apiblaze 0.21.44 → 0.21.46

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.44";
+    version = "0.21.46";
   }
 });
 
@@ -2996,12 +2996,12 @@ function openBrowser2(url) {
   } catch {
   }
 }
-async function deviceLogin(clientId, scope, onPrompt, resource) {
+async function deviceLogin(clientId, scope2, onPrompt, resource) {
   const { verifier, challenge } = pkce();
   const startRes = await fetch(`${AUTH_BASE}/device_authorization`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: clientId, scope, code_challenge: challenge, code_challenge_method: "S256", ...resource ? { resource } : {} })
+    body: new URLSearchParams({ client_id: clientId, scope: scope2, code_challenge: challenge, code_challenge_method: "S256", ...resource ? { resource } : {} })
   });
   const start = await startRes.json().catch(() => ({}));
   if (!startRes.ok) {
@@ -8923,7 +8923,7 @@ async function claimJourney(work, checks, env) {
   if (res.claimed) {
     try {
       await admin({ method: "DELETE", path: `/teams/${encodeURIComponent(teamId)}`, summary: "delete the promoted demo team" });
-      for (let i = 0; i < 60 && !gone; i++) {
+      for (let i = 0; i < 180 && !gone; i++) {
         try {
           await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}` });
         } catch (e) {
@@ -8931,7 +8931,7 @@ async function claimJourney(work, checks, env) {
         }
         if (!gone) await new Promise((r) => setTimeout(r, 1e3));
       }
-      detail = gone ? "cascade done" : "still present after 60 s";
+      detail = gone ? "cascade done" : "still present after 180 s";
     } catch (e) {
       detail = `delete \u2192 ${fail7(e).status} ${fail7(e).error}`;
     }
@@ -8949,7 +8949,7 @@ async function runOpAnon(o = {}) {
   const log4 = (s) => {
     if (!o.json) console.log(s);
   };
-  log4(import_chalk70.default.bold(`${B.cli} op anon \u2014 a first-time visitor's demo, against production`));
+  log4(import_chalk71.default.bold(`${B.cli} op anon \u2014 a first-time visitor's demo, against production`));
   try {
     await journey("first", work, home, checks);
     const env = await journey("rerun", work, home, checks);
@@ -8972,18 +8972,18 @@ async function runOpAnon(o = {}) {
     checks.push({ id: "stop", ok: stop.code === 0 && portsFree, detail: `exit ${stop.code}${portsFree ? "" : " \xB7 ports still answering"}` });
     import_fs10.default.rmSync(root, { recursive: true, force: true });
   }
-  for (const c of checks) log4(`  ${c.skipped ? import_chalk70.default.yellow("\u2013") : c.ok ? import_chalk70.default.green("\u2713") : import_chalk70.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk70.default.dim(c.detail)}`);
+  for (const c of checks) log4(`  ${c.skipped ? import_chalk71.default.yellow("\u2013") : c.ok ? import_chalk71.default.green("\u2713") : import_chalk71.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk71.default.dim(c.detail)}`);
   const failed = checks.filter((c) => !c.ok).length;
   const skipped = checks.filter((c) => c.skipped).length;
   const passed = checks.length - failed - skipped;
   const secs = Math.round((Date.now() - t0) / 1e3);
   const tail = `${skipped ? `, ${skipped} skipped` : ""} (${secs} s)`;
-  log4(failed ? import_chalk70.default.red(`${passed}/${checks.length - skipped} passed, ${failed} failed${tail}`) : import_chalk70.default.green(`${passed}/${checks.length - skipped} passed${tail}`));
+  log4(failed ? import_chalk71.default.red(`${passed}/${checks.length - skipped} passed, ${failed} failed${tail}`) : import_chalk71.default.green(`${passed}/${checks.length - skipped} passed${tail}`));
   if (o.json) process.stdout.write(JSON.stringify({ ok: !failed, checks }, null, 2) + "\n");
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
 }
-var import_fs10, import_os3, import_path7, import_child_process6, import_chalk70, SECRET, SANDBOX_TEAM;
+var import_fs10, import_os3, import_path7, import_child_process6, import_chalk71, SECRET, SANDBOX_TEAM;
 var init_op_anon = __esm({
   "src/commands/op-anon.ts"() {
     "use strict";
@@ -8991,7 +8991,7 @@ var init_op_anon = __esm({
     import_os3 = __toESM(require("os"));
     import_path7 = __toESM(require("path"));
     import_child_process6 = require("child_process");
-    import_chalk70 = __toESM(require("chalk"));
+    import_chalk71 = __toESM(require("chalk"));
     init_brand();
     init_api();
     init_admin();
@@ -9004,7 +9004,7 @@ var init_op_anon = __esm({
 // src/index.ts
 var import_fs11 = __toESM(require("fs"));
 var import_commander = require("commander");
-var import_chalk72 = __toESM(require("chalk"));
+var import_chalk73 = __toESM(require("chalk"));
 init_package();
 init_cli_run_context();
 init_version_guard();
@@ -9108,13 +9108,26 @@ async function defaultName(openapi, teamId) {
   }
   return randomProxyName();
 }
+function saltedName(name) {
+  return `${name}${Math.random().toString(36).slice(2, 6)}`;
+}
 async function chooseName(opts, openapi, teamId, interactive2) {
   if (opts.name !== void 0) {
     const name = normalizeName2(opts.name);
     if (name.length < 3) throw new Error(`${cap(B.thingShort)} name must be at least 3 characters (letters and digits only).`);
     const check = await checkProxyName(name, teamId).catch(() => null);
     if (check && (!check.canUseProjectName || !check.canUseApiVersion)) {
-      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}.`);
+      if (opts.auto || !interactive2) {
+        for (let attempt = 0; attempt < 4; attempt++) {
+          const candidate = saltedName(name);
+          const again = await checkProxyName(candidate, teamId).catch(() => null);
+          if (!again || again.canUseProjectName && again.canUseApiVersion) {
+            console.log(import_chalk20.default.dim(`  "${name}" is taken (names are global) \u2014 using "${candidate}" instead.`));
+            return candidate;
+          }
+        }
+      }
+      throw new Error(`${cap(B.thingShort)} name "${name}" is not available${check.message ? ` \u2014 ${check.message}` : ""}. Omit --name and a free one is chosen for you.`);
     }
     return name;
   }
@@ -9972,7 +9985,6 @@ their own app).
 }
 function shipMarkdown() {
   const legacy = legacySkillMarkdown();
-  const at = legacy.indexOf("## Adopt");
   const backendRules = `## What their backend does \u2014 and nothing else
 
 The gateway does sign-in, keys, tenancy and single-record ownership. The backend does only:
@@ -9993,7 +10005,7 @@ No code yet? Write the smallest plain backend that does exactly that, plus its \
   return withLatest(`# Put ${B.product} in front of their app
 
 ${backendRules}${blockedMarkdown()}
-${at >= 0 ? legacy.slice(at) : legacy}`);
+${legacy}`);
 }
 function skillMarkdown() {
   return `${heroMarkdown()}
@@ -10003,121 +10015,7 @@ function legacySkillMarkdown() {
   const P = B.product;
   const cli = B.cli;
   const LIB = "apiblaze";
-  const other = BRAND === "mcpblaze" ? "APIblaze" : "MCPblaze";
-  const doors = BRAND === "mcpblaze" ? `${P} ships your code to agents (an MCP server); ${other} ships the same code to users (API keys + sign-in).` : `${P} ships your code to users (API keys + sign-in); ${other} ships the same code to agents (an MCP server).`;
-  return `---
-name: ${SKILL_NAME}
-description: Use when the user asks what ${P} (or ${cli}) does or can do for them; says yes to a demo or asks to see / try / demo it; wants to ship, share, expose or make an API public; says "serve my backend behind a proxy and MCP"; wants auth, API keys, sign-in, multi-tenant registration, users and groups, rate limits (throttling), quotas or spend caps; wants agents to use the API through an MCP; or says users can reach each other's records or admin functions. Puts the ${P} gateway in front of the API instead of hand-rolling auth and tenancy in the backend.
----
-
-# Ship safely with ${P}
-
-One gateway, two doors. ${doors}
-Same rules, one command. Nothing about auth, tenancy or ownership goes into the backend's
-business logic: the gateway sits in front of the code and enforces it.
-
-## Which mode \u2014 decide this first
-
-- They ask what ${P} does or can do \u2192 **Explain**. Glance at the workspace first (see
-  Explain), answer, then offer either the demo or their own app. Run no \`npx ${cli}\`
-  command \u2014 the whole answer is in this file.
-- They say yes to the demo, or ask to see / try / demo it \u2192 **Demo app**. It lives in its own
-  folder and never touches their code.
-- They say yes to "can I read the code" \u2192 **Adopt**: scan their app, ask only what the scan
-  could not find, then ship it through the Ship steps.
-- They have a backend, just wrote one, or ask you to BUILD one and then ship it \u2192 **Ship**.
-  No code yet? First write the smallest plain backend that serves the resources they named,
-  plus its \`openapi.yaml\`, start it on their port, then continue at Ship \xA71. Do NOT build
-  the Demo app for this. The gateway does auth, tenancy and item ownership; the backend does
-  only these three things:
-  - stamp each new row's \`tenant\` with the \`x-abz-tenant-id\` header and its \`owner\` with
-    the \`x-abz-user-id\` header;
-  - filter every collection GET to rows whose \`tenant\` AND \`owner\` match those headers (the
-    gateway's rules lock single records, never lists \u2014 a list route has no one record to
-    check). Both, always: a user id is not unique across tenants ("ana" at one customer and
-    "ana" at another are two people);
-  - answer 401 to any call whose \`x-target-api-key\` is not \`process.env.TARGET_SERVER_SECRET\`
-    (generate it with \`openssl rand -hex 24\`, put it in \`.env.local\`, start the backend with
-    it; Ship \xA73b makes the proxy send it). If they say "use
-  ${cli} on this" or "ship it with ${cli}" and point at a backend, skip any pitch and run it.
-
-Tie-breaks: a question ("what can it do", "what is it") is always **Explain**, whatever else the
-message names. Mentioning \`npx ${cli} skills\` is NOT a request to run anything \u2014 it is the
-command that installed this file. If a message fits two modes, the earliest bullet wins.
-
-## Explain
-
-Say this, in these words or close to them, then stop:
-
-"${P} puts a gateway in front of your backend in one command: a proxy (every request passes
-through it first) and an MCP server (the same API, callable by AI agents like Claude). No auth
-or ownership logic goes into your code \u2014 your backend only has to trust one header. Each of
-your customers \u2014 a tenant \u2014 gets their own API key, created from a widget you drop into your
-site. People and agents sign in with hosted GitHub, or your own OAuth app. Each user can only
-touch the records they created; those rules come from your OpenAPI spec (the file listing your
-endpoints), and if you have none I draft one from your routes and show it to you first. One
-more command sets a rate limit, a daily quota and a spend cap. In dev it tunnels to localhost;
-in prod it points at your deploy."
-
-Before answering, look at the workspace \u2014 file names and \`package.json\` only, no reading of
-code yet. It "has an app" if ANY of these is present: an \`openapi.*\` / \`swagger.*\` file; a
-server framework (express, fastify, hono, koa, nest, fastapi, flask, django, rails, gin, chi,
-net/http); or a frontend (next, react, vue, svelte, remix, nuxt) whose \`.env*\` file NAMES an
-API base-URL variable (\`API_URL\`, \`NEXT_PUBLIC_API_URL\`, \`VITE_API_URL\`, or similar) \u2014
-\`grep -l\` the env files, open nothing else. Then end with exactly one of these two lines:
-
-- No app \u2192 **"Would you like me to spin up a demo app?"**
-- An app \u2192 **"I see you have an app already coded. Can I read the code to see how to ready it
-  for human and agent traffic with ${P}?"**
-
-## Demo app \u2014 the same reservation system, before and after
-
-One Next.js app on port 3000. Two routes, same UI, same data: \`/before\` is how most apps
-ship; \`/\` is the same thing behind ${P}. Narrate each step in one line and show every
-\`npx ${cli}\` command \u2014 the commands are the product. Everything goes in \`${cli}-demo/\`.
-
-1. **Scaffold.** \`npx create-next-app@latest ${cli}-demo\` (TypeScript, App Router). Then
-   \`npm i hono ${LIB}\`.
-2. **The backend.** Hono mounted at \`app/api/[[...route]]/route.ts\` (\`import { handle } from
-   'hono/vercel'\`). Three resources \u2014 restaurants, tables, reservations \u2014 in an in-memory Map,
-   every row stamped with \`owner\` = the \`x-abz-user-id\` header (${P} sets it on every call it
-   forwards). Every route requires \`X-Api-Secret: demo-secret\` OR an \`x-abz-user-id\` header \u2014
-   the first is how /before gets in, the second is how the gateway gets in. Write
-   \`openapi.yaml\` at the repo root: every path and method, and the \`id\` each POST returns \u2014
-   the ownership rules are read from it.
-3. **/before.** \`app/before/page.tsx\`: list and create reservations through one server route,
-   \`app/before/api/route.ts\`, which holds \`demo-secret\` and calls \`/api/...\` directly. Put the
-   caption on the page: "Before \u2014 one shared secret, anyone holding it can do anything."
-4. **Put ${P} in front.** In the BACKGROUND, and leave it running \u2014 it is the tunnel:
-   \`npx ${cli} dev --port 3000 --openapi ./openapi.yaml --name demo --auto\`
-   It prints the API URL, the MCP URL, the tenant, and the bootstrap key ONCE. Write them to
-   \`.env.local\` as \`APIBLAZE_URL\`, \`APIBLAZE_SERVER_KEY\`, \`APIBLAZE_TENANT\`. \`--auto\` locks
-   all three resources to their creator \u2014 say so.
-5. **Users and groups.** Turn them on and make the group the demo is about:
-   \`npx ${cli} iam demo on\`
-   \`npx ${cli} group create reservationists --tenant <tenant>\`
-   \`npx ${cli} group add-user <the demo user> reservationists --tenant <tenant>\`
-   \`npx ${cli} admins add <the user's email> --tenant <tenant>\` (so the widget has an admin).
-   Optional, billed per turn: \`npx ${cli} rule demo "only members of reservationists can create
-   or change reservations"\`. If the user is logged out or their wallet has nothing available
-   (\`npx ${cli} billing balance\`), keep the free creator-lock rules and say so \u2014 do not pretend
-   the group rule applied.
-6. **/.** \`app/page.tsx\`: the same UI, plus a **user picker** (ana \xB7 ben \xB7 admin \u2014 a select, no
-   real login; the demo is about authorization, not building sign-in). Its server route calls
-   \`process.env.APIBLAZE_URL\` with \`X-API-Key: APIBLAZE_SERVER_KEY\` and \`X-End-User-Id: <the
-   picked user>\`. Add the three widgets from \`${LIB}/react\`, each with its server route:
-   - \`<ApiKeyWidget />\` + \`app/api/apiblaze/keys/route.ts\` (\`createApiblazeKeys\` from \`${LIB}/server\`)
-   - \`<UsersGroupsWidget />\` + \`app/api/apiblaze/groups/route.ts\` (\`createApiblazeGroups\` \u2014
-     the keys route with one word changed)
-   - \`<ChatWidget />\` + \`app/api/apiblaze/chat/route.ts\` (\`createApiblazeChat\`)
-   Exact snippets for the keys and chat pair: \`npx ${cli} integration demo --stack nextjs\`.
-   Caption: "After \u2014 a key per tenant, every call names its user, and ${P} decides."
-7. **Prove it, in the browser.** \`npm run dev\`, open \`http://localhost:3000/before\` then
-   \`http://localhost:3000/\`. On \`/\`: create a reservation as ana, switch to ben, try to cancel
-   it \u2014 show the 403 in the UI. Open the groups widget: reservationists is there. Ask the chat
-   widget to list reservations. Then say what each \`npx ${cli}\` command did, in order.
-
-## Adopt \u2014 reading their code first
+  return `## Adopt \u2014 reading their code first
 
