apiblaze 0.21.43 → 0.21.45

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.43";
+    version = "0.21.45";
   }
 });
 
@@ -2139,6 +2139,17 @@ function fail(message) {
   console.error(import_chalk11.default.red(`Error: ${message}`));
   process.exit(1);
 }
+function claimRefusalMessage(code, status2, team, claimCode) {
+  if (code === "merge_not_supported_with_iam") {
+    return `This workspace has people, groups or admins, so it can't be merged into ${team ? `"${team}"` : "an existing team"} yet.
+  Claim it as a new team instead: ${B.cli} claim ${claimCode}`;
+  }
+  if (status2 === 403 && code === "forbidden" && team) {
+    return `Merging into "${team}" needs the admin role on that team.
+  Claim it as a new team instead: ${B.cli} claim ${claimCode}`;
+  }
+  return null;
+}
 async function runClaim(claimCodeArg, opts) {
   const creds = loadCredentials();
   if (!creds) fail("Not logged in. Run `apiblaze login` first, then claim.");
@@ -2170,6 +2181,8 @@ async function runClaim(claimCodeArg, opts) {
   } catch (err) {
     if (err instanceof ApiError) {
       const c = typeof err.body === "object" && err.body ? err.body.error : void 0;
+      const refusal = claimRefusalMessage(c, err.status, opts.team, claimCode);
+      if (refusal) fail(refusal);
       if (c === "already_claimed" || c === "not_claimable") {
         if (fromLocal) clearAnonCred();
         console.log(import_chalk11.default.yellow("\nThis workspace was already claimed (e.g. on dashboard.apiblaze.com)."));
@@ -2212,6 +2225,7 @@ var init_claim = __esm({
     init_anon_cred();
     init_api();
     init_types();
+    init_brand();
   }
 });
 
@@ -6476,6 +6490,71 @@ var init_create = __esm({
   }
 });
 
+// src/server/core.ts
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    if (typeof b.error === "string") return b.error;
+    if (b.error?.message) return b.error.message;
+    if (b.detail || b.title) return [b.title, b.detail].filter(Boolean).join(". ").replace(/\.\. /, ". ");
+    return `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function createPlaneCore(cfg) {
+  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
+  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
+  const tenantCache = /* @__PURE__ */ new Map();
+  const endUserCache = /* @__PURE__ */ new Map();
+  function planeFetch(base2, method, path16, user, opts = {}) {
+    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
+    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
+    let body;
+    if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    return fetch(`${base2}${path16}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+  }
+  async function resolveTenant2(user) {
+    const cached = tenantCache.get(user.tenant);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { tenant: tenant2 } = await res.json();
+    tenantCache.set(user.tenant, tenant2);
+    return tenant2;
+  }
+  async function ensureEndUser(user, tenant2) {
+    const cacheKey = `${tenant2}:${user.userId}`;
+    const cached = endUserCache.get(cacheKey);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
+      body: { tenant: tenant2, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
+    });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { abz_sub } = await res.json();
+    endUserCache.set(cacheKey, abz_sub);
+    return abz_sub;
+  }
+  return { planeFetch, resolveTenant: resolveTenant2, ensureEndUser, apikeysBase, iamBase };
+}
+var PlaneError;
+var init_core = __esm({
+  "src/server/core.ts"() {
+    "use strict";
+    PlaneError = class extends Error {
+      constructor(status2, detail) {
+        super(detail);
+        this.status = status2;
+        this.detail = detail;
+      }
+    };
+  }
+});
+
 // src/demo-app/files.ts
 var DEMO_FILES;
 var init_files = __esm({
@@ -6577,7 +6656,7 @@ components:
           properties:
             id: { type: string, example: r1 }
 `,
