`   ${import_chalk26.default.cyan(f.file)}`);
   for (const line of f.code.split("\n")) console.log(`${indent2}${line}`);
   console.log();
 }
 function bullets(lines, indent2 = "   ") {
-  for (const l of lines) console.log(`${indent2}${import_chalk23.default.dim("\u2022")} ${l}`);
+  for (const l of lines) console.log(`${indent2}${import_chalk26.default.dim("\u2022")} ${l}`);
 }
 async function runIntegration(name, opts = {}) {
   const stackRaw = (opts.stack ?? "nextjs").trim().toLowerCase();
@@ -9450,7 +9955,7 @@ async function runIntegration(name, opts = {}) {
   const project = name.trim().toLowerCase();
   const caller = requireCaller();
   if (opts.team && caller.mode === "anon") throw new Error("--team is not available in an anonymous workspace.");
-  const spinner = opts.json ? null : (0, import_ora9.default)(`Rendering the ${stack} kit for ${project}\u2026`).start();
+  const spinner = opts.json ? null : (0, import_ora10.default)(`Rendering the ${stack} kit for ${project}\u2026`).start();
   let kit;
   try {
     kit = await producer(caller, integrationKitCall(project, stack));
@@ -9464,44 +9969,44 @@ async function runIntegration(name, opts = {}) {
     return;
   }
   console.log();
-  console.log(import_chalk23.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
-  console.log(import_chalk23.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
+  console.log(import_chalk26.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
+  console.log(import_chalk26.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
   console.log();
-  console.log(`  ${import_chalk23.default.dim("Proxy:  ")} ${import_chalk23.default.bold(kit.urls.proxy)}`);
-  console.log(`  ${import_chalk23.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk23.default.dim(" \xB7 "))}`);
-  console.log(`  ${import_chalk23.default.dim("Portal: ")} ${kit.urls.portal}`);
-  console.log(`  ${import_chalk23.default.dim("Spec:   ")} ${kit.urls.openapi}`);
+  console.log(`  ${import_chalk26.default.dim("Proxy:  ")} ${import_chalk26.default.bold(kit.urls.proxy)}`);
+  console.log(`  ${import_chalk26.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk26.default.dim(" \xB7 "))}`);
+  console.log(`  ${import_chalk26.default.dim("Portal: ")} ${kit.urls.portal}`);
+  console.log(`  ${import_chalk26.default.dim("Spec:   ")} ${kit.urls.openapi}`);
   const w = kit["1_frontend_widgets"];
   console.log();
-  console.log(import_chalk23.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
-  console.log(import_chalk23.default.dim(`   ${w.note}`));
+  console.log(import_chalk26.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
+  console.log(import_chalk26.default.dim(`   ${w.note}`));
   console.log();
   file(w.frontend);
   for (const r of w.server_routes) file(r);
   const c = kit["2_frontend_server_call_through"];
-  console.log(import_chalk23.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
+  console.log(import_chalk26.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
   console.log();
   file(c);
   const t = kit["3_backend_trust_contract"];
-  console.log(import_chalk23.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
-  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk23.default.cyan(h)} \u2014 ${why}`);
+  console.log(import_chalk26.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
+  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk26.default.cyan(h)} \u2014 ${why}`);
   console.log();
-  console.log(`   ${import_chalk23.default.dim("How to verify:")}`);
+  console.log(`   ${import_chalk26.default.dim("How to verify:")}`);
   bullets(t.how_to_verify);
   console.log();
-  console.log(`   ${import_chalk23.default.dim("Never:")}`);
+  console.log(`   ${import_chalk26.default.dim("Never:")}`);
   bullets(t.what_not_to_do);
   console.log();
-  console.log(import_chalk23.default.bold("4. Env vars (server only)"));
-  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk23.default.cyan(k)}  ${import_chalk23.default.dim("=")}  ${v}`);
+  console.log(import_chalk26.default.bold("4. Env vars (server only)"));
+  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk26.default.cyan(k)}  ${import_chalk26.default.dim("=")}  ${v}`);
   const o = kit["5_what_stays_open"];
   console.log();
-  console.log(import_chalk23.default.bold("5. What stays open"));
-  console.log(`   ${import_chalk23.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk23.default.dim("nothing")}`);
-  console.log(`   ${import_chalk23.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk23.default.dim("nothing")}`);
-  console.log(import_chalk23.default.dim(`   ${o.note}`));