 They said yes. Scan properly now (routes, env files, auth, network calls), classify, then ask
 ONLY for what the scan could not find \u2014 one short list of questions, not an interview.
@@ -10178,12 +10076,14 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    the report. Only ask "where do your users sign in today?" when they mention an existing
    login. Their own OAuth app \u2192 \`--apikey --oauth '{"provider":"auth0","clientId":"\u2026","clientSecret":"\u2026"}'\`
    (both doors: keys for tenants, their login for people and agents). Shapes below.
-3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --name <name> --auto <door flags>\`,
+3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --auto <door flags>\`,
    left running \u2014 it is the tunnel. Start it as its own detached process, never \`cmd &\` inside
    a shell call that ends: \`nohup npx ${cli} dev \u2026 > ${cli}-dev.log 2>&1 < /dev/null &\`, then
-   read the log. If it stops, re-run the SAME command: the same \`--name\` reattaches and
-   creates nothing. Never pick a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
-   \`npx ${cli} create --target <url-or-spec> --name <name> --auto <door flags>\`. Both print the
+   read the log. Leave \`--name\` out: names are global, so a free one is chosen and printed
+   (\`--name\` only for a name the user asked for; a taken one is salted). If the tunnel stops,
+   run the \`--project <name>\` line it printed: that reattaches and creates nothing. Never start
+   a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
+   \`npx ${cli} create --target <url-or-spec> --auto <door flags>\`. Both print the
    URL, the MCP URL (the "agents:" line) and what is locked. Run by you (no terminal), \`dev\`
    saves the bootstrap key to \`.env.local\` as \`APIBLAZE_SERVER_KEY\` and never prints it;
    \`create\` prints it ONCE \u2014 save it there yourself. Either way say only "saved your key to
@@ -11492,8 +11392,13 @@ function withOverride(cat, tool, flags) {
   for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
     if (typeof flags[k] === "boolean") patch[k] = flags[k];
   }
+  if (typeof flags.title === "string") {
+    const t = flags.title.trim().slice(0, 120);
+    if (!t) throw new Error('--title needs some text (a short human label, e.g. "List pets").');
+    patch.title = t;
+  }
   if (Object.keys(patch).length === 0) {
-    throw new Error("Nothing to set. Pass --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
   }
   return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
 }
@@ -14132,15 +14037,15 @@ async function runDomainAdd(project, opts) {
     console.error(import_chalk50.default.red(`A ${kind} domain belongs to a proxy: apiblaze domain add <project> --kind ${kind} --domain ${opts.domain}`));
     process.exit(1);
   }
-  const scope = await scopeFor(project, opts);
+  const scope2 = await scopeFor(project, opts);
   const spinner = (0, import_ora20.default)(`Registering ${opts.domain}...`).start();
   try {
-    const body = scope.kind === "project" ? { hostname: opts.domain, api_version: scope.apiVersion, kind, ...opts.tenant ? { tenant_name: opts.tenant.toLowerCase() } : {} } : { hostname: opts.domain, kind };
+    const body = scope2.kind === "project" ? { hostname: opts.domain, api_version: scope2.apiVersion, kind, ...opts.tenant ? { tenant_name: opts.tenant.toLowerCase() } : {} } : { hostname: opts.domain, kind };
     const out = await admin({
       method: "POST",
-      path: scope.base,
+      path: scope2.base,
       body,
-      summary: `Add custom ${kind} domain ${opts.domain} to ${scope.label}${scope.kind === "project" && opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
+      summary: `Add custom ${kind} domain ${opts.domain} to ${scope2.label}${scope2.kind === "project" && opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
     });
     spinner.succeed(`Registered ${out?.hostname ?? opts.domain} (${describeKind(out)}). Add these DNS records, then run \`apiblaze domain status\`:`);
     if (opts.json) {
@@ -14157,11 +14062,11 @@ async function runDomainAdd(project, opts) {
   }
 }
 async function runDomainList(project, opts) {
-  const scope = await scopeFor(project, opts);
+  const scope2 = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: scope.kind === "project" ? `${scope.base}?api_version=${encodeURIComponent(scope.apiVersion)}` : scope.base,
-    summary: `List custom domains for ${scope.label}`
+    path: scope2.kind === "project" ? `${scope2.base}?api_version=${encodeURIComponent(scope2.apiVersion)}` : scope2.base,
+    summary: `List custom domains for ${scope2.label}`
   });
   const domains = out?.domains ?? [];
   if (opts.json) {
@@ -14173,7 +14078,7 @@ async function runDomainList(project, opts) {
     return;
   }
   for (const d of domains) {
-    const pin = scope.kind === "project" && d.tenant ? import_chalk50.default.dim(` tenant ${d.tenant}`) : "";
+    const pin = scope2.kind === "project" && d.tenant ? import_chalk50.default.dim(` tenant ${d.tenant}`) : "";
     console.log(`  ${import_chalk50.default.bold(d.hostname)}  ${statusColor2(d.status)}  ${import_chalk50.default.dim(describeKind(d))}${pin}  ${import_chalk50.default.dim(d.id ?? "")}`);
   }
 }
@@ -14182,10 +14087,10 @@ async function runDomainStatus(project, opts) {
     console.error(import_chalk50.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const scope = await scopeFor(project, opts);
+  const scope2 = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: `${scope.base}/${encodeURIComponent(opts.id)}/status`,
+    path: `${scope2.base}/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
   if (opts.json) {
@@ -14207,12 +14112,12 @@ async function runDomainRemove(project, opts) {
     console.error(import_chalk50.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const scope = await scopeFor(project, opts);
+  const scope2 = await scopeFor(project, opts);
   const spinner = (0, import_ora20.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
-      path: `${scope.base}/${encodeURIComponent(opts.id)}`,
+      path: `${scope2.base}/${encodeURIComponent(opts.id)}`,
       summary: `Remove custom domain ${opts.id}`
     });
     spinner.succeed("Removed. Billing for it stops now.");
@@ -14828,7 +14733,8 @@ function randomSecret() {
   (0, import_crypto2.randomFillSync)(bytes);
   return Buffer.from(bytes).toString("base64url");
 }
-var PROVIDER_TYPES = ["google", "github", "microsoft", "facebook", "auth0", "other"];
+var PROVIDER_TYPES = ["google", "github", "microsoft", "facebook", "auth0", "oidc"];
+var PASSWORD_TYPE = "password";
 var DEFAULT_SCOPES2 = {
   google: "openid email profile",
   microsoft: "openid email profile",
@@ -14862,8 +14768,15 @@ async function providersMenu(cBase, clientLabel) {
     }]);
     if (act === "back") return;
     if (act === "add") {
-      const { type } = await inquirer3.prompt([{ type: "list", name: "type", message: "Provider:", choices: PROVIDER_TYPES }]);
+      const showPassword = providers.some((p) => String(p.type).toLowerCase() === PASSWORD_TYPE) || process.env.APIBLAZE_ADVANCED === "1";
+      const typeChoices = showPassword ? [...PROVIDER_TYPES, { name: "password  (APIblaze-hosted username & password \u2014 reviewer / test accounts)", value: PASSWORD_TYPE }] : PROVIDER_TYPES;
+      const { type } = await inquirer3.prompt([{ type: "list", name: "type", message: "Provider:", choices: typeChoices }]);
       let body;
+      if (type === PASSWORD_TYPE) {
+        await admin({ method: "POST", path: `${cBase}/providers`, body: { type: PASSWORD_TYPE }, summary: "Enable username & password sign-in" });
+        console.log(import_chalk54.default.green("  Username & password sign-in enabled. Add people: apiblaze tenant password add <username>"));
+        continue;
+      }
       if (type === "github") {
         const { managed } = await inquirer3.prompt([{
           type: "confirm",
@@ -14877,7 +14790,7 @@ async function providersMenu(cBase, clientLabel) {
         const a = await inquirer3.prompt([
           { type: "input", name: "clientId", message: `${type} OAuth client id:`, validate: (s) => !!s.trim() || "required" },
           { type: "password", name: "clientSecret", mask: "*", message: `${type} OAuth client secret:`, validate: (s) => s.length >= 6 && s.length <= 200 || "6\u2013200 chars" },
-          ...type === "auth0" || type === "other" ? [{ type: "input", name: "domain", message: "Issuer / domain (e.g. your-tenant.auth0.com):" }] : [],
+          ...type === "auth0" || type === "oidc" ? [{ type: "input", name: "domain", message: "Issuer / domain (e.g. your-tenant.auth0.com):" }] : [],
           { type: "input", name: "scopes", message: "Scopes:", default: DEFAULT_SCOPES2[type] ?? "" }
         ]);
         body = {
@@ -16323,9 +16236,230 @@ async function agentsMenu(proj2, opts) {
   else await runMcp(proj2.projectName, proj2.apiVersion, {});
 }
 
-// src/commands/group.ts
+// src/commands/tenant-password.ts
 var import_chalk59 = __toESM(require("chalk"));
 var import_ora28 = __toESM(require("ora"));
+init_admin();
+init_api();
+init_resolve();
+init_auth();
+init_tenant_pick();
+async function teamHasTenant(teamId, slug) {
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants?limit=200&q=${encodeURIComponent(slug)}`,
+    summary: `Look for tenant ${slug}`
+  }).catch(() => null);
+  const names = (out?.tenants ?? []).map((t) => typeof t === "string" ? t : t.tenant_name ?? "");
+  return names.includes(slug);
+}
+async function teamForTenant(slug) {
+  const { teamId: active } = await resolveTeam(void 0);
+  if (await teamHasTenant(active, slug)) return active;
+  const teams = (await getTeams().catch(() => [])).filter((t) => t.teamId !== active);
+  for (const t of teams) {
+    if (await teamHasTenant(t.teamId, slug)) {
+      console.error(import_chalk59.default.dim(`  (tenant ${slug} is on team ${t.name})`));
+      return t.teamId;
+    }
+  }
+  console.error(import_chalk59.default.red(`No tenant "${slug}" on any of your teams.`) + import_chalk59.default.dim("  (apiblaze tenant list)"));
+  process.exit(1);
+}
+async function scope(opts, message, positional) {
+  const named = (positional ?? opts.tenant)?.trim();
+  let teamId;
+  let tenant2;
+  if (named) {
+    tenant2 = named;
+    teamId = await teamForTenant(named);
+  } else {
+    ({ teamId } = await resolveTeam(void 0));
+    tenant2 = loadCredentials()?.activeTenant || null;
+    if (!tenant2) tenant2 = await pickTenant(teamId, { message });
+  }
+  if (!tenant2) process.exit(1);
+  return { teamId, tenant: tenant2, base: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}` };
+}
+async function serverSupportsPasswordProvider(s) {
+  try {
+    await admin({ method: "GET", path: `${s.base}/password-accounts`, summary: "Check server capabilities" });
+    return true;
+  } catch (e) {
+    return !/\b404\b|not found/i.test(e instanceof Error ? e.message : String(e));
+  }
+}
+async function defaultAppClient(s) {
+  const auth = await admin({ method: "GET", path: `${s.base}/auth`, summary: "Read tenant login config" }).catch(() => null);
+  let defaultId = auth?.default_app_client_id ?? null;
+  if (!defaultId) {
+    const clients = await admin({ method: "GET", path: `${s.base}/app-clients`, summary: "List app clients" }).catch(() => null);
+    const list = Array.isArray(clients) ? clients : Array.isArray(clients?.app_clients) ? clients.app_clients : [];
+    defaultId = list.length === 1 ? list[0].id ?? list[0].client_id ?? list[0].clientId ?? null : null;
+  }
+  if (!defaultId) return null;
+  const providers = await admin({ method: "GET", path: `${s.base}/app-clients/${encodeURIComponent(defaultId)}/providers`, summary: "List login providers" }).catch(() => []);
+  return { clientId: defaultId, providers: Array.isArray(providers) ? providers : [] };
+}
+async function runTenantPasswordEnable(tenantArg2, opts) {
+  const s = await scope(opts, "Enable username & password sign-in on which tenant?", tenantArg2);
+  if (!await serverSupportsPasswordProvider(s)) {
+    console.error(import_chalk59.default.red("This APIblaze deployment does not offer username & password sign-in yet."));
+    process.exit(1);
+  }
+  const spinner = (0, import_ora28.default)("Checking the tenant's default app client...").start();
+  const dc = await defaultAppClient(s);
+  if (!dc) {
+    spinner.fail(`Tenant ${s.tenant} has no login yet.`);
+    console.error(import_chalk59.default.dim(`  Attach it to a proxy with a sign-in first: apiblaze tenant attach <project> --tenant ${s.tenant}`));
+    process.exit(1);
+  }
+  const existing = dc.providers.find((p) => String(p.type).toLowerCase() === "password");
+  if (existing) {
+    spinner.succeed(`Username & password sign-in is already enabled on ${s.tenant}.`);
+    if (opts.json) console.log(JSON.stringify({ enabled: true, provider_id: existing.id, client_id: dc.clientId }));
+    else console.log(import_chalk59.default.dim(`  Add people: apiblaze tenant password add <username> ${s.tenant}`));
+    return;
+  }
+  spinner.text = "Adding the provider...";
+  const created = await admin({ method: "POST", path: `${s.base}/app-clients/${encodeURIComponent(dc.clientId)}/providers`, body: { type: "password" }, summary: "Enable username & password sign-in" });
+  spinner.succeed(`Username & password sign-in enabled on ${import_chalk59.default.bold(s.tenant)}.`);
+  if (opts.json) {
+    console.log(JSON.stringify({ enabled: true, provider_id: created?.id ?? created?.provider?.id ?? null, client_id: dc.clientId }));
+    return;
+  }
+  console.log(import_chalk59.default.dim(`  The hosted login page now shows a username & password form next to the other sign-in buttons.
+  Add people: apiblaze tenant password add <username> ${s.tenant}`));
+}
+async function runTenantPasswordDisable(tenantArg2, opts) {
+  const s = await scope(opts, "Disable username & password sign-in on which tenant?", tenantArg2);
+  const dc = await defaultAppClient(s);
+  const existing = dc?.providers.find((p) => String(p.type).toLowerCase() === "password");
+  if (!dc || !existing) {
+    console.log(import_chalk59.default.dim(`Username & password sign-in is not enabled on ${s.tenant}.`));
+    return;
+  }
+  if (!opts.yes) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { ok } = await inquirer3.prompt([{ type: "confirm", name: "ok", default: false, message: `Remove username & password sign-in from ${s.tenant}? Every password account on it is deleted too.` }]);
+    if (!ok) return;
+  }
+  await admin({ method: "DELETE", path: `${s.base}/app-clients/${encodeURIComponent(dc.clientId)}/providers/${encodeURIComponent(existing.id)}`, summary: "Disable username & password sign-in" });
+  console.log(import_chalk59.default.green(`Username & password sign-in removed from ${s.tenant}.`));
+  if (opts.json) console.log(JSON.stringify({ enabled: false }));
+}
+function printAccount(a) {
+  const flags = [a.disabled ? import_chalk59.default.red("blocked") : import_chalk59.default.green("active"), a.locked_until ? import_chalk59.default.yellow(`locked until ${a.locked_until}`) : "", a.purpose === "reviewer" ? import_chalk59.default.cyan("reviewer") : ""].filter(Boolean).join(" \xB7 ");
+  console.log(`  ${import_chalk59.default.bold(a.username)}  ${flags}${a.email ? import_chalk59.default.dim(`  ${a.email}`) : ""}${a.last_login_at ? import_chalk59.default.dim(`  last login ${a.last_login_at}`) : ""}`);
+}
+async function runTenantPasswordList(tenantArg2, opts) {
+  const s = await scope(opts, "List password accounts on which tenant?", tenantArg2);
+  const out = await admin({ method: "GET", path: `${s.base}/password-accounts`, summary: "List password accounts" });
+  if (opts.json) {
+    console.log(JSON.stringify(out, null, 2));
+    return;
+  }
+  if (!out?.enabled) {
+    console.log(import_chalk59.default.dim(`Username & password sign-in is not enabled on ${s.tenant}. Enable: apiblaze tenant password enable ${s.tenant}`));
+    return;
+  }
+  const accounts = out.accounts ?? [];
+  if (!accounts.length) {
+    console.log(import_chalk59.default.dim(`  No password accounts yet on ${s.tenant}. Add one: apiblaze tenant password add <username> ${s.tenant}`));
+    return;
+  }
+  console.log(import_chalk59.default.dim(`  ${s.tenant}`));
+  for (const a of accounts) printAccount(a);
+}
+async function readPasswordFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+function revealOnce(s, username, password) {
+  console.log();
+  console.log(import_chalk59.default.bold("  Password (shown once, never stored in clear):"));
+  console.log(`  ${import_chalk59.default.cyan(username)}  ${import_chalk59.default.bgWhite.black(` ${password} `)}`);
+  console.log(import_chalk59.default.dim(`  New one any time: apiblaze tenant password rotate ${username} ${s.tenant}`));
+  console.log();
+}
+async function runTenantPasswordAdd(username, tenantArg2, opts) {
+  const s = await scope(opts, "Add the account on which tenant?", tenantArg2);
+  const body = { username };
+  if (opts.email) body.email = opts.email;
+  if (opts.displayName) body.displayName = opts.displayName;
+  if (opts.purpose) body.purpose = opts.purpose;
+  if (opts.passwordStdin) body.password = await readPasswordFromStdin();
+  const r = await admin({ method: "POST", path: `${s.base}/password-accounts`, body, summary: `Add password account ${username}` });
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return;
+  }
+  console.log(import_chalk59.default.green(`Account ${import_chalk59.default.bold(r.account?.username ?? username)} created on ${s.tenant}.`));
+  if (r.adopts?.abz_sub) console.log(import_chalk59.default.yellow(`  This login signs in AS the existing user ${r.adopts.abz_sub} (same email, pre-provisioned on this tenant).`));
+  if (!opts.passwordStdin && r.password) revealOnce(s, r.account?.username ?? username, r.password);
+}
+async function findAccount(s, username) {
+  const out = await admin({ method: "GET", path: `${s.base}/password-accounts`, summary: "List password accounts" });
+  const a = (out?.accounts ?? []).find((x) => x.username === username.trim().toLowerCase() || x.id === username);
+  if (!a) {
+    console.error(import_chalk59.default.red(`No password account "${username}" on ${s.tenant}.`));
+    process.exit(1);
+  }
+  return a;
+}
+async function runTenantPasswordRotate(username, tenantArg2, opts) {
+  const s = await scope(opts, "Rotate the password on which tenant?", tenantArg2);
+  const a = await findAccount(s, username);
+  const body = {};
+  if (opts.passwordStdin) body.password = await readPasswordFromStdin();
+  const r = await admin({ method: "POST", path: `${s.base}/password-accounts/${encodeURIComponent(a.id)}/rotate`, body, summary: `Rotate password for ${a.username}` });
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return;
+  }
+  console.log(import_chalk59.default.green(`Password rotated for ${import_chalk59.default.bold(a.username)}. Existing sessions end at their next refresh.`));
+  if (!opts.passwordStdin && r.password) revealOnce(s, a.username, r.password);
+}
+async function runTenantPasswordSetBlocked(username, tenantArg2, blocked, opts) {
+  const s = await scope(opts, `${blocked ? "Block" : "Unblock"} the account on which tenant?`, tenantArg2);
+  const a = await findAccount(s, username);
+  const r = await admin({ method: "PATCH", path: `${s.base}/password-accounts/${encodeURIComponent(a.id)}`, body: { disabled: blocked }, summary: `${blocked ? "Block" : "Unblock"} ${a.username}` });
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return;
+  }
+  console.log(import_chalk59.default.green(`${a.username} ${blocked ? "blocked: sign-in refused until unblocked" : "unblocked"}.`));
+}
+async function runTenantPasswordUnlock(username, tenantArg2, opts) {
+  const s = await scope(opts, "Unlock the account on which tenant?", tenantArg2);
+  const a = await findAccount(s, username);
+  const r = await admin({ method: "POST", path: `${s.base}/password-accounts/${encodeURIComponent(a.id)}/unlock`, body: {}, summary: `Unlock ${a.username}` });
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return;
+  }
+  console.log(import_chalk59.default.green(`${a.username} unlocked.`));
+}
+async function runTenantPasswordRemove(username, tenantArg2, opts) {
+  const s = await scope(opts, "Remove the account from which tenant?", tenantArg2);
+  const a = await findAccount(s, username);
+  if (!opts.yes) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { ok } = await inquirer3.prompt([{ type: "confirm", name: "ok", default: false, message: `Remove password account ${a.username}?` }]);
+    if (!ok) return;
+  }
+  const r = await admin({ method: "DELETE", path: `${s.base}/password-accounts/${encodeURIComponent(a.id)}`, summary: `Remove ${a.username}` });
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return;
+  }
+  console.log(import_chalk59.default.green(`${a.username} removed.`));
+}
+
+// src/commands/group.ts
+var import_chalk60 = __toESM(require("chalk"));
+var import_ora29 = __toESM(require("ora"));
 init_auth();
 init_consumer_auth();
 init_admin();
@@ -16427,7 +16561,7 @@ async function userByRefOrCreate(t, ref) {
     if (!ref.includes("@")) throw e;
     const created = await t.call("/v1/admin/users", "POST", { email: ref.trim().toLowerCase() });
     if (!created?.abz_sub) throw e;
-    console.log(import_chalk59.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
+    console.log(import_chalk60.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
     return { abz_sub: created.abz_sub, email: created.email ?? ref, display_name: null };
   }
 }
@@ -16435,11 +16569,11 @@ async function runGroupList(opts) {
   const t = await resolveTransport(opts);
   const groups = await listGroups(t);
   if (opts.json) return void console.log(JSON.stringify(groups));
-  if (!groups.length) return void console.log(import_chalk59.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
-  console.log(import_chalk59.default.dim(`Tenant ${t.tenant}:`));
+  if (!groups.length) return void console.log(import_chalk60.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk60.default.dim(`Tenant ${t.tenant}:`));
   for (const g of groups) {
-    const sealed = g.name === "apiblaze_admins" ? import_chalk59.default.dim("  (admins \u2014 managed by allowlist)") : "";
-    console.log(`  ${import_chalk59.default.bold(g.name)}  ${import_chalk59.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+    const sealed = g.name === "apiblaze_admins" ? import_chalk60.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk60.default.bold(g.name)}  ${import_chalk60.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
   }
 }
 async function runGroupCreate(name, opts) {
@@ -16464,10 +16598,10 @@ async function runGroupCreate(name, opts) {
       }
     }
   }
-  const spinner = (0, import_ora28.default)(`Creating group ${name}...`).start();
+  const spinner = (0, import_ora29.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
-    spinner.succeed(`Group ${import_chalk59.default.bold(name)} created in ${t.tenant}.`);
+    spinner.succeed(`Group ${import_chalk60.default.bold(name)} created in ${t.tenant}.`);
   } catch (e) {
     spinner.fail("Create failed.");
     throw e;
@@ -16476,10 +16610,10 @@ async function runGroupCreate(name, opts) {
 async function runGroupDelete(name, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, name);
-  const spinner = (0, import_ora28.default)(`Deleting group ${name}...`).start();
+  const spinner = (0, import_ora29.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
-    spinner.succeed(`Group ${import_chalk59.default.bold(name)} deleted.`);
+    spinner.succeed(`Group ${import_chalk60.default.bold(name)} deleted.`);
   } catch (e) {
     spinner.fail("Delete failed.");
     throw e;
@@ -16498,21 +16632,21 @@ async function runGroupMembers(name, opts) {
     return void console.log(JSON.stringify({ ...detail, members: walkedMembers.items, subgroups: subs?.subgroups ?? [] }));
   }
   const members = walkedMembers.items;
-  console.log(import_chalk59.default.bold(`${g.name}`) + import_chalk59.default.dim(`  (${t.tenant})`));
-  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk59.default.cyan("group-admin") : import_chalk59.default.dim("member")}`);
-  if (!members.length) console.log(import_chalk59.default.dim("  no members"));
+  console.log(import_chalk60.default.bold(`${g.name}`) + import_chalk60.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk60.default.cyan("group-admin") : import_chalk60.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk60.default.dim("  no members"));
   const sg = subs?.subgroups ?? [];
-  if (sg.length) console.log(import_chalk59.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+  if (sg.length) console.log(import_chalk60.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
 }
 async function runGroupAddUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, groupName);
   const u = await userByRefOrCreate(t, userRef);
   const role = opts.role === "admin" ? "admin" : "member";
-  const spinner = (0, import_ora28.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  const spinner = (0, import_ora29.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
-    spinner.succeed(`${import_chalk59.default.bold(label2(u))} added to ${import_chalk59.default.bold(g.name)} as ${role}.`);
+    spinner.succeed(`${import_chalk60.default.bold(label2(u))} added to ${import_chalk60.default.bold(g.name)} as ${role}.`);
   } catch (e) {
     spinner.fail("Add failed.");
     throw e;
@@ -16521,10 +16655,10 @@ async function runGroupAddUser(userRef, groupName, opts) {
 async function runGroupRemoveUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
-  const spinner = (0, import_ora28.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  const spinner = (0, import_ora29.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
-    spinner.succeed(`${import_chalk59.default.bold(label2(u))} removed from ${import_chalk59.default.bold(g.name)}.`);
+    spinner.succeed(`${import_chalk60.default.bold(label2(u))} removed from ${import_chalk60.default.bold(g.name)}.`);
   } catch (e) {
     spinner.fail("Remove failed.");
     throw e;
@@ -16533,10 +16667,10 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
 async function runGroupAddGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora28.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  const spinner = (0, import_ora29.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
-    spinner.succeed(`${import_chalk59.default.bold(child.name)} is now a subgroup of ${import_chalk59.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk60.default.bold(child.name)} is now a subgroup of ${import_chalk60.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Nest failed.");
     throw e;
@@ -16545,10 +16679,10 @@ async function runGroupAddGroup(childName, parentName, opts) {
 async function runGroupRemoveGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora28.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  const spinner = (0, import_ora29.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
-    spinner.succeed(`${import_chalk59.default.bold(child.name)} un-nested from ${import_chalk59.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk60.default.bold(child.name)} un-nested from ${import_chalk60.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Un-nest failed.");
     throw e;
@@ -16559,13 +16693,13 @@ async function runGroupUsers(opts) {
   const users = await listUsers(t);
   const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
   if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
-  console.log(import_chalk59.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
-  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk59.default.dim(u.abz_sub)}`);
-  if (!users.length) console.log(import_chalk59.default.dim("  no users yet"));
+  console.log(import_chalk60.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk60.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk60.default.dim("  no users yet"));
   const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
   if (fresh.length) {
-    console.log(import_chalk59.default.dim("Seen in traffic (not yet users):"));
-    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk59.default.dim(o.source_label ?? "")}`);
+    console.log(import_chalk60.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk60.default.dim(o.source_label ?? "")}`);
   }
 }
 