-      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const who = req.headers['x-abz-user-id'] || '';\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The people the demo provisioned up front, per pizzeria: { tenant: { handle: stable id } }.\n// Through APIblaze every call already names the stable id (x-abz-user-id); a call straight\n// to this port still says \"ana\", and must mean the same person.\nconst USER_IDS = (() => { try { return JSON.parse(process.env.DEMO_USER_IDS || '{}'); } catch { return {}; } })();\nconst idOf = (tenant, handle) => (USER_IDS[tenant] || {})[handle] || handle;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const who = idOf(tenant, req.headers['x-abz-user-id'] || '');\n  // Shown in the ticker and the terminal: the name the caller gave (APIblaze forwards it as\n  // x-end-user-id next to the stable id), never the opaque id.\n  const shown = req.headers['x-end-user-id'] || req.headers['x-abz-user-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who: shown, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
       "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
       "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
       "public/index.html": `<!doctype html>
@@ -7699,6 +7778,7 @@ __export(demo_exports, {
   DEMO_RPS: () => DEMO_RPS,
   demoName: () => demoName,
   isDemoProcess: () => isDemoProcess,
+  personaPlan: () => personaPlan,
   portFree: () => portFree,
   routesOf: () => routesOf,
   runDemo: () => runDemo,
@@ -7708,6 +7788,19 @@ __export(demo_exports, {
   stopDemos: () => stopDemos,
   stopTunnels: () => stopTunnels
 });
+function personaPlan(ninoTenant, ginoTenant) {
+  const nino = [
+    { tenant: ninoTenant, userId: "ana", label: "Ana", email: DEMO_ADMIN_EMAIL },
+    { tenant: ninoTenant, userId: "ben", label: "Ben" }
+  ];
+  if (!ginoTenant) return nino;
+  return [
+    ...nino,
+    { tenant: ginoTenant, userId: "gina", label: "Gina", email: DEMO_GINO_ADMIN_EMAIL },
+    { tenant: ginoTenant, userId: "ana", label: "Ana" },
+    { tenant: ginoTenant, userId: "ben", label: "Ben" }
+  ];
+}
 function demoName() {
   return `demo${pick2(ADJ)}${pick2(NOUN)}${import_crypto.default.randomBytes(2).toString("hex")}`;
 }
@@ -8169,9 +8262,19 @@ paths:`));
       })()
     ]);
     if (!secretOk) throw new DemoError(`Could not give ${B.product} the backend secret.`, `Run again: ${LATEST} demo`, "secret-failed");
-    return { cpKey: cpKey2, teamId: teamId2, serverKey: serverKey2, project: project2, version: version3, tenant: tenant3, gino: gino2, createSecs: createSecs2, adminOk: adminOk2, ginaOk: ginaOk2, limited: limited2, claimCode: rr.claim_code, applied: rr.secure?.applied ?? [] };
+    const userIds2 = {};
+    const plane = createPlaneCore({ cpKey: cpKey2 });
+    await Promise.all(personaPlan(tenant3, gino2?.tenant).map(async (p) => {
+      try {
+        const id = await plane.ensureEndUser({ tenant: p.tenant, userId: p.userId, label: p.label, email: p.email }, p.tenant);
+        if (id) (userIds2[p.tenant] ??= {})[p.userId] = id;
+      } catch {
+      }
+    }));
+    return { cpKey: cpKey2, teamId: teamId2, serverKey: serverKey2, project: project2, version: version3, tenant: tenant3, gino: gino2, createSecs: createSecs2, adminOk: adminOk2, ginaOk: ginaOk2, limited: limited2, userIds: userIds2, claimCode: rr.claim_code, applied: rr.secure?.applied ?? [] };
   });
-  const { cpKey, teamId, serverKey, project, version: version2, tenant: tenant2, gino, createSecs, adminOk, ginaOk, limited } = setup;
+  const { cpKey, teamId, serverKey, project, version: version2, tenant: tenant2, gino, createSecs, adminOk, ginaOk, limited, userIds } = setup;
+  const peopleOk = Object.values(userIds).reduce((n, m) => n + Object.keys(m).length, 0);
   const apiUrl = restUrl(project, version2, "dev", { anon: true });
   const agents = mcpUrl(project, version2, "dev", { tenant: tenant2, anon: true });
   const applied = setup.applied.map((k) => k.replace(/^\//, "").split("/")[0]);
@@ -8191,7 +8294,9 @@ paths:`));
     DEMO_NINO_TENANT: ninoTenant,
     APP_PORT: appPort,
     BACKEND_PORT: backendPort2,
-    DIRECT_PORT: directPort
+    DIRECT_PORT: directPort,
+    // { tenant: { handle: stable id } }: the backend maps the handles of calls that skip the gateway.