+  console.log(import_chalk26.default.bold("5. What stays open"));
+  console.log(`   ${import_chalk26.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk26.default.dim("nothing")}`);
+  console.log(`   ${import_chalk26.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk26.default.dim("nothing")}`);
+  console.log(import_chalk26.default.dim(`   ${o.note}`));
   console.log();
-  console.log(import_chalk23.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
+  console.log(import_chalk26.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
   console.log();
 }
 
@@ -9509,14 +10014,14 @@ async function runIntegration(name, opts = {}) {
 init_claim();
 
 // src/commands/logout.ts
-var import_chalk24 = __toESM(require("chalk"));
+var import_chalk27 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 async function runLogout(opts = {}) {
   const creds = loadCredentials();
   const consumer2 = loadConsumer();
   if (!creds && !consumer2) {
-    console.log(import_chalk24.default.yellow("You were not logged in."));
+    console.log(import_chalk27.default.yellow("You were not logged in."));
     return;
   }
   let target2;
@@ -9543,18 +10048,18 @@ async function runLogout(opts = {}) {
   }
   if (target2 === "producer" || target2 === "all") {
     clearCredentials();
-    console.log(import_chalk24.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
+    console.log(import_chalk27.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
   }
   if (target2 === "consumer" || target2 === "all") {
     clearConsumer();
-    console.log(import_chalk24.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
+    console.log(import_chalk27.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
   }
 }
 
 // src/commands/flush.ts
 var import_chalk28 = __toESM(require("chalk"));
-var fs13 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
+var fs15 = __toESM(require("fs"));
+var path13 = __toESM(require("path"));
 init_auth();
 init_external_mcp();
 async function runFlush(opts) {
@@ -9562,7 +10067,7 @@ async function runFlush(opts) {
   const demos = await stopDemos2().catch(() => 0);
   if (demos) console.log(import_chalk28.default.dim(`  Stopped ${demos} running demo(s).`));
   const dir = getApiblazeDir();
-  const entries2 = fs13.existsSync(dir) ? fs13.readdirSync(dir) : [];
+  const entries2 = fs15.existsSync(dir) ? fs15.readdirSync(dir) : [];
   if (!entries2.length) {
     console.log(import_chalk28.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
@@ -9575,7 +10080,7 @@ async function runFlush(opts) {
   const footprint = apiblazeMcpFootprint();
   const mdFiles = ["claude", "codex"].map((k) => ({ k, file: agentInstructionFile(k) })).filter(({ file: file2 }) => {
     try {
-      return fs13.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
+      return fs15.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
     } catch {
       return false;
     }
@@ -9584,7 +10089,7 @@ async function runFlush(opts) {
     console.log(import_chalk28.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
   }
   if (mdFiles.length) {
-    console.log(import_chalk28.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path11.basename(m.file)).join(" and ")} (here)`));
+    console.log(import_chalk28.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path13.basename(m.file)).join(" and ")} (here)`));
   }
   console.log(import_chalk28.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
   if (!opts.yes) {
@@ -9600,7 +10105,7 @@ async function runFlush(opts) {
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs13.rmSync(path11.join(dir, e), { recursive: true, force: true });
+      fs15.rmSync(path13.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
       console.log(import_chalk28.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
@@ -9615,14 +10120,14 @@ async function runFlush(opts) {
   for (const { k, file: file2 } of mdFiles) {
     let text = "";
     try {
-      text = fs13.readFileSync(file2, "utf-8");
+      text = fs15.readFileSync(file2, "utf-8");
     } catch {
       continue;
     }
     const names = [...text.matchAll(/<!-- apiblaze:mcp:([^\s>]+) -->/g)].map((m) => m[1]);
     let cleared = 0;
     for (const n of new Set(names)) if (removeAgentInstruction(k, n)) cleared++;
-    if (cleared) console.log(`  ${import_chalk28.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk28.default.bold(path11.basename(file2))}`);
+    if (cleared) console.log(`  ${import_chalk28.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk28.default.bold(path13.basename(file2))}`);
   }
   console.log(`${import_chalk28.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