@@ -16575,8 +16709,8 @@ init_iam();
 init_admins();
 
 // src/commands/preapprove.ts
-var import_chalk60 = __toESM(require("chalk"));
-var import_ora29 = __toESM(require("ora"));
+var import_chalk61 = __toESM(require("chalk"));
+var import_ora30 = __toESM(require("ora"));
 init_preapproval();
 async function runPreapprove(who, opts) {
   const tenant2 = await resolveProducerTenant(opts.tenant);
@@ -16584,14 +16718,14 @@ async function runPreapprove(who, opts) {
     const rules = await listPreapprovalRules(tenant2);
     if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
     if (!rules.length) {
-      console.log(import_chalk60.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
-      console.log(import_chalk60.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      console.log(import_chalk61.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk61.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
       return;
     }
-    console.log(import_chalk60.default.dim(`Pre-approved for ${import_chalk60.default.bold(tenant2)}:`));
+    console.log(import_chalk61.default.dim(`Pre-approved for ${import_chalk61.default.bold(tenant2)}:`));
     for (const r of rules) {
-      const tag = r.kind === "domain" ? import_chalk60.default.cyan("@" + r.value + " (whole domain)") : r.value;
-      const grp = r.groups?.length ? import_chalk60.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      const tag = r.kind === "domain" ? import_chalk61.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk61.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
       console.log(`  ${tag}${grp}`);
     }
     return;
@@ -16600,19 +16734,19 @@ async function runPreapprove(who, opts) {
     throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
   }
   if (opts.remove) {
-    const spinner2 = (0, import_ora29.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const spinner2 = (0, import_ora30.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
-    if (removed) spinner2.succeed(`${import_chalk60.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
-    else spinner2.warn(`No pre-approval rule for ${import_chalk60.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    if (removed) spinner2.succeed(`${import_chalk61.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk61.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
-  const spinner = (0, import_ora29.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  const spinner = (0, import_ora30.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
-    spinner.succeed(`${import_chalk60.default.bold(what)} can now sign in to ${import_chalk60.default.bold(tenant2)}.`);
-    if (opts.group?.length) console.log(import_chalk60.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
-    console.log(import_chalk60.default.dim(`  See the full list:  apiblaze preapprove --list`));
+    spinner.succeed(`${import_chalk61.default.bold(what)} can now sign in to ${import_chalk61.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk61.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk61.default.dim(`  See the full list:  apiblaze preapprove --list`));
   } catch (err) {
     spinner.fail("Could not add the rule.");
     throw err;
@@ -16624,8 +16758,8 @@ init_apichat();
 init_llm();
 
 // src/commands/consumer.ts
-var import_chalk61 = __toESM(require("chalk"));
-var import_ora30 = __toESM(require("ora"));
+var import_chalk62 = __toESM(require("chalk"));
+var import_ora31 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_caller();
@@ -16648,7 +16782,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk61.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk62.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -16659,7 +16793,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk61.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk62.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -16671,24 +16805,24 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora30.default)("Finding the login app...").start();
+    const s2 = (0, import_ora31.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick3 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick3) {
-      console.error(import_chalk61.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk62.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick3.client_id ?? pick3.clientId;
   }
-  console.log(`${import_chalk61.default.cyan("\u2192")} Logging in to ${import_chalk61.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk62.default.cyan("\u2192")} Logging in to ${import_chalk62.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk61.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk61.default.bold(userCode)}
+  Open: ${import_chalk62.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk62.default.bold(userCode)}
 `);
-    console.log(import_chalk61.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk62.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -16703,7 +16837,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk61.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk62.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer2();
@@ -16716,28 +16850,28 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk61.default.cyan("Consumer")} ${import_chalk61.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk61.default.bold(fresh.tenant)}
+  console.log(`${import_chalk62.default.cyan("Consumer")} ${import_chalk62.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk62.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk61.default.bold("access_token")}  ${import_chalk61.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk62.default.bold("access_token")}  ${import_chalk62.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk61.default.bold("id_token")}      ${import_chalk61.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk62.default.bold("id_token")}      ${import_chalk62.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk61.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk62.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk61.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk62.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora30.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora31.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, withPage("/apikeys", null));
   if (list.status >= 400) {
     spinner.stop();
-    console.error(import_chalk61.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk61.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk62.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk62.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   let walkCreds = list.creds;
@@ -16766,16 +16900,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk61.default.yellow("No API keys yet."));
+    console.log(import_chalk62.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk61.default.green(clear) : import_chalk61.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk61.default.dim(`exp ${k.expires_at}`) : import_chalk61.default.dim("no expiry");
-      console.log(`  ${import_chalk61.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk61.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk62.default.green(clear) : import_chalk62.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk62.default.dim(`exp ${k.expires_at}`) : import_chalk62.default.dim("no expiry");
+      console.log(`  ${import_chalk62.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk62.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk61.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk62.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -16789,7 +16923,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora30.default)("Creating key...").start();
+  const s2 = (0, import_ora31.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -16797,13 +16931,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk61.default.green(key)}  ${import_chalk61.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk61.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk62.default.green(key)}  ${import_chalk62.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk62.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk62 = __toESM(require("chalk"));
-var import_ora31 = __toESM(require("ora"));
+var import_chalk63 = __toESM(require("chalk"));
+var import_ora32 = __toESM(require("ora"));
 var fs18 = __toESM(require("fs"));
 var path14 = __toESM(require("path"));
 init_admin();
@@ -16845,18 +16979,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs18.existsSync(path14.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk62.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk63.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs18.existsSync(path14.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora31.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora32.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk62.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk62.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk63.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk63.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -16999,7 +17133,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora31.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora32.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -17011,29 +17145,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk62.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk62.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk63.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk63.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk62.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk63.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk62.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk62.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk63.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk63.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk62.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk63.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk62.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk62.default.cyan("apiblaze login")}  then  ${import_chalk62.default.cyan("apiblaze claim")}   ${import_chalk62.default.dim("(no code needed here)")}`);
-  console.log(import_chalk62.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk63.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk63.default.cyan("apiblaze login")}  then  ${import_chalk63.default.cyan("apiblaze claim")}   ${import_chalk63.default.dim("(no code needed here)")}`);
+  console.log(import_chalk63.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path14.resolve(opts.dir ?? process.cwd());
   const detected2 = detectNextProject(root);
   if (!detected2.found) {
-    console.log(import_chalk62.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk63.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -17044,10 +17178,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk62.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk62.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk63.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk63.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk62.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk63.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -17056,7 +17190,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora31.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora32.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -17070,39 +17204,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk62.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk63.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk62.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk63.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk62.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk63.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected2.router);
-    if (inspectorPath) console.log(`  ${import_chalk62.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk63.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk62.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk62.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk62.default.bold("candidates")} \u2014 list them:  ${import_chalk62.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk62.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk63.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk63.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk63.default.bold("candidates")} \u2014 list them:  ${import_chalk63.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk63.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk62.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path14.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk62.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk63.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path14.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk63.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk62.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk62.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk62.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk63.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk63.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk63.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk62.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk62.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk63.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk63.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk63 = __toESM(require("chalk"));
-var import_ora32 = __toESM(require("ora"));
+var import_chalk64 = __toESM(require("chalk"));
+var import_ora33 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -17112,7 +17246,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk63.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk64.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -17130,30 +17264,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk63.default.bold(`
+  console.log(import_chalk64.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk63.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk63.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk63.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk63.default.bold(`
+  if (!routed.length) console.log(import_chalk64.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk64.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk64.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk64.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk63.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk64.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk63.default.yellow("\u25CB")} ${c.origin}  ${import_chalk63.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk64.default.yellow("\u25CB")} ${c.origin}  ${import_chalk64.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk63.default.dim(`
+    console.log(import_chalk64.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk63.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk64.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk63.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk64.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora32.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora33.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -17164,7 +17298,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora32.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora33.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -17181,7 +17315,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora32.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora33.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -17192,7 +17326,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora32.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora33.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -17203,7 +17337,7 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk71 = __toESM(require("chalk"));
+var import_chalk72 = __toESM(require("chalk"));
 init_auth();
 