+    DEMO_USER_IDS: JSON.stringify(userIds)
   });
   const state = { name: project, version: version2, tenant: tenant2, teamId, cpKey, appPort, backendPort: backendPort2, apiUrl, claimCode: setup.claimCode };
   saveState(dir, state);
@@ -8209,6 +8314,7 @@ paths:`));
       what: ginaOk ? "Ana runs Nino Pizza, Gina runs Gino Pizza" : "Ana runs Nino Pizza",
       cmds: [L(`admins add ${DEMO_ADMIN_EMAIL} --tenant ${tenant2}`), ...ginaOk && gino?.tenant ? [L(`admins add ${DEMO_GINO_ADMIN_EMAIL} --tenant ${gino.tenant}`)] : []]
     }] : [],
+    ...peopleOk ? [{ label: "People", what: `${peopleOk} people provisioned up front (Ana, Ben, Gina), so their ids never change`, cmds: ["(the keys & users widgets' own call: npm i apiblaze \u2192 ensureEndUser)"] }] : [],
     ...applied.length ? [{ label: "Rules", what: "only who made a reservation can change it", cmds: [L(`rule ${project} "${RULE_SENTENCE}"`)] }] : [],
     { label: "AI (MCP Tools)", what: `${tools.length} tools, one per route`, cmds: ["(part of create, above)"] },
     ...limited ? [{ label: "Limits", what: `${DEMO_RPS} calls a second per customer`, cmds: [L(`limits set ${project} --rate ${DEMO_RPS} --end-user-rate ${DEMO_RPS}`)] }] : [],
@@ -8385,6 +8491,7 @@ var init_demo = __esm({
     init_auth();
     init_anon_cred();
     init_brand();
+    init_core();
     init_create();
     init_files();
     DIR_NAME = `${B.cli}-demo`;
@@ -8765,6 +8872,72 @@ async function journey(label3, work, home, checks) {
   }
   return env;
 }
+async function claimJourney(work, checks, env) {
+  const add = (id, ok, detail2) => checks.push({ id: `claim:${id}`, ok, detail: detail2 });
+  let code = "";
+  let teamId = "";
+  try {
+    const st = JSON.parse(import_fs10.default.readFileSync(import_path7.default.join(work, `${B.cli}-demo`, ".demo", "state.json"), "utf8"));
+    code = st.claimCode ?? "";
+    teamId = st.teamId ?? "";
+  } catch {
+  }
+  if (!code || !teamId || !env) {
+    add("code", false, "no claim code in the demo state");
+    return;
+  }
+  const fail7 = (e) => ({ status: e instanceof ApiError ? e.status : 0, error: e instanceof ApiError ? String(e.body?.error ?? "") : String(e.message) });
+  const api = env.APIBLAZE_URL;
+  const key = env.APIBLAZE_SERVER_KEY;
+  const ana = { "x-api-key": key, "x-end-user-id": "ana", "content-type": "application/json" };
+  const before = await http(`${api}/reservations`, { method: "POST", headers: ana, body: JSON.stringify({ time: "21:00" }) });
+  const bookedId = before.status === 201 && before.body?.id ? String(before.body.id) : null;
+  const seenBefore = await http(`${api}/reservations`, { headers: ana });
+  const ownersBefore = new Map((Array.isArray(seenBefore.body) ? seenBefore.body : []).map((r) => [String(r.id), String(r.owner)]));
+  let refused = { status: 200, error: "MERGED" };
+  try {
+    await claimTeam(code, SANDBOX_TEAM);
+  } catch (e) {
+    refused = fail7(e);
+  }
+  add("merge-refused", refused.status === 409 && refused.error === "merge_not_supported_with_iam", `HTTP ${refused.status} ${refused.error}`);
+  let res = {};
+  let err = { status: 0, error: "" };
+  try {
+    res = await claimTeam(code);
+  } catch (e) {
+    err = fail7(e);
+  }
+  add("promote", res.claimed === true && !res.merged && res.team_id === teamId, res.claimed ? `team ${res.team_id}` : `HTTP ${err.status} ${err.error}`);
+  const list = await http(`${api}/reservations`, { headers: ana });
+  const after = new Map((Array.isArray(list.body) ? list.body : []).map((r) => [String(r.id), String(r.owner)]));
+  const missing = [...ownersBefore.keys()].filter((id) => !after.has(id));
+  const changed = [...ownersBefore].filter(([id, owner]) => after.has(id) && after.get(id) !== owner).map(([id]) => id);
+  add(
+    "identity-continuity",
+    list.status === 200 && !!bookedId && ownersBefore.has(bookedId) && missing.length === 0 && changed.length === 0,