   console.log(import_chalk28.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
@@ -9941,11 +10446,11 @@ async function runAgentChatRepl(opts) {
     }
   }
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-  const ask2 = (q) => new Promise((res) => rl.question(q, res));
+  const ask3 = (q) => new Promise((res) => rl.question(q, res));
   await turn(seedPrompt);
   for (; ; ) {
     console.log(footer());
-    const line = (await ask2(import_chalk32.default.green("you \u203A "))).trim();
+    const line = (await ask3(import_chalk32.default.green("you \u203A "))).trim();
     if (!line) continue;
     const lower = line.toLowerCase();
     if (line === "/exit" || line === "/quit" || lower === "exit" || lower === "quit" || lower === "q") {
@@ -10323,7 +10828,7 @@ async function runOpenapi(projectArg, apiVersionArg) {
 }
 
 // src/commands/mcp.ts
-var import_fs6 = __toESM(require("fs"));
+var import_fs8 = __toESM(require("fs"));
 var import_chalk37 = __toESM(require("chalk"));
 init_brand();
 init_auth();
@@ -10535,7 +11040,7 @@ async function runMcpPrompts(action2, project, name, opts) {
     if (!opts.file) throw new Error(`Usage: ${B.cli} mcp prompts set <project> <name> --file prompt.json`);
     let raw;
     try {
-      raw = JSON.parse(import_fs6.default.readFileSync(opts.file, "utf8"));
+      raw = JSON.parse(import_fs8.default.readFileSync(opts.file, "utf8"));
     } catch (e) {
       throw new Error(`Could not read ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -10634,7 +11139,7 @@ function describeJob(job) {
 }
 async function pollJob(jobId, opts = {}) {
   const started = Date.now();
-  const path14 = jobPath(jobId, opts.teamId);
+  const path16 = jobPath(jobId, opts.teamId);
   let lastPhase = "";
   if (!opts.quiet) process.stdout.write(import_chalk38.default.dim(opts.label ?? "Deleting"));
   for (; ; ) {
@@ -10646,7 +11151,7 @@ async function pollJob(jobId, opts = {}) {
       );
     }
     await new Promise((r) => setTimeout(r, POLL_MS));
-    const job = await admin({ method: "GET", path: path14, summary: "poll cascade job" });
+    const job = await admin({ method: "GET", path: path16, summary: "poll cascade job" });
     if (!opts.quiet) {
       const phase = describeJob(job);
       if (phase !== lastPhase) {
@@ -10791,7 +11296,7 @@ async function runJobStatus(jobId, opts) {
 
 // src/commands/export.ts
 var import_chalk41 = __toESM(require("chalk"));
-var import_fs7 = require("fs");
+var import_fs9 = require("fs");
 init_admin();
 init_auth();
 init_resolve();
@@ -10840,7 +11345,7 @@ async function runExport(projectArg, versionArg, opts) {
   });
   if (!res.ok) throw new Error(`Download failed (${res.status}): ${await res.text().catch(() => "")}`);
   const buf = Buffer.from(await res.arrayBuffer());
-  (0, import_fs7.writeFileSync)(outFile, buf);
+  (0, import_fs9.writeFileSync)(outFile, buf);
   console.log(import_chalk41.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
   if (job.decryption_key) console.log(import_chalk41.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
   console.log(import_chalk41.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
@@ -10897,8 +11402,8 @@ function resolveRecipeName(raw, githubHandle, proxyName) {
 function normalizeName3(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-async function publicFetch(path14) {
-  const res = await fetch(`${RECIPES_BASE}/api/recipes${path14}`, {
+async function publicFetch(path16) {
+  const res = await fetch(`${RECIPES_BASE}/api/recipes${path16}`, {
     headers: { accept: "application/json" }
   }).catch((err) => {
     throw new Error(`Could not reach the recipe registry at ${RECIPES_BASE} \u2014 ${err.message}`);
@@ -10951,11 +11456,11 @@ async function fetchRecipeFile(ref, caller) {
        Private recipes are visible only to the publisher's team \u2014 run \`apiblaze login\` if you are on it.`
     );
   }
-  const path14 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
+  const path16 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
   try {
     return await producer(caller, {
       method: "GET",
-      path: path14,
+      path: path16,
       summary: `Read private recipe ${ref.name}${revision !== void 0 ? `@${revision}` : ""}`
     });
   } catch (err) {
@@ -12091,9 +12596,9 @@ function printEnvelopeViolations(violations) {
   console.log("bring-your-own-key case. Change the rules above, then publish again.");
   console.log();
 }
-async function askPromotion(path14) {
+async function askPromotion(path16) {
   const { default: inquirer3 } = await import("inquirer");
-  const suggestedId = path14.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