 // src/lib/op-call.ts
@@ -17232,7 +17366,7 @@ async function opCall(call3) {
 }
 
 // src/commands/op-money.ts
-var import_chalk64 = __toESM(require("chalk"));
+var import_chalk65 = __toESM(require("chalk"));
 init_admin();
 init_types();
 var money2 = (cents2) => typeof cents2 === "number" ? `$${usdStr(cents2)}` : "\u2014";
@@ -17254,60 +17388,60 @@ async function opWalletList(opts) {
   const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list wallets" });
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
   const accounts = data?.accounts ?? [];
-  if (accounts.length === 0) return void console.log(import_chalk64.default.dim("No wallets."));
-  console.log(import_chalk64.default.dim(`
+  if (accounts.length === 0) return void console.log(import_chalk65.default.dim("No wallets."));
+  console.log(import_chalk65.default.dim(`
   ${"available".padStart(10)}  ${"in use".padStart(9)}  ${"grace".padStart(8)}  ${"status".padEnd(11)} ${"gen".padStart(3)}  wallet`));
   for (const a of accounts) {
-    const flags = [a.frozen ? import_chalk64.default.red("FROZEN") : "", a.closed ? import_chalk64.default.red("closed") : "", a.terms && a.terms !== "prepaid" ? import_chalk64.default.yellow(a.terms) : ""].filter(Boolean).join(" ");
-    const who = a.owner_email ? import_chalk64.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk64.default.dim(" \u2014 anon") : a.name ? import_chalk64.default.dim(` \u2014 ${a.name}`) : "";
+    const flags = [a.frozen ? import_chalk65.default.red("FROZEN") : "", a.closed ? import_chalk65.default.red("closed") : "", a.terms && a.terms !== "prepaid" ? import_chalk65.default.yellow(a.terms) : ""].filter(Boolean).join(" ");
+    const who = a.owner_email ? import_chalk65.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk65.default.dim(" \u2014 anon") : a.name ? import_chalk65.default.dim(` \u2014 ${a.name}`) : "";
     console.log(
-      `  ${import_chalk64.default.bold(money2(a.available_cents ?? a.balance_cents).padStart(10))}  ${money2(a.in_use_cents ?? 0).padStart(9)}  ${money2(a.grace_used_cents ?? 0).padStart(8)}  ${String(a.status ?? "").padEnd(11)} ${String(a.generation ?? "").padStart(3)}  ${a.walletId}${who}${flags ? " " + flags : ""}`
+      `  ${import_chalk65.default.bold(money2(a.available_cents ?? a.balance_cents).padStart(10))}  ${money2(a.in_use_cents ?? 0).padStart(9)}  ${money2(a.grace_used_cents ?? 0).padStart(8)}  ${String(a.status ?? "").padEnd(11)} ${String(a.generation ?? "").padStart(3)}  ${a.walletId}${who}${flags ? " " + flags : ""}`
     );
   }
-  if (data?.truncated) console.log(import_chalk64.default.yellow(`
+  if (data?.truncated) console.log(import_chalk65.default.yellow(`
   List truncated \u2014 inspect one wallet with: apiblaze op wallet inspect <wallet>`));
   console.log("");
 }
 async function opWalletInspect(ref, opts) {
-  if (!ref) return void console.log(import_chalk64.default.red("Which wallet?") + import_chalk64.default.cyan(" apiblaze op wallet inspect <wallet id | team id>"));
+  if (!ref) return void console.log(import_chalk65.default.red("Which wallet?") + import_chalk65.default.cyan(" apiblaze op wallet inspect <wallet id | team id>"));
   const ba = await resolveWalletId(ref);
   const w = await opCall({ method: "GET", path: `/operator/wallets/${encodeURIComponent(ba)}`, summary: `inspect wallet ${ba}` });
   if (opts.json) return void console.log(JSON.stringify(w, null, 2));
   const st = w?.state ?? {};
-  console.log(import_chalk64.default.bold(`
-  Wallet ${w?.billing_account_id ?? ba}`) + (ref !== ba ? import_chalk64.default.dim(`  (team ${ref})`) : ""));
-  console.log(`  ${"status".padEnd(16)} ${w?.status ?? "?"}${w?.frozen ? import_chalk64.default.red("  FROZEN") : ""}${w?.closed ? import_chalk64.default.red("  closed") : ""}${w?.terms && w.terms !== "prepaid" ? import_chalk64.default.yellow(`  ${w.terms}`) : ""}`);
-  console.log(`  ${"available".padEnd(16)} ${import_chalk64.default.bold(money2(w?.available_cents ?? w?.balance_cents ?? w?.balance))}`);
-  console.log(`  ${"in use".padEnd(16)} ${money2(w?.in_use_cents)}${import_chalk64.default.dim("  \u03A3 floats + budgets + reserves out at the shards")}`);
+  console.log(import_chalk65.default.bold(`
+  Wallet ${w?.billing_account_id ?? ba}`) + (ref !== ba ? import_chalk65.default.dim(`  (team ${ref})`) : ""));
+  console.log(`  ${"status".padEnd(16)} ${w?.status ?? "?"}${w?.frozen ? import_chalk65.default.red("  FROZEN") : ""}${w?.closed ? import_chalk65.default.red("  closed") : ""}${w?.terms && w.terms !== "prepaid" ? import_chalk65.default.yellow(`  ${w.terms}`) : ""}`);
+  console.log(`  ${"available".padEnd(16)} ${import_chalk65.default.bold(money2(w?.available_cents ?? w?.balance_cents ?? w?.balance))}`);
+  console.log(`  ${"in use".padEnd(16)} ${money2(w?.in_use_cents)}${import_chalk65.default.dim("  \u03A3 floats + budgets + reserves out at the shards")}`);
   console.log(`  ${"grace".padEnd(16)} ${money2(w?.grace_used_cents)} of ${money2(w?.grace_limit_cents)}`);
   console.log(`  ${"epoch / gen".padEnd(16)} ${st.epoch ?? "?"} / ${st.generation ?? w?.generation ?? "?"}`);
   const unsent = unsentLedgerEntries(st);
   const lastSend = lastLedgerSendAtMs(st);
-  console.log(`  ${"unsent ledger".padEnd(16)} ${unsent ?? "\u2014"} entries${import_chalk64.default.dim("  made by the wallet, not yet sent to the ledger")}`);
-  console.log(`  ${"last ledger send".padEnd(16)} ${lastSend ? new Date(lastSend).toISOString() : import_chalk64.default.dim("never")}`);
+  console.log(`  ${"unsent ledger".padEnd(16)} ${unsent ?? "\u2014"} entries${import_chalk65.default.dim("  made by the wallet, not yet sent to the ledger")}`);
+  console.log(`  ${"last ledger send".padEnd(16)} ${lastSend ? new Date(lastSend).toISOString() : import_chalk65.default.dim("never")}`);
   if (st.counters && typeof st.counters === "object") {
     const c = Object.entries(st.counters).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    if (c) console.log(import_chalk64.default.dim(`  counters         ${c}`));
+    if (c) console.log(import_chalk65.default.dim(`  counters         ${c}`));
   }
   const shards = st.shards ?? [];
   if (shards.length) {
-    console.log(import_chalk64.default.bold(`
+    console.log(import_chalk65.default.bold(`
   Shards (${shards.length})`));
-    console.log(import_chalk64.default.dim(`  ${"shard".padEnd(14)} ${"team".padEnd(26)} ${"float".padStart(9)} ${"budget".padStart(9)}  ${"acq/s".padStart(6)} ${"adm/s".padStart(6)}  expires`));
+    console.log(import_chalk65.default.dim(`  ${"shard".padEnd(14)} ${"team".padEnd(26)} ${"float".padStart(9)} ${"budget".padStart(9)}  ${"acq/s".padStart(6)} ${"adm/s".padStart(6)}  expires`));
     for (const s of shards) {
       const exp = s.expiresAtMs ? `${Math.max(0, Math.round((s.expiresAtMs - Date.now()) / 1e3))}s` : "\u2014";
       console.log(
-        `  ${String(s.shardId ?? "").slice(0, 14).padEnd(14)} ${String(s.teamId ?? "").slice(0, 26).padEnd(26)} ${String(s.floatUnits ?? 0).padStart(9)} ${String(s.budgetUnits ?? 0).padStart(9)}  ${String(s.acquiresPerS ?? 0).padStart(6)} ${String(s.admittedPerS ?? 0).padStart(6)}  ${exp}${s.degraded ? import_chalk64.default.red("  degraded") : ""}`
+        `  ${String(s.shardId ?? "").slice(0, 14).padEnd(14)} ${String(s.teamId ?? "").slice(0, 26).padEnd(26)} ${String(s.floatUnits ?? 0).padStart(9)} ${String(s.budgetUnits ?? 0).padStart(9)}  ${String(s.acquiresPerS ?? 0).padStart(6)} ${String(s.admittedPerS ?? 0).padStart(6)}  ${exp}${s.degraded ? import_chalk65.default.red("  degraded") : ""}`
       );
     }
-    console.log(import_chalk64.default.dim("  float/budget in ledger units (10,000 per cent)"));
+    console.log(import_chalk65.default.dim("  float/budget in ledger units (10,000 per cent)"));
   } else {
-    console.log(import_chalk64.default.dim("\n  No live shards (no traffic in the last window)."));
+    console.log(import_chalk65.default.dim("\n  No live shards (no traffic in the last window)."));
   }
   const teams = w?.teams ?? [];
-  if (teams.length) console.log(import_chalk64.default.dim(`
+  if (teams.length) console.log(import_chalk65.default.dim(`
   Teams on this wallet: ${teams.map((t) => typeof t === "string" ? t : t.team_id ?? t.teamId ?? JSON.stringify(t)).join(", ")}`));
-  console.log(import_chalk64.default.dim(`
+  console.log(import_chalk65.default.dim(`
   Act on it (dashboard only): ${walletPage(ba)}
 `));
 }
@@ -17336,11 +17470,11 @@ function opWalletMutation(action2, ref, opts) {
   const target2 = ref ?? "<wallet>";
   const url = ref && !isTeamId(ref) ? walletPage(ref) : `${DASHBOARD_BASE10}/operator/wallets`;
   if (opts.json) return void console.log(JSON.stringify({ action: action2, wallet: ref ?? null, dashboard_only: true, url, requires: need ?? "a reason" }));
-  console.log(import_chalk64.default.yellow(`
+  console.log(import_chalk65.default.yellow(`
   \`op wallet ${action2}\` is dashboard-only \u2014 it writes an operator_audit row with YOUR reason before touching the root.`));
-  console.log(`  ${import_chalk64.default.cyan(url)}`);
-  console.log(import_chalk64.default.dim(`  ${target2}: needs ${need ?? "a reason (required)"}`));
-  if (ref && isTeamId(ref)) console.log(import_chalk64.default.dim(`  (that is a team id \u2014 \`apiblaze op wallet inspect ${ref}\` prints its wallet id and page)`));
+  console.log(`  ${import_chalk65.default.cyan(url)}`);
+  console.log(import_chalk65.default.dim(`  ${target2}: needs ${need ?? "a reason (required)"}`));
+  if (ref && isTeamId(ref)) console.log(import_chalk65.default.dim(`  (that is a team id \u2014 \`apiblaze op wallet inspect ${ref}\` prints its wallet id and page)`));
   console.log("");
 }
 async function opMoneyExposure(opts) {
@@ -17348,24 +17482,24 @@ async function opMoneyExposure(opts) {
   const data = await opCall({ method: "GET", path: `/operator/exposure${qs}`, summary: "money exposure" });
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
   const m = data?.money;
-  console.log(import_chalk64.default.bold("\n  Exposure") + import_chalk64.default.dim(`  source: ${data?.source ?? "?"}${data?.source === "ae" ? " (Analytics Engine fallback \u2014 approximate; the root did not answer)" : " (the root \u2014 exact)"}`));
-  if (data?.money_error) console.log(import_chalk64.default.yellow(`  root error: ${data.money_error}`));
+  console.log(import_chalk65.default.bold("\n  Exposure") + import_chalk65.default.dim(`  source: ${data?.source ?? "?"}${data?.source === "ae" ? " (Analytics Engine fallback \u2014 approximate; the root did not answer)" : " (the root \u2014 exact)"}`));
+  if (data?.money_error) console.log(import_chalk65.default.yellow(`  root error: ${data.money_error}`));
   if (m) {
-    console.log(`  ${"in use".padEnd(14)} ${import_chalk64.default.bold(money2(m.total_in_use_cents))}${import_chalk64.default.dim("  customer money out at the shards, pre-paid (\u2264 0.15 \xD7 unallocated)")}`);
-    console.log(`  ${"grace used".padEnd(14)} ${money2(m.total_grace_used_cents)}${import_chalk64.default.dim("  platform loss bound: \u03A3 grace + chargebacks")}`);
+    console.log(`  ${"in use".padEnd(14)} ${import_chalk65.default.bold(money2(m.total_in_use_cents))}${import_chalk65.default.dim("  customer money out at the shards, pre-paid (\u2264 0.15 \xD7 unallocated)")}`);
+    console.log(`  ${"grace used".padEnd(14)} ${money2(m.total_grace_used_cents)}${import_chalk65.default.dim("  platform loss bound: \u03A3 grace + chargebacks")}`);
     const wallets = m.wallets ?? [];
     if (wallets.length) {
-      console.log(import_chalk64.default.dim(`
+      console.log(import_chalk65.default.dim(`
   ${"in use".padStart(10)}  ${"grace".padStart(8)}  wallet`));
       for (const w of wallets.slice(0, 40)) {
-        console.log(`  ${money2(w.in_use_cents).padStart(10)}  ${money2(w.grace_used_cents ?? (typeof w.grace_used_units === "number" ? w.grace_used_units / 1e4 : void 0)).padStart(8)}  ${w.billing_account_id ?? w.walletId}${w.frozen ? import_chalk64.default.red("  FROZEN") : ""}`);
+        console.log(`  ${money2(w.in_use_cents).padStart(10)}  ${money2(w.grace_used_cents ?? (typeof w.grace_used_units === "number" ? w.grace_used_units / 1e4 : void 0)).padStart(8)}  ${w.billing_account_id ?? w.walletId}${w.frozen ? import_chalk65.default.red("  FROZEN") : ""}`);
       }
-      if (wallets.length > 40) console.log(import_chalk64.default.dim(`  \u2026 ${wallets.length - 40} more (--json)`));
+      if (wallets.length > 40) console.log(import_chalk65.default.dim(`  \u2026 ${wallets.length - 40} more (--json)`));
     }
   }
   const ae = data?.ae;
   if (ae && typeof ae === "object") {
-    console.log(import_chalk64.default.bold("\n  Analytics Engine view") + import_chalk64.default.dim("  admission by gate source, last window"));
+    console.log(import_chalk65.default.bold("\n  Analytics Engine view") + import_chalk65.default.dim("  admission by gate source, last window"));
     for (const [k, v] of Object.entries(ae)) console.log(`  ${k.padEnd(18)} ${typeof v === "object" ? JSON.stringify(v) : String(v)}`);
   }
   console.log("");
@@ -17379,24 +17513,24 @@ async function opIncidentStatus(opts) {
   const data = await opCall({ method: "GET", path: "/operator/incident/degraded-mode", summary: "degraded-mode switch" });
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
   const mode = String(data?.mode ?? "allow");
-  const colour = mode === "allow" ? import_chalk64.default.green : mode === "deny" ? import_chalk64.default.red : import_chalk64.default.yellow;
-  console.log(import_chalk64.default.bold("\n  Degraded mode: ") + colour(mode) + import_chalk64.default.dim(`  \u2014 ${MODE_WORDS[mode] ?? ""}`));
-  if (data?.reason) console.log(import_chalk64.default.dim(`  reason: ${data.reason}`));
-  if (data?.actor || data?.at) console.log(import_chalk64.default.dim(`  set by ${data?.actor ?? "?"}${data?.at ? ` at ${data.at}` : ""}`));
-  console.log(import_chalk64.default.dim(`
+  const colour = mode === "allow" ? import_chalk65.default.green : mode === "deny" ? import_chalk65.default.red : import_chalk65.default.yellow;
+  console.log(import_chalk65.default.bold("\n  Degraded mode: ") + colour(mode) + import_chalk65.default.dim(`  \u2014 ${MODE_WORDS[mode] ?? ""}`));
+  if (data?.reason) console.log(import_chalk65.default.dim(`  reason: ${data.reason}`));
+  if (data?.actor || data?.at) console.log(import_chalk65.default.dim(`  set by ${data?.actor ?? "?"}${data?.at ? ` at ${data.at}` : ""}`));
+  console.log(import_chalk65.default.dim(`
   Change it (dashboard only, reason required): ${incidentPage()}
 `));
 }
 function opIncidentMutation(mode, opts) {
   if (opts.json) return void console.log(JSON.stringify({ action: `incident ${mode}`, dashboard_only: true, url: incidentPage(), requires: "a reason (required); the switch is written to operator_audit, then KV" }));
-  console.log(import_chalk64.default.yellow(`
+  console.log(import_chalk65.default.yellow(`
   \`op incident ${mode}\` is dashboard-only \u2014 ${MODE_WORDS[mode] ?? mode}.`));
-  console.log(`  ${import_chalk64.default.cyan(incidentPage())}`);
-  console.log(import_chalk64.default.dim("  Needs a reason (required); it is written to operator_audit before the switch flips. Check with: apiblaze op incident status\n"));
+  console.log(`  ${import_chalk65.default.cyan(incidentPage())}`);
+  console.log(import_chalk65.default.dim("  Needs a reason (required); it is written to operator_audit before the switch flips. Check with: apiblaze op incident status\n"));
 }
 
 // src/commands/op-ceiling.ts
-var import_chalk65 = __toESM(require("chalk"));
+var import_chalk66 = __toESM(require("chalk"));
 init_types();
 var STATUSES = ["pending", "decided", "all"];
 var rpsStr = (n) => typeof n === "number" && Number.isFinite(n) ? n.toLocaleString("en-US") : "\u2014";
@@ -17410,7 +17544,7 @@ function ageStr(iso, now = Date.now()) {
   return `${Math.floor(s / 86400)}d`;
 }
 var trunc = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
-var STATUS_COLOUR = { pending: import_chalk65.default.yellow, approved: import_chalk65.default.green, denied: import_chalk65.default.red, expired: import_chalk65.default.dim };
+var STATUS_COLOUR = { pending: import_chalk66.default.yellow, approved: import_chalk66.default.green, denied: import_chalk66.default.red, expired: import_chalk66.default.dim };
 function printDecideError(err, id, opts) {
   if (!(err instanceof ApiError) || ![400, 404, 409].includes(err.status)) return false;
   const body = err.body ?? {};
@@ -17423,12 +17557,12 @@ function printDecideError(err, id, opts) {
   if (err.status === 409) {
     const d = body.request;
     const by = d?.decided_by ? ` by ${d.decided_by}${d.decided_at ? ` at ${d.decided_at}` : ""}` : "";
-    console.log(import_chalk65.default.red(`  Ceiling request ${id} was not changed: ${why}${by}.`));
-    console.log(import_chalk65.default.dim("  See the decision: apiblaze op ceiling list --status decided"));
+    console.log(import_chalk66.default.red(`  Ceiling request ${id} was not changed: ${why}${by}.`));
+    console.log(import_chalk66.default.dim("  See the decision: apiblaze op ceiling list --status decided"));
   } else if (err.status === 404) {
-    console.log(import_chalk65.default.red(`  Not found: ${why.replace(/^Not found:\s*/i, "")}.`) + import_chalk65.default.dim("  (ids: apiblaze op ceiling list)"));
+    console.log(import_chalk66.default.red(`  Not found: ${why.replace(/^Not found:\s*/i, "")}.`) + import_chalk66.default.dim("  (ids: apiblaze op ceiling list)"));
   } else {
-    console.log(import_chalk65.default.red(`  Ceiling request ${id} not decided: ${why}.`));
+    console.log(import_chalk66.default.red(`  Ceiling request ${id} not decided: ${why}.`));
   }
   return true;
 }
@@ -17436,31 +17570,31 @@ async function opCeilingList(opts) {
   const status2 = String(opts.status ?? "pending").trim().toLowerCase();
   if (!STATUSES.includes(status2)) {
     process.exitCode = 1;
-    return void console.log(import_chalk65.default.red(`--status must be one of ${STATUSES.join(" | ")}.`));
+    return void console.log(import_chalk66.default.red(`--status must be one of ${STATUSES.join(" | ")}.`));
   }
   const data = await opCall(
     { method: "GET", path: `/operator/ceiling-requests?status=${status2}`, summary: `${status2} ceiling requests` }
   );
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
   const rows = data?.requests ?? [];
-  console.log(import_chalk65.default.bold("\n  Maximum-rate requests") + import_chalk65.default.dim(`  ${status2} \xB7 all consumers together, per project`));
-  if (!rows.length) return void console.log(import_chalk65.default.dim(`  No ${status2 === "all" ? "" : `${status2} `}requests.
+  console.log(import_chalk66.default.bold("\n  Maximum-rate requests") + import_chalk66.default.dim(`  ${status2} \xB7 all consumers together, per project`));
+  if (!rows.length) return void console.log(import_chalk66.default.dim(`  No ${status2 === "all" ? "" : `${status2} `}requests.
 `));
-  console.log(import_chalk65.default.dim(`  ${"id".padEnd(10)}  ${"project/version".padEnd(26)}  ${"team".padEnd(16)}  ${"current \u2192 requested req/s".padEnd(25)}  ${"age".padStart(4)}  ${"requested by".padEnd(24)}  ${"status".padEnd(8)}  use case`));
+  console.log(import_chalk66.default.dim(`  ${"id".padEnd(10)}  ${"project/version".padEnd(26)}  ${"team".padEnd(16)}  ${"current \u2192 requested req/s".padEnd(25)}  ${"age".padStart(4)}  ${"requested by".padEnd(24)}  ${"status".padEnd(8)}  use case`));
   for (const r of rows) {
     const rate = `${rpsStr(r.current_ceiling_rps)} \u2192 ${rpsStr(r.requested_rps)}`;
-    const granted = r.status === "approved" && typeof r.granted_rps === "number" && r.granted_rps !== r.requested_rps ? import_chalk65.default.dim(` (granted ${rpsStr(r.granted_rps)})`) : "";
+    const granted = r.status === "approved" && typeof r.granted_rps === "number" && r.granted_rps !== r.requested_rps ? import_chalk66.default.dim(` (granted ${rpsStr(r.granted_rps)})`) : "";
     const colour = STATUS_COLOUR[r.status] ?? ((s) => s);
     console.log(
-      `  ${trunc(String(r.id), 10).padEnd(10)}  ${trunc(`${r.project_id}/${r.api_version}`, 26).padEnd(26)}  ${trunc(r.team_id ?? "\u2014", 16).padEnd(16)}  ${rate.padEnd(25)}  ${ageStr(r.created_at).padStart(4)}  ${trunc(r.requested_by ?? "\u2014", 24).padEnd(24)}  ${colour(r.status.padEnd(8))}  ${import_chalk65.default.dim(trunc((r.use_case ?? "").replace(/\s+/g, " "), 48))}${granted}`
+      `  ${trunc(String(r.id), 10).padEnd(10)}  ${trunc(`${r.project_id}/${r.api_version}`, 26).padEnd(26)}  ${trunc(r.team_id ?? "\u2014", 16).padEnd(16)}  ${rate.padEnd(25)}  ${ageStr(r.created_at).padStart(4)}  ${trunc(r.requested_by ?? "\u2014", 24).padEnd(24)}  ${colour(r.status.padEnd(8))}  ${import_chalk66.default.dim(trunc((r.use_case ?? "").replace(/\s+/g, " "), 48))}${granted}`
     );
     if (r.status !== "pending" && (r.decided_by || r.decision_note)) {
-      console.log(import_chalk65.default.dim(`  ${"".padEnd(10)}  ${r.decided_by ?? "?"}${r.decided_at ? ` \xB7 ${ageStr(r.decided_at)} ago` : ""}${r.decision_note ? ` \xB7 ${trunc(r.decision_note, 80)}` : ""}`));
+      console.log(import_chalk66.default.dim(`  ${"".padEnd(10)}  ${r.decided_by ?? "?"}${r.decided_at ? ` \xB7 ${ageStr(r.decided_at)} ago` : ""}${r.decision_note ? ` \xB7 ${trunc(r.decision_note, 80)}` : ""}`));
     }
   }
   if (status2 === "pending") {
     const presets = (data?.presets_rps ?? []).map(rpsStr).join(" / ");
-    console.log(import_chalk65.default.dim(`
+    console.log(import_chalk66.default.dim(`
   Decide: apiblaze op ceiling approve <id> [--rps N${presets ? ` e.g. ${presets}` : ""}] [--note "\u2026"]  \xB7  apiblaze op ceiling deny <id> --note "why"`));
   }
   console.log("");
@@ -17468,23 +17602,23 @@ async function opCeilingList(opts) {
 async function opCeilingDecide(decision, id, opts) {
   if (!id) {
     process.exitCode = 1;
-    return void console.log(import_chalk65.default.red("Which request?") + import_chalk65.default.cyan(` apiblaze op ceiling ${decision} <id>${decision === "deny" ? ' --note "why"' : ' [--rps N] [--note "\u2026"]'}`) + import_chalk65.default.dim("  (ids: apiblaze op ceiling list)"));
+    return void console.log(import_chalk66.default.red("Which request?") + import_chalk66.default.cyan(` apiblaze op ceiling ${decision} <id>${decision === "deny" ? ' --note "why"' : ' [--rps N] [--note "\u2026"]'}`) + import_chalk66.default.dim("  (ids: apiblaze op ceiling list)"));
   }
   const note = typeof opts.note === "string" ? opts.note.trim() : "";
   if (decision === "deny" && !note) {
     process.exitCode = 1;
-    return void console.log(import_chalk65.default.red("A denial needs a reason the producer will read:") + import_chalk65.default.cyan(` apiblaze op ceiling deny ${id} --note "why"`));
+    return void console.log(import_chalk66.default.red("A denial needs a reason the producer will read:") + import_chalk66.default.cyan(` apiblaze op ceiling deny ${id} --note "why"`));
   }
   let rps;
   if (opts.rps !== void 0 && opts.rps !== null && opts.rps !== "") {
     if (decision === "deny") {
       process.exitCode = 1;
-      return void console.log(import_chalk65.default.red("--rps only applies to approve."));
+      return void console.log(import_chalk66.default.red("--rps only applies to approve."));
     }
     rps = Number(String(opts.rps).replace(/[,_]/g, ""));
     if (!Number.isInteger(rps) || rps <= 0) {
       process.exitCode = 1;
-      return void console.log(import_chalk65.default.red("--rps must be a whole number of requests per second (e.g. 5000)."));
+      return void console.log(import_chalk66.default.red("--rps must be a whole number of requests per second (e.g. 5000)."));
     }
   }
   const body = { decision };
@@ -17509,19 +17643,19 @@ async function opCeilingDecide(decision, id, opts) {
   const where = r ? `${r.project_id}/${r.api_version}` : `request ${id}`;
   if (decision === "approve") {
     const to = res?.limits?.ceilingRps ?? res?.request?.granted_rps ?? rps ?? r?.requested_rps;
-    console.log(import_chalk65.default.green(`
+    console.log(import_chalk66.default.green(`
   project ${where}: maximum rate ${rpsStr(from)} \u2192 ${rpsStr(to)} req/s`));
-    if (r?.requested_rps !== void 0 && to !== void 0 && to !== r.requested_rps) console.log(import_chalk65.default.dim(`  (asked for ${rpsStr(r.requested_rps)} req/s)`));
+    if (r?.requested_rps !== void 0 && to !== void 0 && to !== r.requested_rps) console.log(import_chalk66.default.dim(`  (asked for ${rpsStr(r.requested_rps)} req/s)`));
   } else {
-    console.log(import_chalk65.default.yellow(`
-  project ${where}: request for ${rpsStr(r?.requested_rps)} req/s denied`) + (typeof from === "number" ? import_chalk65.default.dim(` \u2014 maximum rate stays ${rpsStr(from)} req/s`) : ""));
+    console.log(import_chalk66.default.yellow(`
+  project ${where}: request for ${rpsStr(r?.requested_rps)} req/s denied`) + (typeof from === "number" ? import_chalk66.default.dim(` \u2014 maximum rate stays ${rpsStr(from)} req/s`) : ""));
   }
-  if (note) console.log(import_chalk65.default.dim(`  note: ${note}`));
+  if (note) console.log(import_chalk66.default.dim(`  note: ${note}`));
   console.log("");
 }
 