+    `${ownersBefore.size} booking(s) before (incl. ${bookedId ?? "-"}) \xB7 list ${list.status} after \xB7 ${missing.length ? `MISSING ${missing.join(",")}` : "all still hers"}${changed.length ? ` \xB7 OWNER ID CHANGED ${changed.join(",")}` : ""}`
+  );
+  let gone = false;
+  let detail = "";
+  if (res.claimed) {
+    try {
+      await admin({ method: "DELETE", path: `/teams/${encodeURIComponent(teamId)}`, summary: "delete the promoted demo team" });
+      for (let i = 0; i < 180 && !gone; i++) {
+        try {
+          await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}` });
+        } catch (e) {
+          if (e instanceof ApiError && (e.status === 404 || e.status === 403)) gone = true;
+        }
+        if (!gone) await new Promise((r) => setTimeout(r, 1e3));
+      }
+      detail = gone ? "cascade done" : "still present after 180 s";
+    } catch (e) {
+      detail = `delete \u2192 ${fail7(e).status} ${fail7(e).error}`;
+    }
+  } else detail = "nothing to delete (claim failed)";
+  add("cleanup", gone, detail);
+}
 async function runOpAnon(o = {}) {
   const t0 = Date.now();
   const root = import_fs10.default.mkdtempSync(import_path7.default.join(import_os3.default.tmpdir(), `${B.cli}-op-anon-`));
@@ -8779,7 +8952,8 @@ async function runOpAnon(o = {}) {
   log4(import_chalk70.default.bold(`${B.cli} op anon \u2014 a first-time visitor's demo, against production`));
   try {
     await journey("first", work, home, checks);
-    await journey("rerun", work, home, checks);
+    const env = await journey("rerun", work, home, checks);
+    await claimJourney(work, checks, env);
   } finally {
     const stop = await runCli(["demo", "stop"], work, home, 3e4);
     const demoFolder = import_path7.default.join(work, `${B.cli}-demo`);
@@ -8809,7 +8983,7 @@ async function runOpAnon(o = {}) {
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
 }
-var import_fs10, import_os3, import_path7, import_child_process6, import_chalk70, SECRET;
+var import_fs10, import_os3, import_path7, import_child_process6, import_chalk70, SECRET, SANDBOX_TEAM;
 var init_op_anon = __esm({
   "src/commands/op-anon.ts"() {
     "use strict";
@@ -8819,7 +8993,11 @@ var init_op_anon = __esm({
     import_child_process6 = require("child_process");
     import_chalk70 = __toESM(require("chalk"));
     init_brand();
+    init_api();
+    init_admin();
+    init_types();
     SECRET = /\bsk_(?:dev|test|prod)_[A-Za-z0-9]{6,}/;
+    SANDBOX_TEAM = "team_1782844865835_zujrf";
   }
 });
 
@@ -8930,13 +9108,26 @@ async function defaultName(openapi, teamId) {
   }
   return randomProxyName();
 }
+function saltedName(name) {
+  return `${name}${Math.random().toString(36).slice(2, 6)}`;
+}
 async function chooseName(opts, openapi, teamId, interactive2) {
   if (opts.name !== void 0) {
     const name = normalizeName2(opts.name);
     if (name.length < 3) throw new Error(`${cap(B.thingShort)} name must be at least 3 characters (letters and digits only).`);
     const check = await checkProxyName(name, teamId).catch(() => null);
     if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
-      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
+      if (opts.auto || !interactive2) {
+        for (let attempt = 0; attempt < 4; attempt++) {
+          const candidate = saltedName(name);
+          const again = await checkProxyName(candidate, teamId).catch(() => null);
+          if (!again || again.canUseProjectName && again.canUseApiVersion) {
+            console.log(import_chalk20.default.dim(`  "${name}" is taken (names are global) \u2014 using "${candidate}" instead.`));
+            return candidate;
+          }
+        }
+      }
+      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Omit --name and a free one is chosen for you.`);
     }
     return name;
   }
@@ -9794,10 +9985,12 @@ their own app).