+  const suggestedId = path16.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
   const answers = await inquirer3.prompt([
     { type: "input", name: "prompt", message: "  prompt them with:", validate: (v) => v.trim() ? true : "Required." },
     { type: "input", name: "example", message: "  example:" },
@@ -12104,7 +12609,7 @@ async function askPromotion(path14) {
   const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
   console.log(import_chalk44.default.dim(`      \u2192 replaced with {{${id}}}`));
   return {
-    path: path14,
+    path: path16,
     id,
     prompt: String(answers.prompt).trim(),
     ...answers.example ? { example: String(answers.example).trim() } : {},
@@ -13870,7 +14375,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs15 = __toESM(require("fs"));
+var fs17 = __toESM(require("fs"));
 var import_chalk55 = __toESM(require("chalk"));
 var import_ora25 = __toESM(require("ora"));
 init_admin();
@@ -13893,7 +14398,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs15.readFileSync(opts.file, "utf-8");
+    specContent = fs17.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk55.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -14653,7 +15158,7 @@ async function patchSetting(proj2, s, value, cfg) {
   }
   const body = s.toPatch(value, cfg);
   const method = s.putLimits ? "PUT" : "PATCH";
-  const path14 = s.putLimits ? `/projects/${proj2.projectId}/${proj2.apiVersion}/limits` : `/projects/${proj2.projectId}/${proj2.apiVersion}`;
+  const path16 = s.putLimits ? `/projects/${proj2.projectId}/${proj2.apiVersion}/limits` : `/projects/${proj2.projectId}/${proj2.apiVersion}`;
   if (s.needsTenant) {
     const tenant2 = proj2.tenant ?? cfg.tenant ?? cfg.default_tenant;
     if (!tenant2) throw new Error(`Could not tell which tenant ${proj2.projectName} serves \u2014 pass it via \`apiblaze config ${proj2.projectName} --tenant <slug>\` is not supported yet; run \`apiblaze projects\` and check the project has a tenant.`);
@@ -14663,7 +15168,7 @@ async function patchSetting(proj2, s, value, cfg) {
   try {
     await admin({
       method,
-      path: path14,
+      path: path16,
       body,
       summary: `Set ${s.key} = ${JSON.stringify(value)}`
     });
@@ -15299,11 +15804,11 @@ async function resolveTransport(opts) {
     const token = getAccessToken();
     return {
       tenant: tenant2,
-      call: async (path14, method = "GET", body) => {
+      call: async (path16, method = "GET", body) => {
         const res = await fetch(`${DASHBOARD_BASE9}/api/cli/iam`, {
           method: "POST",
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-          body: JSON.stringify({ tenant: tenant2, path: path14, method, body })
+          body: JSON.stringify({ tenant: tenant2, path: path16, method, body })
         });
         const data = await res.json().catch(() => ({}));
         if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -15321,8 +15826,8 @@ async function resolveTransport(opts) {
     return {
       tenant: fresh.tenant,
       selfEmail: fresh.email,
-      call: async (path14, method = "GET", body) => {
-        const res = await fetch(`${IAM_BASE}${path14}`, {
+      call: async (path16, method = "GET", body) => {
+        const res = await fetch(`${IAM_BASE}${path16}`, {
           method,
           headers: {
             "Content-Type": "application/json",
@@ -15747,28 +16252,28 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk62 = __toESM(require("chalk"));
 var import_ora31 = __toESM(require("ora"));
-var fs16 = __toESM(require("fs"));
-var path12 = __toESM(require("path"));
+var fs18 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs16.existsSync(path12.join(root, f)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs18.existsSync(path14.join(root, f)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs16.readFileSync(path12.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs18.readFileSync(path14.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs16.existsSync(path12.join(root, "app")) || fs16.existsSync(path12.join(root, "src", "app"));
-  const pagesDir = fs16.existsSync(path12.join(root, "pages")) || fs16.existsSync(path12.join(root, "src", "pages"));
+  const appDir = fs18.existsSync(path14.join(root, "app")) || fs18.existsSync(path14.join(root, "src", "app"));
+  const pagesDir = fs18.existsSync(path14.join(root, "pages")) || fs18.existsSync(path14.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
-  const p = path12.join(root, ".env.local");
+  const p = path14.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs16.readFileSync(p, "utf8");