 // src/commands/op-ledger.ts
-var import_chalk66 = __toESM(require("chalk"));
+var import_chalk67 = __toESM(require("chalk"));
 init_admin();
 init_types();
 var UNITS_PER_CENT = 1e4;
@@ -17548,7 +17682,7 @@ function parseLimit(raw, max) {
 function fail6(opts, msg) {
   process.exitCode = 1;
   if (opts.json) return void console.log(JSON.stringify({ ok: false, error: msg }));
-  console.log(import_chalk66.default.red(msg));
+  console.log(import_chalk67.default.red(msg));
 }
 function printLedgerError(err, what, opts) {
   if (!(err instanceof ApiError) || ![400, 403, 404, 500, 502, 503].includes(err.status)) return false;
@@ -17559,9 +17693,9 @@ function printLedgerError(err, what, opts) {
     return true;
   }
   const code = body.error && body.error !== err.message ? ` ${body.error}` : "";
-  console.log(import_chalk66.default.red(`  ${what} failed (${err.status}${code}): ${body.details ?? err.message}`));
-  if (err.status === 503 && body.error === "money_unreachable") console.log(import_chalk66.default.dim("  The money worker did not answer \u2014 retry in a minute; nothing was changed."));
-  if (err.status === 503 && body.error === "audit_unavailable") console.log(import_chalk66.default.dim("  The operator_audit row could not be written, so the action was refused."));
+  console.log(import_chalk67.default.red(`  ${what} failed (${err.status}${code}): ${body.details ?? err.message}`));
+  if (err.status === 503 && body.error === "money_unreachable") console.log(import_chalk67.default.dim("  The money worker did not answer \u2014 retry in a minute; nothing was changed."));
+  if (err.status === 503 && body.error === "audit_unavailable") console.log(import_chalk67.default.dim("  The operator_audit row could not be written, so the action was refused."));
   return true;
 }
 async function call(opts, what, req) {
@@ -17574,33 +17708,33 @@ async function call(opts, what, req) {
 }
 function renderLedger2(data, opts = {}) {
   const out = [];
-  out.push(import_chalk66.default.bold(`
-  Ledger \u2014 ${data.billing_account_id}`) + import_chalk66.default.dim(`  money_ledger, oldest first${opts.since ? ` since ${opts.since}` : ""}${opts.kind ? ` \xB7 kind=${opts.kind}` : ""}`));
+  out.push(import_chalk67.default.bold(`
+  Ledger \u2014 ${data.billing_account_id}`) + import_chalk67.default.dim(`  money_ledger, oldest first${opts.since ? ` since ${opts.since}` : ""}${opts.kind ? ` \xB7 kind=${opts.kind}` : ""}`));
   const h = data.head;
   if (h) {
-    const gap = h.contiguous_to < h.head_seq ? import_chalk66.default.yellow(`  GAP: ${h.head_seq - h.contiguous_to} seq missing after ${h.contiguous_to}`) : import_chalk66.default.green("  contiguous");
+    const gap = h.contiguous_to < h.head_seq ? import_chalk67.default.yellow(`  GAP: ${h.head_seq - h.contiguous_to} seq missing after ${h.contiguous_to}`) : import_chalk67.default.green("  contiguous");
     out.push(`  head  gen ${h.generation} \xB7 seq ${h.head_seq} \xB7 balance ${money3(cents(h.head_balance))} \xB7 at ${ts(h.head_ts)} \xB7 contiguous to ${h.contiguous_to}${gap}`);
   } else {
-    out.push(import_chalk66.default.dim("  head  none \u2014 Neon has no row for this wallet yet"));
+    out.push(import_chalk67.default.dim("  head  none \u2014 Neon has no row for this wallet yet"));
   }
   const rows = data.rows ?? [];
   if (!rows.length) {
-    out.push(import_chalk66.default.dim("  No rows."));
+    out.push(import_chalk67.default.dim("  No rows."));
     return out;
   }
-  out.push(import_chalk66.default.dim(`  ${"gen".padStart(3)} ${"seq".padStart(13)}  ${"ts".padEnd(19)}  ${"class".padEnd(5)}  ${"kind".padEnd(18)}  ${"amount".padStart(12)}  ${"balance after".padStart(13)}  flag`));
+  out.push(import_chalk67.default.dim(`  ${"gen".padStart(3)} ${"seq".padStart(13)}  ${"ts".padEnd(19)}  ${"class".padEnd(5)}  ${"kind".padEnd(18)}  ${"amount".padStart(12)}  ${"balance after".padStart(13)}  flag`));
   for (const r of rows) {
     const c = typeof r.units_cents === "number" ? r.units_cents : cents(r.units);
     const amt = signedMoney2(c);
     const bal = typeof r.balance_after_cents === "number" ? r.balance_after_cents : cents(r.balance_after);
-    const flag = r.flag ? import_chalk66.default.red(r.flag) : "";
-    const n = r.class === "flow" && (r.count ?? 0) > 1 ? import_chalk66.default.dim(` \xD7${r.count}`) : "";
+    const flag = r.flag ? import_chalk67.default.red(r.flag) : "";
+    const n = r.class === "flow" && (r.count ?? 0) > 1 ? import_chalk67.default.dim(` \xD7${r.count}`) : "";
     out.push(
-      `  ${String(r.generation).padStart(3)} ${seqRange(r).padStart(13)}  ${ts(r.ts_to).padEnd(19)}  ${r.class.padEnd(5)}  ${trunc2(String(r.kind ?? ""), 18).padEnd(18)}  ${(typeof c === "number" && c < 0 ? import_chalk66.default.red : import_chalk66.default.green)(amt.padStart(12))}  ${money3(bal).padStart(13)}  ${flag}${n}`
+      `  ${String(r.generation).padStart(3)} ${seqRange(r).padStart(13)}  ${ts(r.ts_to).padEnd(19)}  ${r.class.padEnd(5)}  ${trunc2(String(r.kind ?? ""), 18).padEnd(18)}  ${(typeof c === "number" && c < 0 ? import_chalk67.default.red : import_chalk67.default.green)(amt.padStart(12))}  ${money3(bal).padStart(13)}  ${flag}${n}`
     );
   }
-  out.push(import_chalk66.default.bold(`  ${"\u03A3".padStart(17)}  ${"".padEnd(19)}  ${"".padEnd(5)}  ${"".padEnd(18)}  ${signedMoney2(cents(data.sum_units)).padStart(12)}`));
-  if (data.partial) out.push(import_chalk66.default.yellow(`  More than ${data.limit} rows in the window \u2014 narrow --since / --kind or raise --limit (\u2264 1000) before trusting the sum.`));
+  out.push(import_chalk67.default.bold(`  ${"\u03A3".padStart(17)}  ${"".padEnd(19)}  ${"".padEnd(5)}  ${"".padEnd(18)}  ${signedMoney2(cents(data.sum_units)).padStart(12)}`));
+  if (data.partial) out.push(import_chalk67.default.yellow(`  More than ${data.limit} rows in the window \u2014 narrow --since / --kind or raise --limit (\u2264 1000) before trusting the sum.`));
   return out;
 }
 async function opLedgerShow(ref, opts) {
@@ -17625,25 +17759,25 @@ async function opLedgerLag(opts) {
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
   const newest = data.newest_received_at;
   const ageS = newest ? Math.max(0, Math.round((Date.now() - Date.parse(newest)) / 1e3)) : null;
-  console.log(import_chalk66.default.bold("\n  Ledger lag") + import_chalk66.default.dim("  money_ledger health (gaps, flags, quarantine)"));
-  console.log(`  ${"newest row".padEnd(16)} ${newest ? `${ts(newest)} (${ageS}s ago)` : import_chalk66.default.dim("none")}`);
-  console.log(`  ${"gaps".padEnd(16)} ${(data.gap_count ? import_chalk66.default.yellow : import_chalk66.default.green)(String(data.gap_count))}${import_chalk66.default.dim("  wallets whose contiguous_to < head_seq")}`);
-  console.log(`  ${"flagged 24h".padEnd(16)} ${(data.flagged_24h?.count ? import_chalk66.default.red : import_chalk66.default.green)(String(data.flagged_24h?.count ?? 0))}${import_chalk66.default.dim("  mismatch flags on rows received in the last 24 h")}`);
-  console.log(`  ${"quarantine 24h".padEnd(16)} ${(data.quarantine_24h ? import_chalk66.default.red : import_chalk66.default.green)(String(data.quarantine_24h))}${import_chalk66.default.dim("  apiblaze op ledger quarantine")}`);
+  console.log(import_chalk67.default.bold("\n  Ledger lag") + import_chalk67.default.dim("  money_ledger health (gaps, flags, quarantine)"));
+  console.log(`  ${"newest row".padEnd(16)} ${newest ? `${ts(newest)} (${ageS}s ago)` : import_chalk67.default.dim("none")}`);
+  console.log(`  ${"gaps".padEnd(16)} ${(data.gap_count ? import_chalk67.default.yellow : import_chalk67.default.green)(String(data.gap_count))}${import_chalk67.default.dim("  wallets whose contiguous_to < head_seq")}`);
+  console.log(`  ${"flagged 24h".padEnd(16)} ${(data.flagged_24h?.count ? import_chalk67.default.red : import_chalk67.default.green)(String(data.flagged_24h?.count ?? 0))}${import_chalk67.default.dim("  mismatch flags on rows received in the last 24 h")}`);
+  console.log(`  ${"quarantine 24h".padEnd(16)} ${(data.quarantine_24h ? import_chalk67.default.red : import_chalk67.default.green)(String(data.quarantine_24h))}${import_chalk67.default.dim("  apiblaze op ledger quarantine")}`);
   if (data.gaps?.length) {
-    console.log(import_chalk66.default.bold("\n  Gaps") + import_chalk66.default.dim("  (biggest first)"));
-    console.log(import_chalk66.default.dim(`  ${"missing".padStart(7)}  ${"gen".padStart(3)}  ${"contig \u2192 head".padEnd(17)}  ${"head at".padEnd(19)}  wallet`));
+    console.log(import_chalk67.default.bold("\n  Gaps") + import_chalk67.default.dim("  (biggest first)"));
+    console.log(import_chalk67.default.dim(`  ${"missing".padStart(7)}  ${"gen".padStart(3)}  ${"contig \u2192 head".padEnd(17)}  ${"head at".padEnd(19)}  wallet`));
     for (const g of data.gaps.slice(0, 40)) {
-      console.log(`  ${import_chalk66.default.yellow(String(g.missing).padStart(7))}  ${String(g.generation).padStart(3)}  ${`${g.contiguous_to} \u2192 ${g.head_seq}`.padEnd(17)}  ${ts(g.head_ts).padEnd(19)}  ${g.billing_account_id}`);
+      console.log(`  ${import_chalk67.default.yellow(String(g.missing).padStart(7))}  ${String(g.generation).padStart(3)}  ${`${g.contiguous_to} \u2192 ${g.head_seq}`.padEnd(17)}  ${ts(g.head_ts).padEnd(19)}  ${g.billing_account_id}`);
     }
-    if (data.gaps.length > 40) console.log(import_chalk66.default.dim(`  \u2026 ${data.gaps.length - 40} more (--json)`));
-    console.log(import_chalk66.default.dim("  A gap the queue is not about to fill (> 30 min): apiblaze op ledger cut <wallet>, or backfill (\xA76.4)."));
+    if (data.gaps.length > 40) console.log(import_chalk67.default.dim(`  \u2026 ${data.gaps.length - 40} more (--json)`));
+    console.log(import_chalk67.default.dim("  A gap the queue is not about to fill (> 30 min): apiblaze op ledger cut <wallet>, or backfill (\xA76.4)."));
   }
   const flagged = data.flagged_24h?.rows ?? [];
   if (flagged.length) {
-    console.log(import_chalk66.default.bold("\n  Flagged rows (24 h)"));
-    for (const f of flagged.slice(0, 40)) console.log(`  ${ts(f.received_at)}  gen ${f.generation} seq ${seqRange(f).padEnd(11)}  ${trunc2(f.kind, 14).padEnd(14)}  ${import_chalk66.default.red(f.flag)}  ${f.billing_account_id}`);
-    if (flagged.length > 40) console.log(import_chalk66.default.dim(`  \u2026 ${flagged.length - 40} more (--json)`));
+    console.log(import_chalk67.default.bold("\n  Flagged rows (24 h)"));
+    for (const f of flagged.slice(0, 40)) console.log(`  ${ts(f.received_at)}  gen ${f.generation} seq ${seqRange(f).padEnd(11)}  ${trunc2(f.kind, 14).padEnd(14)}  ${import_chalk67.default.red(f.flag)}  ${f.billing_account_id}`);
+    if (flagged.length > 40) console.log(import_chalk67.default.dim(`  \u2026 ${flagged.length - 40} more (--json)`));
   }
   console.log("");
 }
@@ -17656,14 +17790,14 @@ async function opLedgerQuarantine(opts) {
   const data = await call(opts, "Quarantine read", { method: "GET", path: `/operator/ledger/quarantine${qs.toString() ? `?${qs}` : ""}`, summary: "ledger quarantine" });
   if (!data) return;
   if (opts.json) return void console.log(JSON.stringify(data, null, 2));
-  console.log(import_chalk66.default.bold("\n  Ledger quarantine") + import_chalk66.default.dim(`  newest first${data.ba ? ` \xB7 ${data.ba}` : ""} \xB7 ${data.count_24h} in the last 24 h`));
+  console.log(import_chalk67.default.bold("\n  Ledger quarantine") + import_chalk67.default.dim(`  newest first${data.ba ? ` \xB7 ${data.ba}` : ""} \xB7 ${data.count_24h} in the last 24 h`));
   const rows = data.rows ?? [];
-  if (!rows.length) return void console.log(import_chalk66.default.green("  Empty.\n"));
-  console.log(import_chalk66.default.dim(`  ${"received".padEnd(19)}  ${"reason".padEnd(10)}  ${"gen".padStart(3)} ${"seq".padStart(13)}  wallet`));
+  if (!rows.length) return void console.log(import_chalk67.default.green("  Empty.\n"));
+  console.log(import_chalk67.default.dim(`  ${"received".padEnd(19)}  ${"reason".padEnd(10)}  ${"gen".padStart(3)} ${"seq".padStart(13)}  wallet`));
   for (const r of rows) {
-    console.log(`  ${ts(r.received_at).padEnd(19)}  ${import_chalk66.default.red(trunc2(String(r.reason), 10).padEnd(10))}  ${String(r.generation).padStart(3)} ${seqRange(r).padStart(13)}  ${r.billing_account_id}${r.existing ? import_chalk66.default.dim("  (differs from the stored row)") : ""}`);
+    console.log(`  ${ts(r.received_at).padEnd(19)}  ${import_chalk67.default.red(trunc2(String(r.reason), 10).padEnd(10))}  ${String(r.generation).padStart(3)} ${seqRange(r).padStart(13)}  ${r.billing_account_id}${r.existing ? import_chalk67.default.dim("  (differs from the stored row)") : ""}`);
   }
-  console.log(import_chalk66.default.dim("\n  Both versions: --json. The fix is always wallet-side (code fix, and an `adjust` if money was wrong) \u2014 never an edit of Neon (\xA76.6).\n"));
+  console.log(import_chalk67.default.dim("\n  Both versions: --json. The fix is always wallet-side (code fix, and an `adjust` if money was wrong) \u2014 never an edit of Neon (\xA76.6).\n"));
 }
 async function opLedgerCut(ref, opts) {
   if (!ref) return fail6(opts, 'Which wallet? apiblaze op ledger cut <wallet id | team id> [--reason "\u2026"]');
@@ -17674,9 +17808,9 @@ async function opLedgerCut(ref, opts) {
   const res = await call(opts, "Ledger cut", { method: "POST", path: "/operator/ledger/cut", body, summary: `cut ledger for ${ba}` });
   if (!res) return;
   if (opts.json) return void console.log(JSON.stringify(res, null, 2));
-  console.log(import_chalk66.default.green(`
+  console.log(import_chalk67.default.green(`
   ${res.billing_account_id ?? ba}: cut and sent ${res.rows ?? 0} row${res.rows === 1 ? "" : "s"}.`));
-  console.log(import_chalk66.default.dim(`  They land in Neon within seconds: apiblaze op ledger show ${ba}
+  console.log(import_chalk67.default.dim(`  They land in Neon within seconds: apiblaze op ledger show ${ba}
 `));
 }
 async function opLedgerBackfill(opts) {
@@ -17692,33 +17826,33 @@ async function opLedgerBackfill(opts) {
   const res = await call(opts, "Ledger backfill", { method: "POST", path: "/operator/ledger/backfill", body, summary: `ledger backfill since ${new Date(sinceMs).toISOString()}` });
   if (!res) return;
   if (opts.json) return void console.log(JSON.stringify(res, null, 2));
-  console.log(import_chalk66.default.bold(`
-  Ledger backfill since ${new Date(res.since_ms ?? sinceMs).toISOString()}`) + import_chalk66.default.dim("  verbatim re-send of stored cuts, never a re-cut"));
+  console.log(import_chalk67.default.bold(`
+  Ledger backfill since ${new Date(res.since_ms ?? sinceMs).toISOString()}`) + import_chalk67.default.dim("  verbatim re-send of stored cuts, never a re-cut"));
   console.log(`  ${"wallets checked".padEnd(16)} ${res.wallets_checked}`);
   console.log(`  ${"resent".padEnd(16)} ${res.resent_rows} row${res.resent_rows === 1 ? "" : "s"} across ${res.resent_wallets} wallet${res.resent_wallets === 1 ? "" : "s"}`);
   console.log(`  ${"in sync".padEnd(16)} ${res.in_sync}`);
-  console.log(`  ${"uncut".padEnd(16)} ${res.uncut}${import_chalk66.default.dim("  entries not cut yet \u2014 reported, not cut (op ledger cut <wallet>)")}`);
-  console.log(`  ${"neon ahead".padEnd(16)} ${(res.neon_ahead ? import_chalk66.default.yellow : (s) => s)(String(res.neon_ahead))}`);
-  console.log(`  ${"unrecoverable".padEnd(16)} ${(res.unrecoverable ? import_chalk66.default.red : (s) => s)(String(res.unrecoverable))}${import_chalk66.default.dim("  the wallet no longer keeps the cuts after Neon's head (> 30 d)")}`);
-  console.log(`  ${"errors".padEnd(16)} ${(res.errors ? import_chalk66.default.red : (s) => s)(String(res.errors))}`);
+  console.log(`  ${"uncut".padEnd(16)} ${res.uncut}${import_chalk67.default.dim("  entries not cut yet \u2014 reported, not cut (op ledger cut <wallet>)")}`);
+  console.log(`  ${"neon ahead".padEnd(16)} ${(res.neon_ahead ? import_chalk67.default.yellow : (s) => s)(String(res.neon_ahead))}`);
+  console.log(`  ${"unrecoverable".padEnd(16)} ${(res.unrecoverable ? import_chalk67.default.red : (s) => s)(String(res.unrecoverable))}${import_chalk67.default.dim("  the wallet no longer keeps the cuts after Neon's head (> 30 d)")}`);
+  console.log(`  ${"errors".padEnd(16)} ${(res.errors ? import_chalk67.default.red : (s) => s)(String(res.errors))}`);
   const notable = (res.results ?? []).filter((r) => r.action !== "in_sync");
   if (notable.length) {
-    console.log(import_chalk66.default.dim(`
+    console.log(import_chalk67.default.dim(`
   ${"action".padEnd(10)}  ${"wallet gen/seq/cut".padEnd(20)}  ${"neon gen/head/contig".padEnd(20)}  wallet`));
     for (const r of notable.slice(0, 60)) {
       const w = r.wallet ? `${r.wallet.generation}/${r.wallet.seq}/${r.wallet.cut_to}` : "\u2014";
       const n = r.neon ? `${r.neon.generation}/${r.neon.head_seq}/${r.neon.contiguous_to}` : "\u2014";
-      const colour = r.action === "error" || r.unrecoverable ? import_chalk66.default.red : r.action === "resent" ? import_chalk66.default.green : import_chalk66.default.yellow;
+      const colour = r.action === "error" || r.unrecoverable ? import_chalk67.default.red : r.action === "resent" ? import_chalk67.default.green : import_chalk67.default.yellow;
       const note = [r.resent !== void 0 ? `resent ${r.resent}` : "", r.unrecoverable ? `UNRECOVERABLE (oldest kept seq ${r.oldest_kept_seq ?? "?"})` : "", r.error ?? ""].filter(Boolean).join(" \xB7 ");
-      console.log(`  ${colour(r.action.padEnd(10))}  ${w.padEnd(20)}  ${n.padEnd(20)}  ${r.billing_account_id}${note ? import_chalk66.default.dim(`  ${note}`) : ""}`);
+      console.log(`  ${colour(r.action.padEnd(10))}  ${w.padEnd(20)}  ${n.padEnd(20)}  ${r.billing_account_id}${note ? import_chalk67.default.dim(`  ${note}`) : ""}`);
     }
-    if (notable.length > 60) console.log(import_chalk66.default.dim(`  \u2026 ${notable.length - 60} more (--json)`));
+    if (notable.length > 60) console.log(import_chalk67.default.dim(`  \u2026 ${notable.length - 60} more (--json)`));
   }
   console.log("");
 }
 