 }
 function shipMarkdown() {
   const legacy = legacySkillMarkdown();
-  const at = legacy.indexOf("## Adopt");
   const backendRules = `## What their backend does \u2014 and nothing else
 
 The gateway does sign-in, keys, tenancy and single-record ownership. The backend does only:
+- provision each person before their first call (what the Users widget's \`ensureEndUser\` does): an
+  unprovisioned caller arrives as the raw id the app asserted, a provisioned one as their stable id, and
+  a row stamped with the former is not found by the latter;
 - stamp each new row's \`tenant\` with the \`x-abz-tenant-id\` header and its \`owner\` with the
   \`x-abz-user-id\` header;
 - filter every collection GET to rows whose \`tenant\` AND \`owner\` match those headers. Both,
@@ -9812,7 +10005,7 @@ No code yet? Write the smallest plain backend that does exactly that, plus its \
   return withLatest(`# Put ${B.product} in front of their app
 
 ${backendRules}${blockedMarkdown()}
-${at >= 0 ? legacy.slice(at) : legacy}`);
+${legacy}`);
 }
 function skillMarkdown() {
   return `${heroMarkdown()}
@@ -9822,121 +10015,7 @@ function legacySkillMarkdown() {
   const P = B.product;
   const cli = B.cli;
   const LIB = "apiblaze";
-  const other = BRAND === "mcpblaze" ? "APIblaze" : "MCPblaze";
-  const doors = BRAND === "mcpblaze" ? `${P} ships your code to agents (an MCP server); ${other} ships the same code to users (API keys + sign-in).` : `${P} ships your code to users (API keys + sign-in); ${other} ships the same code to agents (an MCP server).`;
-  return `---
-name: ${SKILL_NAME}
-description: Use when the user asks what ${P} (or ${cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share, expose or make an API public; says "serve my backend behind a proxy and MCP"; wants auth, API keys, sign-in, multi-tenant registration, users and groups, rate limits (throttling), quotas or spend caps; wants agents to use the API through an MCP; or says users can reach each other's records or admin functions. Puts the ${P} gateway in front of the API instead of hand-rolling auth and tenancy in the backend.
----
-
-# Ship safely with ${P}
-
-One gateway, two doors. ${doors}
-Same rules, one command. Nothing about auth, tenancy or ownership goes into the backend's
-business logic: the gateway sits in front of the code and enforces it.
-
-## Which mode \u2014 decide this first
-
-- They ask what ${P} does or can do \u2192 **Explain**. Glance at the workspace first (see
-  Explain), answer, then offer either the demo or their own app. Run no \`npx ${cli}\`
-  command \u2014 the whole answer is in this file.
-- They say yes to the demo, or ask to see / try / demo it \u2192 **Demo app**. It lives in its own
-  folder and never touches their code.
-- They say yes to "can I read the code" \u2192 **Adopt**: scan their app, ask only what the scan
-  could not find, then ship it through the Ship steps.
-- They have a backend, just wrote one, or ask you to BUILD one and then ship it \u2192 **Ship**.
-  No code yet? First write the smallest plain backend that serves the resources they named,
-  plus its \`openapi.yaml\`, start it on their port, then continue at Ship \xA71. Do NOT build
-  the Demo app for this. The gateway does auth, tenancy and item ownership; the backend does
-  only these three things:
-  - stamp each new row's \`tenant\` with the \`x-abz-tenant-id\` header and its \`owner\` with
-    the \`x-abz-user-id\` header;
-  - filter every collection GET to rows whose \`tenant\` AND \`owner\` match those headers (the
-    gateway's rules lock single records, never lists \u2014 a list route has no one record to
-    check). Both, always: a user id is not unique across tenants ("ana" at one customer and
-    "ana" at another are two people);
-  - answer 401 to any call whose \`x-target-api-key\` is not \`process.env.TARGET_SERVER_SECRET\`
-    (generate it with \`openssl rand -hex 24\`, put it in \`.env.local\`, start the backend with
-    it; Ship \xA73b makes the proxy send it). If they say "use
-  ${cli} on this" or "ship it with ${cli}" and point at a backend, skip any pitch and run it.