+    existing = fs18.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -15783,15 +16288,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs16.writeFileSync(p, next);
+  fs18.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs16.existsSync(path12.join(root, "node_modules", "apiblaze", "package.json"))) {
+  if (fs18.existsSync(path14.join(root, "node_modules", "apiblaze", "package.json"))) {
     console.log(`  ${import_chalk62.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f) => fs16.existsSync(path12.join(root, f));
+  const has = (f) => fs18.existsSync(path14.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora31.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -15804,7 +16309,7 @@ function installSidecarPackage(root) {
 }
 function readEnvKey(root) {
   try {
-    const s = fs16.readFileSync(path12.join(root, ".env.local"), "utf8");
+    const s = fs18.readFileSync(path14.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -15812,16 +16317,16 @@ function readEnvKey(root) {
   }
 }
 function ensureGitignored(root) {
-  const p = path12.join(root, ".gitignore");
+  const p = path14.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs16.readFileSync(p, "utf8");
+    c = fs18.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs16.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs18.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path12.join("src", "instrumentation.ts")].map((c) => path12.join(root, c)).find((f) => fs16.existsSync(f));
+  const existing = ["instrumentation.ts", "instrumentation.js", path14.join("src", "instrumentation.ts")].map((c) => path14.join(root, c)).find((f) => fs18.existsSync(f));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -15829,18 +16334,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs16.writeFileSync(path12.join(root, "instrumentation.ts"), body);
+    fs18.writeFileSync(path14.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs16.readFileSync(existing, "utf8");
+  const cur = fs18.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs16.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs18.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs16.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs18.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -15923,17 +16428,17 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs16.existsSync(path12.join(root, "src", "pages")) ? path12.join(root, "src", "pages") : path12.join(root, "pages");
-      const f2 = path12.join(dir2, "abz-inspector.tsx");
-      fs16.writeFileSync(f2, INSPECTOR_PAGE);
-      return path12.relative(root, f2);
-    }
-    const base2 = fs16.existsSync(path12.join(root, "src", "app")) ? path12.join(root, "src", "app") : path12.join(root, "app");
-    const dir = path12.join(base2, "abz-inspector");
-    fs16.mkdirSync(dir, { recursive: true });
-    const f = path12.join(dir, "page.tsx");
-    fs16.writeFileSync(f, INSPECTOR_PAGE);
-    return path12.relative(root, f);
+      const dir2 = fs18.existsSync(path14.join(root, "src", "pages")) ? path14.join(root, "src", "pages") : path14.join(root, "pages");
+      const f2 = path14.join(dir2, "abz-inspector.tsx");
+      fs18.writeFileSync(f2, INSPECTOR_PAGE);
+      return path14.relative(root, f2);
+    }
+    const base2 = fs18.existsSync(path14.join(root, "src", "app")) ? path14.join(root, "src", "app") : path14.join(root, "app");
+    const dir = path14.join(base2, "abz-inspector");
+    fs18.mkdirSync(dir, { recursive: true });
+    const f = path14.join(dir, "page.tsx");
+    fs18.writeFileSync(f, INSPECTOR_PAGE);
+    return path14.relative(root, f);
   } catch {
     return null;
   }
@@ -15973,7 +16478,7 @@ async function runAnonymousInit(root, router, opts) {
   console.log(import_chalk62.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
-  const root = path12.resolve(opts.dir ?? process.cwd());
+  const root = path14.resolve(opts.dir ?? process.cwd());
   const detected2 = detectNextProject(root);
   if (!detected2.found) {
     console.log(import_chalk62.default.yellow(`No Next.js project detected in ${root}.`));
@@ -16032,7 +16537,7 @@ async function runSidecar(opts) {
   console.log(`  2. The origins your app calls appear as ${import_chalk62.default.bold("candidates")} \u2014 list them:  ${import_chalk62.default.cyan("apiblaze sidecar")}`);
   console.log(`  3. Approve the ones to route:  ${import_chalk62.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk62.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path12.dirname(inspectorPath)} before shipping)`);
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk62.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path14.dirname(inspectorPath)} before shipping)`);