 // src/commands/op-test.ts
-var import_chalk67 = __toESM(require("chalk"));
+var import_chalk68 = __toESM(require("chalk"));
 init_auth();
 init_types();
 var DASHBOARD_BASE11 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
@@ -17743,10 +17877,10 @@ async function scrubSandboxKeys(timeoutS = 150) {
   try {
     const r = await runnerCall({ action: "gut", id: TEARDOWN_GUT_ID }, timeoutS);
     const first = r.results?.[0]?.detail ?? r.error ?? "";
-    log(import_chalk67.default.dim(`teardown: ${first || (r.ok ? "sandbox fixture keys scrubbed" : "scrub reported a problem")}`));
+    log(import_chalk68.default.dim(`teardown: ${first || (r.ok ? "sandbox fixture keys scrubbed" : "scrub reported a problem")}`));
     return r.ok;
   } catch (e) {
-    log(import_chalk67.default.dim(`teardown: sandbox key scrub skipped (${e instanceof Error ? e.message : String(e)}) \u2014 leftovers expire within 14 days; scripts/purge-test-keys.mjs reaps them`));
+    log(import_chalk68.default.dim(`teardown: sandbox key scrub skipped (${e instanceof Error ? e.message : String(e)}) \u2014 leftovers expire within 14 days; scripts/purge-test-keys.mjs reaps them`));
     return false;
   }
 }
@@ -17768,23 +17902,23 @@ async function runOpTest(o = {}) {
   const guts = o.skipGuts ? [] : listing.guts.filter((g) => g.id !== TEARDOWN_GUT_ID && matches(g.id, void 0, { ...o, group: void 0 }));
   const total = specs.length + guts.length;
   if (total === 0) {
-    log(import_chalk67.default.yellow("nothing matched"));
+    log(import_chalk68.default.yellow("nothing matched"));
     process.exitCode = 2;
     return;
   }
-  log(import_chalk67.default.bold(`apiblaze op test \u2014 ${specs.length} spec(s) + ${guts.length} gut check(s) on sandbox ${listing.sandbox_team}`));
+  log(import_chalk68.default.bold(`apiblaze op test \u2014 ${specs.length} spec(s) + ${guts.length} gut check(s) on sandbox ${listing.sandbox_team}`));
   const results = [];
   let failed = 0;
   const started = Date.now();
   const record = (r) => {
     results.push(r);
     if (!r.ok) failed += 1;
-    const mark = r.ok ? import_chalk67.default.green("PASS") : import_chalk67.default.red("FAIL");
+    const mark = r.ok ? import_chalk68.default.green("PASS") : import_chalk68.default.red("FAIL");
     log(`[${mark}] ${r.id} \u2014 ${r.label} (${ms(r.duration_ms)})`);
     if (!r.ok) {
-      if (r.kind === "spec") for (const c of r.cases.filter((c2) => !c2.ok)) log(import_chalk67.default.red(`   \u2717 ${c.name}: ${c.detail}`));
-      else if (r.error) log(import_chalk67.default.red(`   \u2717 ${r.error}`));
-      else for (const x of r.results.filter((x2) => x2 && x2.ok === false)) log(import_chalk67.default.red(`   \u2717 ${x.name ?? ""}: ${x.detail ?? JSON.stringify(x)}`));
+      if (r.kind === "spec") for (const c of r.cases.filter((c2) => !c2.ok)) log(import_chalk68.default.red(`   \u2717 ${c.name}: ${c.detail}`));
+      else if (r.error) log(import_chalk68.default.red(`   \u2717 ${r.error}`));
+      else for (const x of r.results.filter((x2) => x2 && x2.ok === false)) log(import_chalk68.default.red(`   \u2717 ${x.name ?? ""}: ${x.detail ?? JSON.stringify(x)}`));
     }
   };
   try {
@@ -17815,13 +17949,13 @@ async function runOpTest(o = {}) {
   }
   const summary = { ran: results.length, passed: results.length - failed, failed, duration_ms: Date.now() - started, sandbox_team: listing.sandbox_team };
   log("");
-  log(failed ? import_chalk67.default.red(`${summary.passed}/${summary.ran} passed, ${failed} failed (${ms(summary.duration_ms)})`) : import_chalk67.default.green(`${summary.passed}/${summary.ran} passed (${ms(summary.duration_ms)})`));
+  log(failed ? import_chalk68.default.red(`${summary.passed}/${summary.ran} passed, ${failed} failed (${ms(summary.duration_ms)})`) : import_chalk68.default.green(`${summary.passed}/${summary.ran} passed (${ms(summary.duration_ms)})`));
   if (o.json) process.stdout.write(JSON.stringify({ ...summary, results }, null, 2) + "\n");
   if (failed) process.exitCode = 1;
 }
 
 // src/commands/op-consumer.ts
-var import_chalk68 = __toESM(require("chalk"));
+var import_chalk69 = __toESM(require("chalk"));
 init_consumer_auth();
 var SANDBOX_TENANT = "portalteststenant";
 var SANDBOX_PROXY = "portaltestproxypreapproved@2.7.0";
@@ -17864,9 +17998,9 @@ async function runOpConsumer(o = {}) {
   const creds = loadConsumer();
   const done = (r) => {
     const out = { kind: "consumer", id: "consumer-door", label: "Consumer door: the stored consumer token opens its tenant's OAuth-door proxy", duration_ms: Date.now() - t0, ...r };
-    const mark = out.skipped ? import_chalk68.default.yellow("SKIP") : out.ok ? import_chalk68.default.green("PASS") : import_chalk68.default.red("FAIL");
+    const mark = out.skipped ? import_chalk69.default.yellow("SKIP") : out.ok ? import_chalk69.default.green("PASS") : import_chalk69.default.red("FAIL");
     log2(`[${mark}] ${out.id} \u2014 ${out.label}${out.tenant ? ` (tenant ${out.tenant})` : ""}${out.url ? ` \u2192 ${out.url}` : ""}`);
-    for (const c of out.cases) if (!c.ok || out.skipped) log2((c.ok ? import_chalk68.default.dim : import_chalk68.default.red)(`   ${c.ok ? "ok  " : "\u2717"} ${c.name}: ${c.detail}`));
+    for (const c of out.cases) if (!c.ok || out.skipped) log2((c.ok ? import_chalk69.default.dim : import_chalk69.default.red)(`   ${c.ok ? "ok  " : "\u2717"} ${c.name}: ${c.detail}`));
     if (o.json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
     if (!out.ok && !out.skipped) process.exitCode = 1;
     if (out.skipped) process.exitCode = 2;
@@ -17906,7 +18040,7 @@ async function runOpConsumer(o = {}) {
 }
 