-
-Tie-breaks: a question ("what can it do", "what is it") is always **Explain**, whatever else the
-message names. Mentioning \`npx ${cli} skills\` is NOT a request to run anything \u2014 it is the
-command that installed this file. If a message fits two modes, the earliest bullet wins.
-
-## Explain
-
-Say this, in these words or close to them, then stop:
-
-"${P} puts a gateway in front of your backend in one command: a proxy (every request passes
-through it first) and an MCP server (the same API, callable by AI agents like Claude). No auth
-or ownership logic goes into your code \u2014 your backend only has to trust one header. Each of
-your customers \u2014 a tenant \u2014 gets their own API key, created from a widget you drop into your
-site. People and agents sign in with hosted GitHub, or your own OAuth app. Each user can only
-touch the records they created; those rules come from your OpenAPI spec (the file listing your
-endpoints), and if you have none I draft one from your routes and show it to you first. One
-more command sets a rate limit, a daily quota and a spend cap. In dev it tunnels to localhost;
-in prod it points at your deploy."
-
-Before answering, look at the workspace \u2014 file names and \`package.json\` only, no reading of
-code yet. It "has an app" if ANY of these is present: an \`openapi.*\` / \`swagger.*\` file; a
-server framework (express, fastify, hono, koa, nest, fastapi, flask, django, rails, gin, chi,
-net/http); or a frontend (next, react, vue, svelte, remix, nuxt) whose \`.env*\` file NAMES an
-API base-URL variable (\`API_URL\`, \`NEXT_PUBLIC_API_URL\`, \`VITE_API_URL\`, or similar) \u2014
-\`grep -l\` the env files, open nothing else. Then end with exactly one of these two lines:
-
-- No app \u2192 **"Would you like me to spin up a demo app?"**
-- An app \u2192 **"I see you have an app already coded. Can I read the code to see how to ready it
-  for human and agent traffic with ${P}?"**
-
-## Demo app \u2014 the same reservation system, before and after
-
-One Next.js app on port 3000. Two routes, same UI, same data: \`/before\` is how most apps
-ship; \`/\` is the same thing behind ${P}. Narrate each step in one line and show every
-\`npx ${cli}\` command \u2014 the commands are the product. Everything goes in \`${cli}-demo/\`.
-
-1. **Scaffold.** \`npx create-next-app@latest ${cli}-demo\` (TypeScript, App Router). Then
-   \`npm i hono ${LIB}\`.
-2. **The backend.** Hono mounted at \`app/api/[[...route]]/route.ts\` (\`import { handle } from
-   'hono/vercel'\`). Three resources \u2014 restaurants, tables, reservations \u2014 in an in-memory Map,
-   every row stamped with \`owner\` = the \`x-abz-user-id\` header (${P} sets it on every call it
-   forwards). Every route requires \`X-Api-Secret: demo-secret\` OR an \`x-abz-user-id\` header \u2014
-   the first is how /before gets in, the second is how the gateway gets in. Write
-   \`openapi.yaml\` at the repo root: every path and method, and the \`id\` each POST returns \u2014
-   the ownership rules are read from it.
-3. **/before.** \`app/before/page.tsx\`: list and create reservations through one server route,
-   \`app/before/api/route.ts\`, which holds \`demo-secret\` and calls \`/api/...\` directly. Put the
-   caption on the page: "Before \u2014 one shared secret, anyone holding it can do anything."
-4. **Put ${P} in front.** In the BACKGROUND, and leave it running \u2014 it is the tunnel:
-   \`npx ${cli} dev --port 3000 --openapi ./openapi.yaml --name demo --auto\`
-   It prints the API URL, the MCP URL, the tenant, and the bootstrap key ONCE. Write them to
-   \`.env.local\` as \`APIBLAZE_URL\`, \`APIBLAZE_SERVER_KEY\`, \`APIBLAZE_TENANT\`. \`--auto\` locks
-   all three resources to their creator \u2014 say so.