   if (switchingTeam) console.log(import_chalk62.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
   console.log(import_chalk62.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
@@ -16768,17 +17273,17 @@ var import_chalk68 = __toESM(require("chalk"));
 init_consumer_auth();
 var SANDBOX_TENANT = "portalteststenant";
 var SANDBOX_PROXY = "portaltestproxypreapproved@2.7.0";
-function proxyUrlFor(spec2, path14 = "/get") {
+function proxyUrlFor(spec2, path16 = "/get") {
   const [name, version2 = "1.0.0"] = spec2.split("@");
-  return `https://${name}.abz.run/${version2}/prod${path14.startsWith("/") ? path14 : `/${path14}`}`;
+  return `https://${name}.abz.run/${version2}/prod${path16.startsWith("/") ? path16 : `/${path16}`}`;
 }
 function isPortalAudience(aud) {
   return /^https:\/\/[a-z0-9-]+\.portal\.apiblaze\.com\b/i.test(aud);
 }
 var log2 = (s) => process.stderr.write(s + "\n");
-function probeUrlFor(audience, path14 = "/") {
+function probeUrlFor(audience, path16 = "/") {
   const base2 = audience.replace(/\/+$/, "");
-  return `${base2}/prod${path14.startsWith("/") ? path14 : `/${path14}`}`;
+  return `${base2}/prod${path16.startsWith("/") ? path16 : `/${path16}`}`;
 }
 function tamper(token) {
   const parts = token.split(".");
@@ -17723,7 +18228,7 @@ program.command("demo").description(`See what ${B.product} does in a minute: a s
   }
   await runDemo(opts);
 });
-program.command("skill").alias("skills").description(`Print or install the Claude Code skill that teaches Claude to ship your API safely with ${B.product}`).option("--install", "Write it to .claude/skills/ship-safely/SKILL.md in the current project (instead of printing it)").option("--force", "Overwrite an existing SKILL.md").option("--ship", "Print the steps for putting it in front of your own app").action(action((opts) => runSkill(opts)));
+program.command("skill").alias("skills").description(`What ${B.product} does, for you or your AI assistant: checks this folder for a backend and offers the next step (put it on the internet, or a sample app)`).argument("[page]", "One page instead: ship \xB7 keys \xB7 signin \xB7 rules \xB7 limits \xB7 mcp \xB7 widgets").option("--agent", "Print what an AI assistant reads, even at a terminal").option("--static", "Print the installed text, with no folder check (for generated docs)").option("--install", "Write it to .claude/skills/ship-safely/SKILL.md in the current project (instead of printing it)").option("--force", "Overwrite an existing SKILL.md").option("--ship", "Same as the ship page: the steps for putting it in front of your own app").action(action((page, opts) => runSkill({ ...opts, topic: page })));
 var agent = program.command("agent").description("Chat with an assistant that builds and runs your APIs (billed per turn)").option("--team <id|name>", "Team to work in (defaults to your active team)").action(action((opts) => runAgent(opts)));
 agent.command("authz").description("Chat to design and turn on access rules for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runAuthz(project, apiVersion)));
 program.command("rule").description("Lock resources to the person who created them \u2014 or describe any access rule in plain English (that one is billed per turn)").argument("<project>", "Project name or id").argument("[sentence]", 'Optional rule in plain English, e.g. "users see only their own rows". Omit to pick from what the spec can protect.').option("--enforce", "Turn enforcement on right after saving (default: save in shadow mode, then ask)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((project, sentence, opts) => runRule(project, sentence, opts)));
@@ -17742,7 +18247,7 @@ mcpCommon(mcpOps.command("set").description("Override one tool").argument("<proj
 mcpCommon(mcpOps.command("reset").description("Back to the automatic default for one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpOps("reset", project, tool, opts)));
 mcpCommon(mcpCmd.command("ui").description("Print a tool's MCP Apps UI resource (ui://{project}/{tool}) \u2014 the automatic viewer").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpUi(project, tool, opts)));
 program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {
-  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs9.default.existsSync(project));
+  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs11.default.existsSync(project));
   const target2 = opts.target ?? (looksLikeSource ? project : void 0);
   return runApichat({ ...opts, target: target2, project: looksLikeSource ? void 0 : project, openapispec: opts.openapispec ?? opts.openapi });
 }));