 // src/commands/op-perf.ts
-var import_chalk69 = __toESM(require("chalk"));
+var import_chalk70 = __toESM(require("chalk"));
 var RPS_DEFAULT = 100;
 var RPS_CAP = 300;
 var SECONDS_DEFAULT = 60;
@@ -18090,10 +18224,10 @@ async function readGateway(proxy, sent, signal) {
     }
     const left = deadline - Date.now();
     if (left <= 0) {
-      log3(import_chalk69.default.yellow(`  gateway: not available \u2014 Analytics Engine had ${lastSeen}/${sent} rows for ${proxy} after ${GATEWAY_WAIT_MS / 1e3}s${lastErr ? ` (last error: ${lastErr})` : ""}`));
+      log3(import_chalk70.default.yellow(`  gateway: not available \u2014 Analytics Engine had ${lastSeen}/${sent} rows for ${proxy} after ${GATEWAY_WAIT_MS / 1e3}s${lastErr ? ` (last error: ${lastErr})` : ""}`));
       return null;
     }
-    log3(import_chalk69.default.dim(`  waiting for the latency ledger\u2026 ${lastSeen}/${sent} rows for ${proxy}${lastErr ? ` (${lastErr})` : ""}`));
+    log3(import_chalk70.default.dim(`  waiting for the latency ledger\u2026 ${lastSeen}/${sent} rows for ${proxy}${lastErr ? ` (${lastErr})` : ""}`));
     await sleep(Math.min(GATEWAY_POLL_MS, left), signal);
   }
 }
@@ -18102,7 +18236,7 @@ async function runOpPerf(o = {}) {
   const thresholds = thresholdsFrom(o);
   const ctrl = new AbortController();
   const onSigint = () => {
-    log3(import_chalk69.default.yellow("\ninterrupted \u2014 stopping the load and tearing down the fixture"));
+    log3(import_chalk70.default.yellow("\ninterrupted \u2014 stopping the load and tearing down the fixture"));
     ctrl.abort();
   };
   process.once("SIGINT", onSigint);
@@ -18111,7 +18245,7 @@ async function runOpPerf(o = {}) {
     if (!o.key) throw new Error("--url needs --key (the fixture proxy's API key)");
     fixture = { url: o.url, key: o.key, proxy: proxyFromUrl(o.url), provisioned: false };
   } else {
-    log3(import_chalk69.default.dim("provisioning the perf fixture through the runner\u2026"));
+    log3(import_chalk70.default.dim("provisioning the perf fixture through the runner\u2026"));
     const f = await runnerCall({ action: "perf-fixture" }, 120);
     if (!f?.url || !f?.key) throw new Error(`perf-fixture returned no url/key: ${JSON.stringify(f).slice(0, 200)}`);
     fixture = { url: f.url, key: f.key, proxy: f.proxy || proxyFromUrl(f.url), team: f.team, provisioned: true };
@@ -18119,7 +18253,7 @@ async function runOpPerf(o = {}) {
   try {
     const total = Math.round(rps * seconds);
     const intervalMs = 1e3 / rps;
-    log3(import_chalk69.default.bold(`apiblaze op test --perf \u2014 ${rps} rps \xD7 ${seconds}s (${total} requests) against ${fixture.url}${fixture.team ? ` (sandbox ${fixture.team})` : ""}`));
+    log3(import_chalk70.default.bold(`apiblaze op test --perf \u2014 ${rps} rps \xD7 ${seconds}s (${total} requests) against ${fixture.url}${fixture.team ? ` (sandbox ${fixture.team})` : ""}`));
     const samples = [];
     const inflight = /* @__PURE__ */ new Set();
     let fired = 0;
@@ -18127,7 +18261,7 @@ async function runOpPerf(o = {}) {
     const progress = setInterval(() => {
       const m = summarize(samples, Date.now() - t0);
       const secs = (Date.now() - t0) / 1e3;
-      log3(import_chalk69.default.dim(`  ${Math.round(secs)}s  sent ${fired}  ok ${m.ok}  err ${m.errors}  p50 ${fmtMs(m.p50)}  p95 ${fmtMs(m.p95)}  (${(fired / secs).toFixed(1)} rps)`));
+      log3(import_chalk70.default.dim(`  ${Math.round(secs)}s  sent ${fired}  ok ${m.ok}  err ${m.errors}  p50 ${fmtMs(m.p50)}  p95 ${fmtMs(m.p95)}  (${(fired / secs).toFixed(1)} rps)`));
     }, PROGRESS_EVERY_MS);
     const { sent, elapsedMs } = await schedule({
       total,
@@ -18141,21 +18275,21 @@ async function runOpPerf(o = {}) {
       }
     });
     clearInterval(progress);
-    if (inflight.size) log3(import_chalk69.default.dim(`  load sent; waiting for ${inflight.size} in-flight response(s) (\u2264 ${REQUEST_TIMEOUT_MS / 1e3}s)\u2026`));
+    if (inflight.size) log3(import_chalk70.default.dim(`  load sent; waiting for ${inflight.size} in-flight response(s) (\u2264 ${REQUEST_TIMEOUT_MS / 1e3}s)\u2026`));
     await Promise.all([...inflight]);
     const client = summarize(samples, elapsedMs);
     log3("");
-    log3(`  ${import_chalk69.default.bold("client ")}  p50 ${fmtMs(client.p50).padStart(7)}  p95 ${fmtMs(client.p95).padStart(7)}  p99 ${fmtMs(client.p99).padStart(7)}   errors ${client.error_rate_pct.toFixed(2)}% (${client.errors}/${client.sent}: ${client.non2xx} non-2xx, ${client.timeouts} timeouts, ${client.network} network)   achieved ${client.rps_achieved} rps of ${rps}`);
+    log3(`  ${import_chalk70.default.bold("client ")}  p50 ${fmtMs(client.p50).padStart(7)}  p95 ${fmtMs(client.p95).padStart(7)}  p99 ${fmtMs(client.p99).padStart(7)}   errors ${client.error_rate_pct.toFixed(2)}% (${client.errors}/${client.sent}: ${client.non2xx} non-2xx, ${client.timeouts} timeouts, ${client.network} network)   achieved ${client.rps_achieved} rps of ${rps}`);
     const gateway = ctrl.signal.aborted ? null : await readGateway(fixture.proxy, sent, ctrl.signal);
     if (gateway) {
       const extras = [
         gateway.kv_per_req !== void 0 ? `kv/req ${gateway.kv_per_req}` : "",
         gateway.redis_per_req !== void 0 ? `redis/req ${gateway.redis_per_req}` : ""
       ].filter(Boolean).join("  ");
-      log3(`  ${import_chalk69.default.bold("gateway")}  p50 ${fmtMs(gateway.p50).padStart(7)}  p95 ${fmtMs(gateway.p95).padStart(7)}${gateway.p99 !== void 0 ? `  p99 ${fmtMs(gateway.p99).padStart(7)}` : ""}   ${import_chalk69.default.dim(`(${gateway.requests} ledger rows${extras ? `, ${extras}` : ""})`)}`);
-      for (const b of gateway.blame ?? []) log3(import_chalk69.default.dim(`           ${(b.share * 100).toFixed(1).padStart(5)}%  p95 ${fmtMs(b.p95_ms).padStart(6)}  ${b.feature} \u2192 ${b.dep}`));
+      log3(`  ${import_chalk70.default.bold("gateway")}  p50 ${fmtMs(gateway.p50).padStart(7)}  p95 ${fmtMs(gateway.p95).padStart(7)}${gateway.p99 !== void 0 ? `  p99 ${fmtMs(gateway.p99).padStart(7)}` : ""}   ${import_chalk70.default.dim(`(${gateway.requests} ledger rows${extras ? `, ${extras}` : ""})`)}`);
+      for (const b of gateway.blame ?? []) log3(import_chalk70.default.dim(`           ${(b.share * 100).toFixed(1).padStart(5)}%  p95 ${fmtMs(b.p95_ms).padStart(6)}  ${b.feature} \u2192 ${b.dep}`));
     } else {
-      log3(`  ${import_chalk69.default.bold("gateway")}  ${import_chalk69.default.yellow("not available")} ${import_chalk69.default.dim("(gateway thresholds not evaluated)")}`);
+      log3(`  ${import_chalk70.default.bold("gateway")}  ${import_chalk70.default.yellow("not available")} ${import_chalk70.default.dim("(gateway thresholds not evaluated)")}`);
     }
     const breaches = evaluate(client, gateway, thresholds);
     const aborted = ctrl.signal.aborted;
@@ -18163,7 +18297,7 @@ async function runOpPerf(o = {}) {
     log3("");
     const row = (metric, value, limit, unit) => {
       const hit = breaches.find((b) => b.metric === metric);
-      log3(`[${hit ? import_chalk69.default.red("FAIL") : import_chalk69.default.green("PASS")}] ${metric.padEnd(11)} ${String(value)}${unit} ${hit ? ">" : "\u2264"} ${limit}${unit}`);
+      log3(`[${hit ? import_chalk70.default.red("FAIL") : import_chalk70.default.green("PASS")}] ${metric.padEnd(11)} ${String(value)}${unit} ${hit ? ">" : "\u2264"} ${limit}${unit}`);
     };
     row("client_p50", client.p50, thresholds.p50_ms, "ms");
     row("client_p95", client.p95, thresholds.p95_ms, "ms");
@@ -18172,12 +18306,12 @@ async function runOpPerf(o = {}) {
       row("gateway_p50", gateway.p50, thresholds.gateway_p50_ms, "ms");
       row("gateway_p95", gateway.p95, thresholds.gateway_p95_ms, "ms");
     } else {
-      log3(`[${import_chalk69.default.yellow("SKIP")}] gateway_p50 / gateway_p95 \u2014 ledger rows not available`);
+      log3(`[${import_chalk70.default.yellow("SKIP")}] gateway_p50 / gateway_p95 \u2014 ledger rows not available`);
     }
     log3("");
-    if (aborted) log3(import_chalk69.default.red(`FAIL \u2014 interrupted after ${sent}/${total} requests`));
-    else if (ok) log3(import_chalk69.default.green(`PASS \u2014 ${client.sent} requests at ${client.rps_achieved} rps, no threshold breached`));
-    else log3(import_chalk69.default.red(`FAIL \u2014 ${breaches.length} threshold(s) breached: ${breaches.map((b) => `${b.metric} ${b.value} > ${b.limit}`).join(", ")}`));
+    if (aborted) log3(import_chalk70.default.red(`FAIL \u2014 interrupted after ${sent}/${total} requests`));
+    else if (ok) log3(import_chalk70.default.green(`PASS \u2014 ${client.sent} requests at ${client.rps_achieved} rps, no threshold breached`));
+    else log3(import_chalk70.default.red(`FAIL \u2014 ${breaches.length} threshold(s) breached: ${breaches.map((b) => `${b.metric} ${b.value} > ${b.limit}`).join(", ")}`));
     if (o.json) {
       const doc = {
         kind: "perf",
@@ -18215,9 +18349,9 @@ async function runOpPerf(o = {}) {
     if (fixture.provisioned) {
       try {
         await runnerCall({ action: "perf-teardown", proxy: fixture.proxy }, 120);
-        log3(import_chalk69.default.dim(`fixture ${fixture.proxy} torn down`));
+        log3(import_chalk70.default.dim(`fixture ${fixture.proxy} torn down`));
       } catch (e) {
-        log3(import_chalk69.default.red(`teardown of ${fixture.proxy} failed: ${e instanceof Error ? e.message : String(e)} \u2014 run \`apiblaze op residue\` / clean the sandbox`));
+        log3(import_chalk70.default.red(`teardown of ${fixture.proxy} failed: ${e instanceof Error ? e.message : String(e)} \u2014 run \`apiblaze op residue\` / clean the sandbox`));
         process.exitCode = 1;
       }
       await scrubSandboxKeys(120);
@@ -18267,79 +18401,79 @@ var OP_COMMANDS = [
 function renderOpCommands() {
   const width = Math.max(...OP_COMMANDS.map((c) => c.cmd.length)) + 10;
   const lines = OP_COMMANDS.map((c) => {
-    const left = `  ${import_chalk71.default.cyan(`apiblaze ${c.cmd}`)}`;
+    const left = `  ${import_chalk72.default.cyan(`apiblaze ${c.cmd}`)}`;
     const pad = " ".repeat(Math.max(1, width - c.cmd.length));
-    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk71.default.dim(`(${c.extra})`) : ""}`;
+    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk72.default.dim(`(${c.extra})`) : ""}`;
   });
   return [
-    import_chalk71.default.bold("Operator commands"),
+    import_chalk72.default.bold("Operator commands"),
     ...lines,
     "",
-    import_chalk71.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
-    import_chalk71.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
-    import_chalk71.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
+    import_chalk72.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
+    import_chalk72.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
+    import_chalk72.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
     "",
-    import_chalk71.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
-    import_chalk71.default.dim("  in the repo. Wallet and incident MUTATIONS are dashboard-only (/operator/wallets/<id>,"),
-    import_chalk71.default.dim("  /operator/incident) \u2014 they need a typed reason and an audit row. Billing conformance"),
-    import_chalk71.default.dim("  (every door metered, 1 request = 1 charge) runs inside `op test`. Operator dashboards"),
-    import_chalk71.default.dim("  (dlq, thresholds, limits, pricing, agent-spend, teams, tests, leak-detection,"),
-    import_chalk71.default.dim("  lifecycle) live at /operator/* in the app.")
+    import_chalk72.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
+    import_chalk72.default.dim("  in the repo. Wallet and incident MUTATIONS are dashboard-only (/operator/wallets/<id>,"),
+    import_chalk72.default.dim("  /operator/incident) \u2014 they need a typed reason and an audit row. Billing conformance"),
+    import_chalk72.default.dim("  (every door metered, 1 request = 1 charge) runs inside `op test`. Operator dashboards"),
+    import_chalk72.default.dim("  (dlq, thresholds, limits, pricing, agent-spend, teams, tests, leak-detection,"),
+    import_chalk72.default.dim("  lifecycle) live at /operator/* in the app.")
   ].join("\n");
 }
 function printResidue(report, applied) {
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk71.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk71.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  console.log(import_chalk72.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk72.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk71.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk72.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk71.default.yellow(s.store_id)} ${import_chalk71.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk72.default.yellow(s.store_id)} ${import_chalk72.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk71.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk72.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk71.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk72.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk71.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk72.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk71.default.yellow(s.store_id)} ${import_chalk71.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk72.default.yellow(s.store_id)} ${import_chalk72.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk71.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk72.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk71.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk72.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk71.default.red(`    error: ${e}`));
-  console.log(import_chalk71.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk72.default.red(`    error: ${e}`));
+  console.log(import_chalk72.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk71.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk71.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk71.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk72.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk72.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk72.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk71.default.green(`    no ghost tuples ${import_chalk71.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk72.default.green(`    no ghost tuples ${import_chalk72.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk71.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk72.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk71.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk72.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk71.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk72.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk71.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk72.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}, view, arg) {
   if (!loadCredentials()) {
-    console.log(import_chalk71.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk72.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk71.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk72.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
@@ -18408,11 +18542,11 @@ async function runOp(sub, opts = {}, view, arg) {
       }
       if (opts.json) return void console.log(JSON.stringify(out, null, 2));
       console.log("");
-      console.log(`  Minimum CLI version:   ${import_chalk71.default.bold(out.min_version)}${out.min_version === "0.0.0" ? import_chalk71.default.dim("  (no minimum)") : ""}`);
-      console.log(`  Refuse unversioned:    ${out.reject_unversioned ? import_chalk71.default.yellow("yes \u2014 CLIs released before 2026-09-27 get a 426 (cheap refusals; they keep retrying)") : "no"}`);
-      console.log(`  Message:               ${out.message ?? import_chalk71.default.dim("(default)")}`);
-      if (out.updated_at) console.log(import_chalk71.default.dim(`  Updated ${out.updated_at}${out.updated_by ? ` by ${out.updated_by}` : ""}`));
-      console.log(import_chalk71.default.dim("  Takes effect within ~1 minute on the CLI lane; running `dev` sessions re-check every 10 minutes."));
+      console.log(`  Minimum CLI version:   ${import_chalk72.default.bold(out.min_version)}${out.min_version === "0.0.0" ? import_chalk72.default.dim("  (no minimum)") : ""}`);
+      console.log(`  Refuse unversioned:    ${out.reject_unversioned ? import_chalk72.default.yellow("yes \u2014 CLIs released before 2026-09-27 get a 426 (cheap refusals; they keep retrying)") : "no"}`);
+      console.log(`  Message:               ${out.message ?? import_chalk72.default.dim("(default)")}`);
+      if (out.updated_at) console.log(import_chalk72.default.dim(`  Updated ${out.updated_at}${out.updated_by ? ` by ${out.updated_by}` : ""}`));
+      console.log(import_chalk72.default.dim("  Takes effect within ~1 minute on the CLI lane; running `dev` sessions re-check every 10 minutes."));
       console.log("");
       return;
     }
@@ -18430,17 +18564,17 @@ async function runOp(sub, opts = {}, view, arg) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nFga + nGhost + nSide === 0) {
-        console.log(import_chalk71.default.green("Nothing to sweep."));
+        console.log(import_chalk72.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline3 = await import("readline/promises");
         const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk71.default.red(`Delete ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk72.default.red(`Delete ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk71.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk72.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -18450,15 +18584,15 @@ async function runOp(sub, opts = {}, view, arg) {
     case "mark": {
       const label3 = (view ?? "").trim();
       if (!label3) {
-        console.log(import_chalk71.default.red("Give the change a name:") + import_chalk71.default.cyan(' apiblaze op mark "cached tenant count"'));
+        console.log(import_chalk72.default.red("Give the change a name:") + import_chalk72.default.cyan(' apiblaze op mark "cached tenant count"'));
         return;
       }
       const res = await opCall({ method: "POST", path: "/operator/latency/mark", body: { label: label3 }, summary: "record change marker" });
       const ts2 = new Date(res?.marker?.ts ?? Date.now()).toISOString();
-      console.log(import_chalk71.default.green(`
-  Marked: `) + import_chalk71.default.bold(label3));
-      console.log(import_chalk71.default.dim(`  ${ts2}`));
-      console.log(import_chalk71.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk71.default.cyan("apiblaze op latency compare") + "\n");
+      console.log(import_chalk72.default.green(`
+  Marked: `) + import_chalk72.default.bold(label3));
+      console.log(import_chalk72.default.dim(`  ${ts2}`));
+      console.log(import_chalk72.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk72.default.cyan("apiblaze op latency compare") + "\n");
       return;
     }
     // ── MONEY (specs/TQC §11 "Operator console") — commands/op-money.ts ────
@@ -18469,14 +18603,14 @@ async function runOp(sub, opts = {}, view, arg) {
       if (which === "list") return void await opWalletList(opts);
       if (which === "inspect") return void await opWalletInspect(arg, opts);
       if (which in WALLET_MUTATIONS) return void opWalletMutation(which, arg, opts);
-      return void console.log(import_chalk71.default.red(`Unknown: apiblaze op wallet ${which}. Use list | inspect <wallet> | ${Object.keys(WALLET_MUTATIONS).join(" | ")}.`));
+      return void console.log(import_chalk72.default.red(`Unknown: apiblaze op wallet ${which}. Use list | inspect <wallet> | ${Object.keys(WALLET_MUTATIONS).join(" | ")}.`));
     }
     case "money": {
       const which = (view ?? "").trim().toLowerCase();
       if (which === "exposure") return void await opMoneyExposure(opts);
       if (which === "journal") return void await opLedgerShow(arg, opts);
       process.exitCode = 1;
-      return void console.log(import_chalk71.default.red(`Unknown: apiblaze op money ${which}. Use exposure; the money ledger is`) + import_chalk71.default.cyan(" apiblaze op ledger show <wallet> | lag") + import_chalk71.default.red("."));
+      return void console.log(import_chalk72.default.red(`Unknown: apiblaze op money ${which}. Use exposure; the money ledger is`) + import_chalk72.default.cyan(" apiblaze op ledger show <wallet> | lag") + import_chalk72.default.red("."));
     }
     // ── MONEY LEDGER (specs/noreconciliations.MD §6/§7) — commands/op-ledger.ts ──
     case "ledger": {
@@ -18487,20 +18621,20 @@ async function runOp(sub, opts = {}, view, arg) {
       if (which === "cut") return void await opLedgerCut(arg, opts);
       if (which === "backfill") return void await opLedgerBackfill(opts);
       process.exitCode = 1;
-      return void console.log(import_chalk71.default.red(`Unknown: apiblaze op ledger ${which}. Use show <wallet> | lag | quarantine | cut <wallet> | backfill --since <ISO|ms>.`));
+      return void console.log(import_chalk72.default.red(`Unknown: apiblaze op ledger ${which}. Use show <wallet> | lag | quarantine | cut <wallet> | backfill --since <ISO|ms>.`));
     }
     // ── MAXIMUM RATE (project ceiling) requests — commands/op-ceiling.ts ──
     case "ceiling": {
       const which = (view ?? "list").trim().toLowerCase();
       if (which === "list") return void await opCeilingList(opts);
       if (which === "approve" || which === "deny") return void await opCeilingDecide(which, arg, opts);
-      return void console.log(import_chalk71.default.red(`Unknown: apiblaze op ceiling ${which}. Use list | approve <id> | deny <id> --note "why".`));
+      return void console.log(import_chalk72.default.red(`Unknown: apiblaze op ceiling ${which}. Use list | approve <id> | deny <id> --note "why".`));
     }
     case "incident": {
       const which = (view ?? "status").trim().toLowerCase();
       if (which === "status" || which === "degraded-mode") return void await opIncidentStatus(opts);
       if (which === "allow" || which === "deny" || which === "extend") return void opIncidentMutation(which, opts);
-      return void console.log(import_chalk71.default.red(`Unknown: apiblaze op incident ${which}. Use status | allow | deny | extend.`));
+      return void console.log(import_chalk72.default.red(`Unknown: apiblaze op incident ${which}. Use status | allow | deny | extend.`));
     }
     // ── LATENCY (specs/latency/ §7.4) ─────────────────────────────────────
     // The blame table first: level 1 (which feature) and level 2 (what inside
@@ -18550,29 +18684,29 @@ async function runOp(sub, opts = {}, view, arg) {
         const data = await opCall({ method: "GET", path: `/operator/latency/grades${q}`, summary: "latency grades" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const t = data.thresholds_ms;
-        console.log(import_chalk71.default.bold("\nHow good was apiblaze itself?") + import_chalk71.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
-        console.log(import_chalk71.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
+        console.log(import_chalk72.default.bold("\nHow good was apiblaze itself?") + import_chalk72.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
+        console.log(import_chalk72.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
 `));
-        console.log(import_chalk71.default.dim("  date         reqs   excellent      okay       bad  terrible"));
+        console.log(import_chalk72.default.dim("  date         reqs   excellent      okay       bad  terrible"));
         for (const d of data.days ?? []) {
           const p = d.pct;
-          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk71.default.dim(`${String(v).padStart(5)}%`);
+          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk72.default.dim(`${String(v).padStart(5)}%`);
           console.log(
-            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk71.default.green)}  ${cell(p.okay, import_chalk71.default.cyan)}  ${cell(p.bad, import_chalk71.default.yellow)}  ${cell(p.terrible, import_chalk71.default.red)}`
+            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk72.default.green)}  ${cell(p.okay, import_chalk72.default.cyan)}  ${cell(p.bad, import_chalk72.default.yellow)}  ${cell(p.terrible, import_chalk72.default.red)}`
           );
         }
         const cul = data.culprits ?? [];
         if (cul.length) {