-5. **Users and groups.** Turn them on and make the group the demo is about:
-   \`npx ${cli} iam demo on\`
-   \`npx ${cli} group create reservationists --tenant <tenant>\`
-   \`npx ${cli} group add-user <the demo user> reservationists --tenant <tenant>\`
-   \`npx ${cli} admins add <the user's email> --tenant <tenant>\` (so the widget has an admin).
-   Optional, billed per turn: \`npx ${cli} rule demo "only members of reservationists can create
-   or change reservations"\`. If the user is logged out or their wallet has nothing available
-   (\`npx ${cli} billing balance\`), keep the free creator-lock rules and say so \u2014 do not pretend
-   the group rule applied.
-6. **/.** \`app/page.tsx\`: the same UI, plus a **user picker** (ana \xB7 ben \xB7 admin \u2014 a select, no
-   real login; the demo is about authorization, not building sign-in). Its server route calls
-   \`process.env.APIBLAZE_URL\` with \`X-API-Key: APIBLAZE_SERVER_KEY\` and \`X-End-User-Id: <the
-   picked user>\`. Add the three widgets from \`${LIB}/react\`, each with its server route:
-   - \`<ApiKeyWidget />\` + \`app/api/apiblaze/keys/route.ts\` (\`createApiblazeKeys\` from \`${LIB}/server\`)
-   - \`<UsersGroupsWidget />\` + \`app/api/apiblaze/groups/route.ts\` (\`createApiblazeGroups\` \u2014
-     the keys route with one word changed)
-   - \`<ChatWidget />\` + \`app/api/apiblaze/chat/route.ts\` (\`createApiblazeChat\`)
-   Exact snippets for the keys and chat pair: \`npx ${cli} integration demo --stack nextjs\`.
-   Caption: "After \u2014 a key per tenant, every call names its user, and ${P} decides."
-7. **Prove it, in the browser.** \`npm run dev\`, open \`http://localhost:3000/before\` then
-   \`http://localhost:3000/\`. On \`/\`: create a reservation as ana, switch to ben, try to cancel
-   it \u2014 show the 403 in the UI. Open the groups widget: reservationists is there. Ask the chat
-   widget to list reservations. Then say what each \`npx ${cli}\` command did, in order.
-
-## Adopt \u2014 reading their code first
+  return `## Adopt \u2014 reading their code first
 
 They said yes. Scan properly now (routes, env files, auth, network calls), classify, then ask
 ONLY for what the scan could not find \u2014 one short list of questions, not an interview.
@@ -9997,12 +10076,14 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    the report. Only ask "where do your users sign in today?" when they mention an existing
    login. Their own OAuth app \u2192 \`--apikey --oauth '{"provider":"auth0","clientId":"\u2026","clientSecret":"\u2026"}'\`
    (both doors: keys for tenants, their login for people and agents). Shapes below.
-3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --name <name> --auto <door flags>\`,
+3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --auto <door flags>\`,
    left running \u2014 it is the tunnel. Start it as its own detached process, never \`cmd &\` inside
    a shell call that ends: \`nohup npx ${cli} dev \u2026 > ${cli}-dev.log 2>&1 < /dev/null &\`, then
-   read the log. If it stops, re-run the SAME command: the same \`--name\` reattaches and
-   creates nothing. Never pick a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
-   \`npx ${cli} create --target <url-or-spec> --name <name> --auto <door flags>\`. Both print the
+   read the log. Leave \`--name\` out: names are global, so a free one is chosen and printed
+   (\`--name\` only for a name the user asked for; a taken one is salted). If the tunnel stops,
+   run the \`--project <name>\` line it printed: that reattaches and creates nothing. Never start
+   a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
+   \`npx ${cli} create --target <url-or-spec> --auto <door flags>\`. Both print the
    URL, the MCP URL (the "agents:" line) and what is locked. Run by you (no terminal), \`dev\`
    saves the bootstrap key to \`.env.local\` as \`APIBLAZE_SERVER_KEY\` and never prints it;
    \`create\` prints it ONCE \u2014 save it there yourself. Either way say only "saved your key to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.43",
+  "version": "0.21.45",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",