-          console.log(import_chalk71.default.bold("\n  Who caused the bad and terrible ones\n"));
-          console.log(import_chalk71.default.dim("     bad  terrible  feature \u2192 dependency"));
+          console.log(import_chalk72.default.bold("\n  Who caused the bad and terrible ones\n"));
+          console.log(import_chalk72.default.dim("     bad  terrible  feature \u2192 dependency"));
           for (const r of cul.slice(0, 12)) {
             if (!r.bad && !r.terrible) continue;
             console.log(
-              `  ${String(r.bad).padStart(6)}  ${import_chalk71.default.red(String(r.terrible).padStart(8))}  ${import_chalk71.default.yellow(r.feature)} ${import_chalk71.default.dim("\u2192")} ${import_chalk71.default.cyan(r.dep)}`
+              `  ${String(r.bad).padStart(6)}  ${import_chalk72.default.red(String(r.terrible).padStart(8))}  ${import_chalk72.default.yellow(r.feature)} ${import_chalk72.default.dim("\u2192")} ${import_chalk72.default.cyan(r.dep)}`
             );
           }
         }
-        if (data.caveat) console.log(import_chalk71.default.dim(`
+        if (data.caveat) console.log(import_chalk72.default.dim(`
   \u26A0 ${data.caveat}
 `));
         return;
@@ -18581,24 +18715,24 @@ async function runOp(sub, opts = {}, view, arg) {
         const data = await opCall({ method: "GET", path: `/operator/latency/compare${q}`, summary: "latency before/after" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const b = data.before, a = data.after, d = data.delta;
-        console.log(import_chalk71.default.bold(`
-Before vs after: `) + import_chalk71.default.cyan(data.marker.label));
-        console.log(import_chalk71.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
+        console.log(import_chalk72.default.bold(`
+Before vs after: `) + import_chalk72.default.cyan(data.marker.label));
+        console.log(import_chalk72.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
 `));
         const row = (name, before, after, delta) => {
           const arrow = delta === 0 ? "=" : delta < 0 ? "\u2193" : "\u2191";
           const txt = `${String(before).padStart(6)}ms  \u2192${String(after).padStart(7)}ms   ${arrow}${Math.abs(delta)}ms`;
-          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk71.default.green(txt) : import_chalk71.default.red(txt) : import_chalk71.default.dim(txt)}`);
+          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk72.default.green(txt) : import_chalk72.default.red(txt) : import_chalk72.default.dim(txt)}`);
         };
-        console.log(import_chalk71.default.dim("  metric                 before        after      change"));
+        console.log(import_chalk72.default.dim("  metric                 before        after      change"));
         row("total p50", b.total_p50, a.total_p50, d.total_p50);
         row("total p95", b.total_p95, a.total_p95, d.total_p95);
         row("apiblaze overhead p50", b.gw_p50, a.gw_p50, d.gw_p50);
         row("apiblaze overhead p95", b.gw_p95, a.gw_p95, d.gw_p95);
-        console.log(import_chalk71.default.dim(`
+        console.log(import_chalk72.default.dim(`
   requests: ${b.requests} before \xB7 ${a.requests} after`));
         for (const w of data.warnings ?? []) {
-          console.log((data.trustworthy ? import_chalk71.default.dim : import_chalk71.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
+          console.log((data.trustworthy ? import_chalk72.default.dim : import_chalk72.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
         }
         console.log("");
         return;
@@ -18607,19 +18741,19 @@ Before vs after: `) + import_chalk71.default.cyan(data.marker.label));
         const data = await opCall({ method: "GET", path: `/operator/latency/slow${q}`, summary: "slowest requests" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk71.default.dim("No requests over the threshold in that window."));
-        console.log(import_chalk71.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk72.default.dim("No requests over the threshold in that window."));
+        console.log(import_chalk72.default.bold(`
 Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
 `));
-        console.log(import_chalk71.default.dim("  total   ours   theirs  blame                 request id"));
+        console.log(import_chalk72.default.dim("  total   ours   theirs  blame                 request id"));
         for (const r of rows2.slice(0, 30)) {
           console.log(
-            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk71.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk71.default.dim(r.request_id || "")}`
+            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk72.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk72.default.dim(r.request_id || "")}`
           );
         }
-        console.log(import_chalk71.default.dim(`
+        console.log(import_chalk72.default.dim(`
   The last column is the request id (Cloudflare calls it a "cf-ray"). Look one up with`));
-        console.log(import_chalk71.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
+        console.log(import_chalk72.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
 `));
         return;
       }
@@ -18627,18 +18761,18 @@ Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
         const data = await opCall({ method: "GET", path: `/operator/latency/llm${q}`, summary: "llm latency" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk71.default.dim("No LLM traffic in that window."));
-        console.log(import_chalk71.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk72.default.dim("No LLM traffic in that window."));
+        console.log(import_chalk72.default.bold(`
 LLM timing \u2014 last ${data.window_hours}h
 `));
-        console.log(import_chalk71.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
+        console.log(import_chalk72.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
         for (const r of rows2) {
           const n = r.turns ?? r.requests ?? 0;
           console.log(
             `  ${String(Math.round(n)).padStart(8)}   ${String(Math.round(r.turn_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.ttfc_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.gen_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms ?? 0)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95 ?? 0)).padStart(6)}/${String(Math.round(r.output_tokens_p95 ?? 0)).padEnd(6)}   ${r.model || "-"}`
           );
         }
-        console.log(import_chalk71.default.dim(`
+        console.log(import_chalk72.default.dim(`
   ${data.note}
 `));
         return;
@@ -18649,26 +18783,26 @@ LLM timing \u2014 last ${data.window_hours}h
       ]);
       if (opts.json) return void console.log(JSON.stringify({ blame, summary }, null, 2));
       const ov = summary?.apiblaze_overhead_ms ?? {};
-      console.log(import_chalk71.default.bold(`
+      console.log(import_chalk72.default.bold(`
 Latency \u2014 last ${summary?.window_hours ?? "?"}h, ${Number(summary?.requests ?? 0).toLocaleString()} requests
 `));
-      console.log(`  ${import_chalk71.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk71.default.dim("\u2190 ours")}`);
-      console.log(`  ${import_chalk71.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk71.default.dim("\u2190 theirs")}`);
-      console.log(import_chalk71.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
+      console.log(`  ${import_chalk72.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk72.default.dim("\u2190 ours")}`);
+      console.log(`  ${import_chalk72.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk72.default.dim("\u2190 theirs")}`);
+      console.log(import_chalk72.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
 `));
       const rows = blame?.blame ?? [];
-      if (!rows.length) return void console.log(import_chalk71.default.dim("No latency rows in that window."));
-      console.log(import_chalk71.default.bold("  Which feature ate the time, and what inside it\n"));
-      console.log(import_chalk71.default.dim("   share   p95      feature \u2192 dependency"));
+      if (!rows.length) return void console.log(import_chalk72.default.dim("No latency rows in that window."));
+      console.log(import_chalk72.default.bold("  Which feature ate the time, and what inside it\n"));
+      console.log(import_chalk72.default.dim("   share   p95      feature \u2192 dependency"));
       for (const r of rows.slice(0, 15)) {
         const share = `${(r.share * 100).toFixed(1)}%`;
-        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk71.default.yellow(r.feature)} ${import_chalk71.default.dim("\u2192")} ${import_chalk71.default.cyan(r.dep)}`);
+        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk72.default.yellow(r.feature)} ${import_chalk72.default.dim("\u2192")} ${import_chalk72.default.cyan(r.dep)}`);
       }
       console.log("");
       return;
     }
     default:
-      console.log(import_chalk71.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk72.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 function printDistance(data) {
@@ -18676,17 +18810,17 @@ function printDistance(data) {
   const p = (v) => `${n(v).toFixed(1)}%`;
   const msf = (v) => `${Math.round(n(v))}ms`;
   const thr = n(data?.threshold_ms) || 50;
-  const scope = data?.team ? ` \xB7 team ${data.team}` : "";
-  console.log(import_chalk71.default.bold(`
-Durable Object distance \u2014 last ${data?.window_hours ?? "?"}h${scope}, ${n(data?.total_requests).toLocaleString()} requests, ${n(data?.do_calls).toLocaleString()} DO calls
+  const scope2 = data?.team ? ` \xB7 team ${data.team}` : "";
+  console.log(import_chalk72.default.bold(`
+Durable Object distance \u2014 last ${data?.window_hours ?? "?"}h${scope2}, ${n(data?.total_requests).toLocaleString()} requests, ${n(data?.do_calls).toLocaleString()} DO calls
 `));
   console.log(
-    `  ${import_chalk71.default.bold(p(data?.requests_with_do_call_pct))} of requests made a Durable Object call; ${import_chalk71.default.bold(p(data?.far_pct))} of those crossed colos; ${import_chalk71.default.bold((n(data?.problem_pct?.of_all_requests) >= 1 ? import_chalk71.default.red : import_chalk71.default.green)(p(data?.problem_pct?.of_all_requests)))} of all requests paid > ${thr} ms of distance.`
+    `  ${import_chalk72.default.bold(p(data?.requests_with_do_call_pct))} of requests made a Durable Object call; ${import_chalk72.default.bold(p(data?.far_pct))} of those crossed colos; ${import_chalk72.default.bold((n(data?.problem_pct?.of_all_requests) >= 1 ? import_chalk72.default.red : import_chalk72.default.green)(p(data?.problem_pct?.of_all_requests)))} of all requests paid > ${thr} ms of distance.`
   );
-  console.log(import_chalk71.default.dim(`  (${p(data?.problem_pct?.of_do_calls)} of DO calls over ${thr} ms network \xB7 entry or object colo unknown on ${p(data?.unknown_pct)} of calls)
+  console.log(import_chalk72.default.dim(`  (${p(data?.problem_pct?.of_do_calls)} of DO calls over ${thr} ms network \xB7 entry or object colo unknown on ${p(data?.unknown_pct)} of calls)
 `));
   const nm = data?.network_ms ?? {};
-  console.log(import_chalk71.default.dim("  network ms          calls      p50     p95     p99   >thr"));
+  console.log(import_chalk72.default.dim("  network ms          calls      p50     p95     p99   >thr"));
   const line = (label3, r) => {
     if (!r) return;
     console.log(
@@ -18700,32 +18834,32 @@ Durable Object distance \u2014 last ${data?.window_hours ?? "?"}h${scope}, ${n(d
   line("kind: throttle", nm.throttle);
   const modes = data?.by_mode ?? [];
   if (modes.length) {
-    console.log(import_chalk71.default.dim("\n  mode               calls   share     p95   >thr"));
+    console.log(import_chalk72.default.dim("\n  mode               calls   share     p95   >thr"));
     for (const m of modes) {
       console.log(`  ${String(m.mode).padEnd(14)} ${String(n(m.calls).toLocaleString()).padStart(9)}  ${p(m.share_pct).padStart(6)} ${msf(m.p95_ms).padStart(7)}  ${String(n(m.problem_calls).toLocaleString()).padStart(5)}`);
     }
   }
   const routes = data?.routes ?? [];
   if (routes.length) {
-    console.log(import_chalk71.default.bold("\n  Routes (worker colo \u2192 object colo)") + import_chalk71.default.dim(`  added ms = network above the same-colo p50 (${msf(data?.same_colo_p50_baseline_ms)}), summed`));
-    console.log(import_chalk71.default.dim("  route              calls     p50     p95     added ms"));
+    console.log(import_chalk72.default.bold("\n  Routes (worker colo \u2192 object colo)") + import_chalk72.default.dim(`  added ms = network above the same-colo p50 (${msf(data?.same_colo_p50_baseline_ms)}), summed`));
+    console.log(import_chalk72.default.dim("  route              calls     p50     p95     added ms"));
     for (const r of routes) {
       const cross = r.worker_colo !== r.object_colo;
       const route = `${r.worker_colo} \u2192 ${r.object_colo}`;
-      console.log(`  ${(cross ? import_chalk71.default.yellow : import_chalk71.default.dim)(route.padEnd(16))} ${String(n(r.calls).toLocaleString()).padStart(8)} ${msf(r.p50_ms).padStart(7)} ${msf(r.p95_ms).padStart(7)} ${String(n(r.added_ms_total).toLocaleString()).padStart(12)}`);
+      console.log(`  ${(cross ? import_chalk72.default.yellow : import_chalk72.default.dim)(route.padEnd(16))} ${String(n(r.calls).toLocaleString()).padStart(8)} ${msf(r.p50_ms).padStart(7)} ${msf(r.p95_ms).padStart(7)} ${String(n(r.added_ms_total).toLocaleString()).padStart(12)}`);
     }
   }
   const teams = data?.teams ?? [];
   if (teams.length) {
-    console.log(import_chalk71.default.bold(`
+    console.log(import_chalk72.default.bold(`
   Teams paying the most distance (> ${thr} ms)`));
-    console.log(import_chalk71.default.dim("  >thr calls  of calls  object colo  worker colos             team"));
+    console.log(import_chalk72.default.dim("  >thr calls  of calls  object colo  worker colos             team"));
     for (const t of teams) {
       const w = (t.top_worker_colos ?? []).map((x) => `${x.colo} ${n(x.problem_calls).toLocaleString()}`).join(", ");
-      console.log(`  ${String(n(t.problem_calls).toLocaleString()).padStart(10)}  ${p(t.problem_pct).padStart(8)}  ${String(t.dominant_object_colo).padEnd(11)}  ${w.padEnd(24)} ${import_chalk71.default.dim(t.team)}`);
+      console.log(`  ${String(n(t.problem_calls).toLocaleString()).padStart(10)}  ${p(t.problem_pct).padStart(8)}  ${String(t.dominant_object_colo).padEnd(11)}  ${w.padEnd(24)} ${import_chalk72.default.dim(t.team)}`);
     }
   } else if (!n(data?.do_calls)) {
-    console.log(import_chalk71.default.dim("\n  No Durable Object calls in that window (warm leases write no gate rows)."));
+    console.log(import_chalk72.default.dim("\n  No Durable Object calls in that window (warm leases write no gate rows)."));
   }
   console.log("");
 }
@@ -18791,7 +18925,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Lock resources to the person who created them \u2014 or describe any access rule in plain English (that one is billed per turn)").argument("<project>", "Project name or id").argument("[sentence]", 'Optional rule in plain English, e.g. "users see only their own rows". Omit to pick from what the spec can protect.').option("--enforce", "Turn enforcement on right after saving (default: save in shadow mode, then ask)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((project, sentence, opts) => runRule(project, sentence, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-var mcpCmd = program.command("mcp").description("Optional tweaks to a proxy's MCP server: prompts, per-tool behavior (read-only / destructive / confirm / always-async), UI resource");
+var mcpCmd = program.command("mcp").description("Optional tweaks to a proxy's MCP server: prompts, per-tool behavior (title / read-only / destructive / confirm / always-async), UI resource");
 var mcpCommon = (c) => c.option("--apiversion <version>", "API version (defaults to the project's)").option("--environment <env>", "Catalogue environment (default: prod)").option("--json", "Output machine-readable JSON");
 var mcpPrompts = mcpCmd.command("prompts").description("Prompts the MCP server offers (drafted by the MCP agent; editable here)");
 mcpCommon(mcpPrompts.command("list").description("List the prompts").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpPrompts("list", project, void 0, opts)));
@@ -18800,7 +18934,7 @@ mcpCommon(mcpPrompts.command("set").description("Add or replace a prompt from a
 mcpCommon(mcpPrompts.command("rm").description("Remove a prompt").argument("<project>", "Project name or id").argument("<name>", "Prompt name")).action(action((project, name, opts) => runMcpPrompts("rm", project, name, opts)));
 var mcpOps = mcpCmd.command("ops").description("Per-tool behavior. Default from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm");
 mcpCommon(mcpOps.command("list").description("Every tool with its effective behavior (overrides marked)").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpOps("list", project, void 0, opts)));
-mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
+mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--title <text>", "Human label clients and directories show (default: the OpenAPI summary, else the name spelled out)").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
 mcpCommon(mcpOps.command("reset").description("Back to the automatic default for one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpOps("reset", project, tool, opts)));
 mcpCommon(mcpCmd.command("ui").description("Print a tool's MCP Apps UI resource (ui://{project}/{tool}) \u2014 the automatic viewer").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpUi(project, tool, opts)));
 program.command("apichat [project]").alias("chat").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {
@@ -18824,7 +18958,7 @@ program.command("dev").description(`Put the app running on THIS machine on the i
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk72.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk73.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ ...opts, port: resolved });
@@ -18936,6 +19070,18 @@ program.command("preapprove").description("Allow an email or company domain to s
 var tenant = program.command("tenant").description("Manage tenants \u2014 bare command opens the interactive picker (settings, OAuth sign-in providers, app clients)").action(action(() => runTenantManage(void 0, {})));
 tenant.command("manage").description("Browse & edit one tenant: settings, OAuth sign-in providers (swap or add one \u2014 this is how you change sign-in after create), login app clients, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
 tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
+var tenantPassword = tenant.command("password").description("APIblaze-hosted username & password sign-in on a tenant (reviewer / test accounts; advanced)");
+var tenantArg = (cmd) => cmd.argument("[tenant]", "Tenant (defaults to your tenant scope, else a picker)").option("--tenant <slug>", "Same as the positional").option("--json", "Output machine-readable JSON");
+tenantArg(tenantPassword.command("enable").description("Add username & password sign-in to the tenant's login (idempotent)")).action(action((t, opts) => runTenantPasswordEnable(t, opts)));
+tenantArg(tenantPassword.command("disable").description("Remove username & password sign-in from the tenant (deletes its accounts)")).option("-y, --yes", "Skip the confirmation").action(action((t, opts) => runTenantPasswordDisable(t, opts)));
+tenantArg(tenantPassword.command("list").description("List the accounts")).action(action((t, opts) => runTenantPasswordList(t, opts)));
+var accountCmd = (name, desc) => tenantArg(tenantPassword.command(name).description(desc).argument("<username>", "3\u201364 chars: a\u2013z 0\u20139 . _ -"));
+accountCmd("add", "Create an account; the password is generated and printed once (or read from stdin with --password-stdin)").option("--email <email>", "Optional: lets a pre-provisioned user/admin with this address adopt the login").option("--display-name <name>", "Display name").option("--purpose <user|reviewer>", "`reviewer` marks a directory test account").option("--password-stdin", "Read the password from stdin instead of generating one").action(action((username, t, opts) => runTenantPasswordAdd(username, t, opts)));
+accountCmd("rotate", "New password (generated, printed once; or --password-stdin); existing sessions end at their next refresh").option("--password-stdin", "Read the new password from stdin").action(action((username, t, opts) => runTenantPasswordRotate(username, t, opts)));
+accountCmd("block", "Refuse sign-in for an account (keeps it)").action(action((username, t, opts) => runTenantPasswordSetBlocked(username, t, true, opts)));
+accountCmd("unblock", "Allow sign-in again").action(action((username, t, opts) => runTenantPasswordSetBlocked(username, t, false, opts)));
+accountCmd("unlock", "Clear the lockout after repeated failed sign-ins").action(action((username, t, opts) => runTenantPasswordUnlock(username, t, opts)));
+accountCmd("remove", "Delete an account").option("-y, --yes", "Skip the confirmation").action(action((username, t, opts) => runTenantPasswordRemove(username, t, opts)));
 tenant.command("list").description("List tenants in your team (--q searches server-side)").option("--q <search>", "Filter by tenant name or display name").option("--limit <n>", "Page size (max 200)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
 tenant.command("create").description("Create a tenant in your team (tenant names are lowercase alphanumeric and globally unique)").requiredOption("--name <name>", "Tenant name \u2014 becomes the slug ({name}.portal.apiblaze.com) unless --slug overrides; also the display label").option("--slug <tenant_name>", "Explicit tenant slug when it should differ from --name").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--no-login", "Do not give the tenant a dev-portal sign-in (by default it gets the zero-config GitHub one, unless it already has one)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
@@ -18994,7 +19140,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk72.default.bold(g.title)}
+    return `${import_chalk73.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -19007,7 +19153,7 @@ program.configureHelp({
 program.addHelpText("before", () => isBetaCached() ? `${betaNotice()}
 ` : "");
 program.addHelpText("after", () => `
-${import_chalk72.default.bold("Don't like reading docs?")} Run ${import_chalk72.default.bgCyan.black.bold(` npx ${B.cli} docs `)} ${import_chalk72.default.cyan(`\u2014 ask an AI chatbot about ${B.product}, and let it act on your account.`)}
+${import_chalk73.default.bold("Don't like reading docs?")} Run ${import_chalk73.default.bgCyan.black.bold(` npx ${B.cli} docs `)} ${import_chalk73.default.cyan(`\u2014 ask an AI chatbot about ${B.product}, and let it act on your account.`)}
 
 ${groupedCommandHelp()}
 
@@ -19044,14 +19190,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk72.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk73.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk72.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk72.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk73.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk73.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -19063,28 +19209,28 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk72.default.red(`
+    console.error(import_chalk73.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk72.default.red(`
+    console.error(import_chalk73.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk72.default.red("\nUnknown error"));
+    console.error(import_chalk73.default.red("\nUnknown error"));
   }
 }
 function hintStaleCacheOnUnknownOption(cmd) {
   cmd.exitOverride((err) => {
     if (err.code === "commander.unknownOption") {
-      console.error(import_chalk72.default.yellow(
+      console.error(import_chalk73.default.yellow(
         `
 This is ${B.cli} v${version}. If that option is documented but this build
 does not have it, your npx cache is serving an older copy \u2014 re-run as:
 `
       ));
-      console.error(import_chalk72.default.cyan(`  npx ${B.cli}@latest ${process.argv.slice(2).join(" ")}
+      console.error(import_chalk73.default.cyan(`  npx ${B.cli}@latest ${process.argv.slice(2).join(" ")}
 `));
     }
     process.exit(err.exitCode);